CrawlCheck High Risk API
The High Risk API from CrawlCheck — 2 operation(s) for high risk.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/crawlcheck-io:crawlcheck-io-high-risk-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Crawlcheck Io High Risk API
version: '1'
contact:
name: CrawlCheck
url: https://crawlcheck.io/policy
email: hello@crawlcheck.io
license:
name: Terms
url: https://crawlcheck.io/policy
x-core-contract:
promise: 'These operations are the core contract. They stay at /api/v1 and keep answering for at least 180 days after any /api/v2 is announced; their stable fields change only in a new major version, and their provisional fields only after 30 days'' notice, per /docs/api/compatibility. Verifying what they return needs none of these calls: crawlcheck-verify.mjs checks a document on your machine against the published keys (/.well-known/http-message-signatures-directory) and the rotation record, read once with --online or saved for --keys. Everything else documented here is useful but secondary, and may change with the notice its fields'' tags promise.'
operations:
- method: GET
path: /api/v1/resolve
operationId: resolveDomainV1
- method: POST
path: /api/v1/resolve
operationId: resolveBatchV1
- method: POST
path: /api/v1/preflight
operationId: preflightV1
- method: GET
path: /api/v1/decisions/{sha256}
operationId: decisionCheckV1
- method: GET
path: /api/v1/revocations
operationId: revocations
- method: GET
path: /api/v1/visitor
operationId: visitorResolveV1
- method: POST
path: /api/v1/visitor
operationId: visitorResolveBatchV1
- method: GET
path: /api/v1/mcp/scan
operationId: mcpScanUrl
- method: POST
path: /api/v1/mcp/lock/check
operationId: mcpLockCheck
list: https://crawlcheck.io/api/v1/core
description: 'Operations tagged High Risk across 2 of this provider''s published API definitions: crawlcheck-io-openapi.json, crawlcheck-io-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://crawlcheck.io
tags:
- name: High Risk
paths:
/api/v1/high-risk:
get:
operationId: highRiskWatch
summary: 'High-risk field watch for a domain (?domain=): payment processors, checkout…'
parameters:
- name: domain
in: query
required: false
schema:
type: string
- name: fresh
in: query
required: false
schema:
type: string
enum:
- '1'
responses:
'200':
description: crawlcheck-high-risk
content:
application/json:
examples:
worked:
value:
kind: crawlcheck-high-risk
v: 1
domain: shop.example.com
state: changed_unconfirmed
watched_since: '2026-10-01T12:02:00.000Z'
read_at: '2026-10-07T12:02:00.000Z'
fields:
payment_processors:
value:
- stripe
since: '2026-10-01T12:02:00.000Z'
checkout_host:
value: same_site
since: '2026-10-01T12:02:00.000Z'
wallet_addresses:
value: []
since: '2026-10-01T12:02:00.000Z'
oauth_authorization_server:
value: null
since: '2026-10-01T12:02:00.000Z'
mx_hosts:
value:
- aspmx.l.google.com
since: '2026-10-01T12:02:00.000Z'
mcp_endpoints:
value: []
since: '2026-10-01T12:02:00.000Z'
pending:
- field: checkout_host
from: same_site
to: pay-shop-example.com
changed_at: '2026-10-07T12:02:00.000Z'
previous_value_since: '2026-10-01T12:02:00.000Z'
age_days: 0
blocks_transact: true
unread: []
reading: '1 high-risk field(s) changed and the owner has not confirmed the change: checkout_host. transact is block until the claim holder confirms (POST /api/v1/high-risk/confirm) or 7 days pass'
history: []
rule: https://crawlcheck.io/rules#HIGH_RISK_FIELD_CHANGED
method: …
sha256: …
signature: …
schema:
type:
- object
- 'null'
properties:
kind:
type:
- string
- 'null'
v:
type:
- number
- 'null'
domain:
type:
- string
- 'null'
state:
type:
- string
- 'null'
watched_since:
type:
- string
- 'null'
read_at:
type:
- string
- 'null'
fields:
type:
- object
- 'null'
properties:
payment_processors:
type:
- object
- 'null'
