desenmascara.me API
desenmascara.me API from Desenmascara.me — 2 path(s) described in OpenAPI.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/desenmascara-me:desenmascara-me-openapi"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.0.3
info:
title: desenmascara.me API
version: '1.0'
description: 'Fraud-detection intelligence API. Analyze any domain and get a clear verdict
(**LEGIT / SUSPICIOUS / FRAUDULENT**), a 0‑100 risk score, structured signals,
and a natural-language justification — cross-checked against alerts from 55+
financial regulators worldwide, phishing feeds, Tranco, WHOIS and our own
detection engines (brand & government impersonation, ClickFix, AI-agent traps,
cloaking, phishing kits).
### Authentication
All B2B endpoints use an API key sent in the `X-API-Key` header
(format `dm_...`). Create and revoke keys in your [dashboard](https://desenmascara.me/dashboard).
B2B API-key access also requires an **approved egress/source IP**.
Non-approved IPs receive `403` with `error_code: api_ip_not_allowed`.
Contact us to allowlist your IPs.
### Plans
| Plan | Domain check | Fraud feed | Searches | Actor intel |
|------|--------------|------------|----------|-------------|
| Citizen (€39/mo) | 100/day | — | domain search | — |
| Startup (€590/mo) | 10,000/month | ✓ | all | ✓ |
| Enterprise | unlimited | ✓ | all | ✓ |
Get a plan at [desenmascara.me/pro](https://desenmascara.me/pro).
'
contact:
name: desenmascara.me
url: https://desenmascara.me/contact
servers:
- url: https://desenmascara.me
security:
- ApiKeyAuth: []
tags:
- name: Domain Check
description: On-demand fraud analysis of any domain.
- name: Fraud Feed
description: Pull-based incremental feed of newly recorded verdicts (Startup+).
- name: Search
description: Query the analyzed-domain corpus.
- name: Threat Intel
description: Actor clustering across shared infrastructure (Startup+).
- name: Public
description: Public, unauthenticated endpoints.
paths:
/api/v1/unmask/:
post:
tags:
- Domain Check
summary: Analyze a domain
description: 'Analyze a domain for fraud intent. Returns verdict, AI risk score (0‑100),
structured signals and justification.
**Synchronous mode (default)**: blocks until the analysis is ready
(typically 10‑40s; cached results return instantly).
**Asynchronous mode** (`"async": true`): returns `202 Accepted`
immediately. Poll the same endpoint with the same body every
`retry_after` seconds until you receive `200` with
`analysis_status: "full"`.
Plans: Citizen (100/day) · Startup (10,000/month) · Enterprise (unlimited).
'
operationId: unmaskDomain
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- domain
properties:
domain:
type: string
description: Domain to analyze.
example: example.com
async:
type: boolean
default: false
description: '`true` for async mode (202 + polling).'
lang:
type: string
enum:
- es
- en
description: Response language. Default auto-detect.
force:
type: boolean
default: false
description: Force re-analysis (bypass cache).
include_raw:
type: boolean
default: false
description: Include raw HTML and HTTP headers in the response.
final_only:
type: boolean
default: true
description: Wait for the complete analysis (`false` may return preliminary results).
responses:
'200':
description: Full analysis result.
content:
application/json:
schema:
$ref: '#/components/schemas/AnalysisResult'
'202':
description: Analysis accepted and running in the background (async mode). Poll again after `retry_after` seconds.
headers:
Retry-After:
schema:
type: integer
description: Seconds to wait before polling again.
content:
application/json:
schema:
type: object
properties:
domain:
type: string
example: suspicious-site.com
canonical_domain:
type: string
analysis_status:
type: string
example: fast
retry_after:
type: integer
example: 5
pending_started_at:
type: string
format: date-time
'401':
$ref: '#/components/responses/Unauthorized'
'402':
$ref: '#/components/responses/PlanRequired'
'403':
$ref: '#/components/responses/IpNotAllowed'
'429':
description: Rate limit exceeded.
'502':
description: The site is unreachable (no HTTP response from any path). No verdict is issued for unreachable sites.
'504':
description: Analysis timed out, or the site did not respond in time.
/api/account/fraud-feed/:
get:
tags:
- Fraud Feed
summary: Incremental verdict feed
description: 'Pull-based incremental feed of newly recorded verdicts, designed for B2B
integrations (ad platforms, signup funnels, payment risk, moderation,
SOC automation).
**Cursor flow**: start with `cursor=0`, store the returned `next_cursor`,
and call again with `cursor=<next_cursor>` to fetch only newer items.
Plans: Startup · Enterprise.
'
operationId: fraudFeed
parameters:
- name: cursor
in: query
schema:
type: integer
default: 0
description: Last seen cursor (exclusive).
- name: limit
in: query
schema:
type: integer
default: 50
minimum: 1
maximum: 200
- name: veredicts
in: query
schema:
type: string
default: FRAUDULENT
description: 'Comma-separated verdicts: `FRAUDULENT`, `SUSPICIOUS`, `LEGIT`.'
example: FRAUDULENT,SUSPICIOUS
responses:
'200':
description: Feed page.
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
type: object
properties:
cursor:
type: integer
example: 12345
analyzed_at:
type: string
format: date-time
domain:
type: string
example: example-scam.test
veredict:
type: string
example: FRAUDULENT
public_id:
type: string
format: uuid
domain_ip:
type: string
nullable: true
server_country:
type: string
nullable: true
ai_score:
type: number
nullable: true
next_cursor:
type: integer
limit:
type: integer
veredicts:
type: array
items:
type: string
components:
schemas:
AnalysisResult:
type: object
description: Referenced by this document but never defined in it. API Evangelist added this empty placeholder so the document resolves;
the shape is unknown and is NOT a claim about the API.
x-ae-placeholder: true
responses:
Unauthorized:
description: Referenced by this document but never defined in it. API Evangelist added this empty placeholder so the document resolves;
the shape is unknown and is NOT a claim about the API.
x-ae-placeholder: true
PlanRequired:
description: Referenced by this document but never defined in it. API Evangelist added this empty placeholder so the document resolves;
the shape is unknown and is NOT a claim about the API.
x-ae-placeholder: true
IpNotAllowed:
description: Referenced by this document but never defined in it. API Evangelist added this empty placeholder so the document resolves;
the shape is unknown and is NOT a claim about the API.
x-ae-placeholder: true