Properties
| Name | Type | Description |
|---|---|---|
| schema_version | string | |
| request_id | string | |
| checked_at | string | RFC 3339 UTC. |
| engine | string | |
| models | object | |
| input | object | |
| verdict | string | |
| p_scam | number | Probability that the input is part of a scam. |
| risk_score | integer | |
| confidence | number | |
| classification | object | |
| reason_codes | array | The codes that decided the verdict, strongest first, at most 5. |
| entities | array | |
| signals | array | |
| degraded | boolean | |
| degraded_reasons | array | |
| cached | boolean | |
| explanation | object |
JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://artifacts.apis.io/bewary/json-schema/bewary-envelope-schema.json",
"title": "Envelope",
"description": "The answer of every lookup and check.",
"x-generated": "2026-11-02",
"x-method": "derived",
"x-generator": "derive-json-schema.py",
"x-source": "openapi/bewary-openapi.json#/components/schemas/Envelope",
"properties": {
"schema_version": {
"type": "string",
"title": "Schema Version"
},
"request_id": {
"type": "string",
"title": "Request Id"
},
"checked_at": {
"type": "string",
"title": "Checked At",
"description": "RFC 3339 UTC."
},
"engine": {
"type": "string",
"title": "Engine"
},
"models": {
"$ref": "#/$defs/ModelsUsed"
},
"input": {
"$ref": "#/$defs/InputInfo"
},
"verdict": {
"type": "string",
"enum": [
"scam",
"suspicious",
"safe",
"unknown"
],
"title": "Verdict"
},
"p_scam": {
"type": "number",
"maximum": 1.0,
"minimum": 0.0,
"title": "P Scam",
"description": "Probability that the input is part of a scam."
},
"risk_score": {
"type": "integer",
"maximum": 100.0,
"minimum": 0.0,
"title": "Risk Score"
},
"confidence": {
"type": "number",
"maximum": 1.0,
"minimum": 0.0,
"title": "Confidence"
},
"classification": {
"anyOf": [
{
"$ref": "#/$defs/Classification"
},
{
"type": "null"
}
]
},
"reason_codes": {
"items": {
"type": "string"
},
"type": "array",
"title": "Reason Codes",
"description": "The codes that decided the verdict, strongest first, at most 5."
},
"entities": {
"items": {
"$ref": "#/$defs/Entity"
},
"type": "array",
"title": "Entities"
},
"signals": {
"items": {
"$ref": "#/$defs/Signal"
},
"type": "array",
"title": "Signals"
},
"degraded": {
"type": "boolean",
"title": "Degraded"
},
"degraded_reasons": {
"items": {
"type": "string",
"enum": [
"source_timeout",
"source_unavailable",
"budget_limit",
"redirect_unresolved",
"input_truncated",
"model_unavailable",
"page_unavailable"
]
},
"type": "array",
"title": "Degraded Reasons"
},
"cached": {
"type": "boolean",
"title": "Cached"
},
"explanation": {
"anyOf": [
{
"$ref": "#/$defs/Explanation"
},
{
"type": "null"
}
]
}
},
"type": "object",
"required": [
"schema_version",
"request_id",
"checked_at",
"engine",
"models",
"input",
"verdict",
"p_scam",
"risk_score",
"confidence",
"reason_codes",
"entities",
"signals",
"degraded",
"degraded_reasons",
"cached"
],
"$defs": {
"AppFacts": {
"properties": {
"store": {
"anyOf": [
{
"type": "string",
"enum": [
"apple",
"google_play"
]
},
{
"type": "null"
}
],
"title": "Store"
},
"app_id": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "App Id",
"description": "Apple: the numeric App Store id. Google Play: the package name (application id)."
},
"status": {
"anyOf": [
{
"type": "string",
"enum": [
"live",
"removed",
"not_found",
"unknown"
]
},
{
"type": "null"
}
],
"title": "Status",
"description": "live: the store lists it now. removed: we saw it live before and the store no longer lists it. not_found: the store has no such app and we never saw it live. unknown: the store could not be read (degraded)."
},
"name": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Name",
"description": "The store's title for the app (from the last live sighting)."