properties:
value:
type:
- array
- 'null'
items:
type:
- string
- 'null'
since:
type:
- string
- 'null'
additionalProperties: true
checkout_host:
type:
- object
- 'null'
properties:
value:
type:
- string
- 'null'
since:
type:
- string
- 'null'
additionalProperties: true
wallet_addresses:
type:
- object
- 'null'
properties:
value:
type:
- array
- 'null'
items: {}
since:
type:
- string
- 'null'
additionalProperties: true
oauth_authorization_server:
type:
- object
- 'null'
properties:
value: {}
since:
type:
- string
- 'null'
additionalProperties: true
mx_hosts:
type:
- object
- 'null'
properties:
value:
type:
- array
- 'null'
items:
type:
- string
- 'null'
since:
type:
- string
- 'null'
additionalProperties: true
mcp_endpoints:
type:
- object
- 'null'
properties:
value:
type:
- array
- 'null'
items: {}
since:
type:
- string
- 'null'
additionalProperties: true
additionalProperties: true
pending:
type:
- array
- 'null'
items:
type:
- object
- 'null'
properties:
field:
type:
- string
- 'null'
from:
type:
- string
- 'null'
to:
type:
- string
- 'null'
changed_at:
type:
- string
- 'null'
previous_value_since:
type:
- string
- 'null'
age_days:
type:
- number
- 'null'
blocks_transact:
type:
- boolean
- 'null'
additionalProperties: true
unread:
type:
- array
- 'null'
items: {}
reading:
type:
- string
- 'null'
history:
type:
- array
- 'null'
items: {}
rule:
type:
- string
- 'null'
method: {}
sha256: {}
signature: {}
additionalProperties: true
x-schema-source: worked-example
x-codeSamples:
- lang: Shell
label: curl
source: curl -s 'https://crawlcheck.io/api/v1/high-risk?domain=shop.example.com'
security: []
x-auth: public; no credential read
tags:
- High Risk
servers:
- url: https://crawlcheck.io
/api/v1/high-risk/confirm:
post:
operationId: highRiskConfirm
summary: The domain claim holder confirms the pending high-risk changes ({domain} with…
parameters:
- name: x-crawlcheck-key
in: header
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
examples:
worked:
summary: The request behind the worked response
value:
domain: shop.example.com
responses:
'200':
description: crawlcheck-high-risk
content:
application/json:
examples:
worked:
value:
kind: crawlcheck-high-risk
v: 1
domain: shop.example.com
confirmed:
- checkout_host
at: '2026-10-07T12:30:00.000Z'
reading: the current values of checkout_host are now the confirmed baseline; transact returns to what the measurements say
sha256: …
signature: …
schema:
type:
- object
- 'null'
properties:
kind:
type:
- string
- 'null'
v:
type:
- number
- 'null'
domain:
type:
- string
- 'null'
confirmed:
type:
- array
- 'null'
items:
type:
- string
- 'null'
at:
type:
- string
- 'null'
reading:
type:
- string
- 'null'
sha256: {}
signature: {}
additionalProperties: true
x-schema-source: worked-example
'403':
description: not the claim holder
x-codeSamples:
- lang: Shell
label: curl
source: 'curl -s -X POST ''https://crawlcheck.io/api/v1/high-risk/confirm'' -H ''x-crawlcheck-key: cc_…'' -H ''content-type: application/json'' -d ''{"domain":"shop.example.com"}'''
security: []
x-auth: public; no credential read
x-crawlcheck-budget:
request_body_max: 1048576
rate_limit: 'shared: 30 calls per address per UTC hour across the MCP checks, anchors, origin, incidents and high-risk confirm (429)'
tags:
- High Risk
servers:
- url: https://crawlcheck.io
components:
securitySchemes:
licenceKey:
type: apiKey
in: header
name: x-crawlcheck-key
description: 'Your licence key: cc_ followed by 32 hex characters. Sent on every keyed call.'
bearer:
type: http
scheme: bearer
description: The same licence key as a Bearer token. Accepted on /api/v1/* and /api/usage.
externalDocs:
url: https://crawlcheck.io/docs/api
description: Human-readable reference
x-refined-from:
- crawlcheck-io-openapi.json
- crawlcheck-io-openapi.yml