},
"developer": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Developer",
"description": "The developer or seller name the store publishes (from the last live sighting)."
},
"rating_count": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"title": "Rating Count",
"description": "How many ratings the store shows (Apple: in that storefront)."
},
"storefront": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Storefront",
"description": "Apple: the App Store country read, ISO 3166-1 alpha-2."
},
"first_seen": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "First Seen",
"description": "The first time we saw it live, RFC 3339 UTC."
},
"last_seen": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Last Seen",
"description": "The last time we saw it live, RFC 3339 UTC."
},
"missing_since": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Missing Since",
"description": "The first check that found it gone after a live sighting, RFC 3339 UTC; null while live."
}
},
"additionalProperties": false,
"type": "object",
"title": "AppFacts",
"description": "A mobile app on the Apple App Store or Google Play (task E12, added 2026-10-29)."
},
"ArchiveHistory": {
"properties": {
"checked_at": {
"type": "string",
"title": "Checked At",
"description": "When we read the archive's index, RFC 3339 UTC. Kept for up to 30 days."
},
"captured": {
"type": "boolean",
"title": "Captured",
"description": "The archive holds at least one capture of the host's homepage."
},
"first_capture_at": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "First Capture At",
"description": "The first capture, RFC 3339 UTC; null when none."
},
"last_capture_at": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Last Capture At",
"description": "The latest capture, RFC 3339 UTC; null when none."
},
"captured_before_registration": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"title": "Captured Before Registration",
"description": "The homepage was captured more than 30 days before registered_at: the name had an earlier life before this registration (it lapsed and someone registered it again). Null when either date is unknown, or for a tenant of a hosting platform."
},
"months_before_registration": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"title": "Months Before Registration",
"description": "How many calendar months hold a capture before registered_at; null unless captured_before_registration."
},
"last_capture_before_registration_at": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Last Capture Before Registration At",
"description": "The last capture before registered_at, RFC 3339 UTC: the end of the earlier life."
}
},
"additionalProperties": false,
"type": "object",
"required": [
"checked_at",
"captured"
],
"title": "ArchiveHistory",
"description": "The site's history in a public web archive (E9): when its homepage was first and last captured, and whether\nit was captured before the current registration began (a name that lapsed and was registered again)."
},
"Brand": {
"properties": {
"id": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Id"
},
"name": {
"type": "string",
"title": "Name"
}
},
"type": "object",
"required": [
"name"
],
"title": "Brand"
},
"Classification": {
"properties": {
"artifact_type": {
"type": "string",
"title": "Artifact Type",
"description": "What the message is: delivery_notice, account_alert, otp_or_2fa_code and so on."
},
"stance": {
"type": "string",
"enum": [
"inbound_solicitation",
"user_own_record",
"ambiguous"
],
"title": "Stance"
},
"ask": {
"type": "string",
"enum": [
"none",
"pay",
"click_link",
"call_back",
"give_credentials",
"give_code",
"install_app",
"reply",
"other"
],
"title": "Ask"
},
"scam_type": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Scam Type",
"description": "Null until the calibrated classifier ships."
},
"impersonated_brand": {
"anyOf": [
{
"$ref": "#/$defs/Brand"
},
{
"type": "null"
}
]
},
"probabilities": {
"additionalProperties": {
"additionalProperties": {
"type": "number"
},
"type": "object"
},
"type": "object",
"title": "Probabilities"
}
},
"type": "object",
"required": [
"artifact_type",
"stance",
"ask"
],
"title": "Classification"
},
"ComplaintStats": {
"properties": {
"count": {
"type": "integer",
"title": "Count"
},
"days": {
"type": "integer",
"title": "Days",
"description": "Distinct days with a complaint."
},
"first_at": {
"type": "string",
"title": "First At",
"description": "First complaint day, 00:00Z."
},
"last_at": {
"type": "string",
"title": "Last At",
"description": "Last complaint day, 00:00Z."
},
"subjects": {
"additionalProperties": {
"type": "integer"
},
"type": "object",
"title": "Subjects",
"description": "FTC: subject code (imposters, debt_reduction, ...); FCC: call type (prerecorded_voice, live_voice, text_message, ...)."
},
"robocall_share": {
"type": "number",
"maximum": 1.0,
"minimum": 0.0,
"title": "Robocall Share",
"description": "FTC: recorded-message flag; FCC: prerecorded-voice share."
},
"daily": {
"items": {
"$ref": "#/$defs/DailyCount"
},
"type": "array",
"title": "Daily",
"description": "The last 90 days, only days with complaints, oldest first."
},
"reporter_states": {
"additionalProperties": {
"type": "integer"
},
"type": "object",
"title": "Reporter States",
"description": "Top 5 US states (USPS codes) of the people who complained."
},
"hours": {
"additionalProperties": {
"type": "integer"
},
"type": "object",
"title": "Hours",
"description": "Complaints by the hour of the call, \"0\" to \"23\", every hour present: the reporter's local time as they gave it (FCC: the call time; FTC: the call time when it was not given as midnight). 13 months."
},
"weekdays": {
"additionalProperties": {
"type": "integer"
},
"type": "object",
"title": "Weekdays",
"description": "Complaints by weekday of the complaint day, \"1\" (Monday) to \"7\", every day present. 13 months."
}
},
"additionalProperties": false,
"type": "object",
"required": [
"count",
"days",
"first_at",
"last_at",
"subjects",
"robocall_share",
"daily",
"reporter_states",
"hours",
"weekdays"
],
"title": "ComplaintStats",
"description": "One source's complaints about a number over the retained 13 months (DIRECTORY-CONTRACT.md).\nCounts only: never a complaint's text, a name or a place smaller than a state."
},
"DailyCount": {
"properties": {
"day": {
"type": "string",
"title": "Day",
"description": "YYYY-MM-DD."
},
"count": {
"type": "integer",
"title": "Count"
}
},
"additionalProperties": false,
"type": "object",
"required": [
"day",
"count"
],
"title": "DailyCount"
},
"DatasetRef": {
"properties": {
"dataset": {
"type": "string",
"enum": [
"registration",
"dns",
"certificates",
"web_archive",
"threat_feeds",
"threat_aggregates",
"brand_registry",
"web_pages",
"ip_network",
"phone_numbering",
"us_numbering",
"phone_complaints",
"honeypot_lines",
"phone_reports_de",
"shortcodes",
"email_providers",
"breaches",
"wallet_reports",
"sanctions",
"issuer_freezes",
"community_reports",
"campaigns",
"text_model",
"platform_pages",
"iban_registry",
"bank_codes",
"app_stores",
"short_links",
"payment_profiles"
],
"title": "Dataset"
},
"coverage": {
"type": "string",
"pattern": "^(WW|[A-Z]{2})$",
"title": "Coverage",
"description": "WW: worldwide. A country code (US, DE): the data describes only that country's numbers, codes or complaints."
},
"in_coverage": {
"type": "boolean",
"title": "In Coverage"
}
},
"type": "object",
"required": [
"dataset",
"coverage",
"in_coverage"
],
"title": "DatasetRef"
},
"DnsFacts": {
"properties": {
"resolves": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"title": "Resolves"
},
"a": {
"anyOf": [
{
"items": {
"type": "string"
},
"type": "array"
},
{
"type": "null"
}
],
"title": "A"
},
"mx": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"title": "Mx"
},
"ns": {
"anyOf": [
{
"items": {
"type": "string"
},
"type": "array"
},
{
"type": "null"
}
],
"title": "Ns"
}
},
"additionalProperties": false,
"type": "object",
"title": "DnsFacts"
},
"DomainFacts": {
"properties": {
"registrable_domain": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Registrable Domain",
"description": "The owner boundary per the Public Suffix List with its private section: x.pages.dev stays x.pages.dev. Block by this."
},
"registered_domain": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Registered Domain",
"description": "The name a registry sold (Public Suffix List, ICANN section): x.pages.dev -> pages.dev. registered_at, expires_at and registrar describe this name."
},
"tld": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Tld"
},
"tld_abuse": {
"anyOf": [
{
"type": "string",
"enum": [
"low",
"medium",
"high"
]
},
{
"type": "null"
}
],
"title": "Tld Abuse"
},
"registered_at": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Registered At",
"description": "RFC 3339 UTC."
},
"expires_at": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Expires At",
"description": "When the registration expires, RFC 3339 UTC, from RDAP."
},
"age_days": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"title": "Age Days"
},
"age_bucket": {
"anyOf": [
{
"type": "string",
"enum": [
"lt_7d",
"d7_30",
"d30_90",
"d90_365",
"gt_1y",
"unknown"
]
},
{
"type": "null"
}
],
"title": "Age Bucket"
},
"registrar": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Registrar",
"description": "The registrar's name, from RDAP."
},
"dns": {
"anyOf": [
{
"$ref": "#/$defs/DnsFacts"
},
{
"type": "null"
}
]
},
"hosting": {
"anyOf": [
{
"$ref": "#/$defs/HostingFacts"
},
{
"type": "null"
}
],
"description": "The hosting platform serving the host (1.9.0), null when none we know of. Says where a site lives, never whether it is honest: the platforms host real brands and fake shops alike."
},
"status": {
"anyOf": [
{
"type": "string",
"enum": [
"live",
"gone",
"broken",
"parked",
"held",
"unknown"
]
},
{
"type": "null"
}
],
"title": "Status",
"description": "What the domain is doing now: live (resolves), gone (NXDOMAIN), broken (SERVFAIL: a delegation that no longer answers), parked (a parking service's name servers), held (does not resolve because its registry or registrar holds it, see hold), unknown (no answer in time)."
},
"cert_first_seen": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Cert First Seen"
},
"lookalike": {
"anyOf": [
{
"$ref": "#/$defs/Lookalike"
},
{
"type": "null"
}
]
},
"platform": {
"anyOf": [
{
"type": "string",
"enum": [
"none",
"multi_tenant"
]
},
{
"type": "null"
}
],
"title": "Platform"
},
"allowlisted": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"title": "Allowlisted"
},
"listed": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"title": "Listed",
"description": "On Bewary's scam list."
},
"seen_in_checks_7d": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"title": "Seen In Checks 7D"
},
"country": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Country",
"description": "ISO 3166-1 alpha-2 country its country-code TLD names; null for generic TLDs and generic-use ccTLDs (.co, .io, .tv...)."
},
"target_countries": {
"anyOf": [
{
"items": {
"type": "string"
},
"type": "array"
},
{
"type": "null"
}
],
"title": "Target Countries",
"description": "ISO 3166-1 alpha-2 countries whose people it is aimed at, from the national lists that name it (CERT Polska: PL, Taiwan's 165 line: TW, Germany's regulator: DE, US complaint feeds: US). Empty when no list with a national scope names it."
},
"list_count": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"title": "List Count",
"description": "How many lists name it (our own and others'); 96% of listed domains are on one list (2026-10-27)."
},
"site": {
"anyOf": [
{
"$ref": "#/$defs/SiteVerdict"
},
{
"type": "null"
}
],
"description": "Our verdict on the site, when our worker read its page in the last 90 days; null otherwise."
},
"platform_status": {
"anyOf": [
{
"$ref": "#/$defs/PlatformStatus"
},
{
"type": "null"
}
],
"description": "The hosting platform's own answer about the site (Vercel's takedown page, Cloudflare's phishing warning, a host's not-found page), when our worker read it; null otherwise."
},
"registry_status": {
"anyOf": [
{
"items": {
"type": "string",
"enum": [
"active",
"inactive",
"associated",
"locked",
"validated",
"proxy",
"private",
"removed",
"obscured",
"add_period",
"auto_renew_period",
"renew_period",
"transfer_period",
"redemption_period",
"pending_create",
"pending_delete",
"pending_renew",
"pending_restore",
"pending_transfer",
"pending_update",
"client_hold",
"server_hold",
"client_delete_prohibited",
"client_renew_prohibited",
"client_transfer_prohibited",
"client_update_prohibited",
"server_delete_prohibited",
"server_renew_prohibited",
"server_transfer_prohibited",
"server_update_prohibited",
"delete_prohibited",
"renew_prohibited",
"transfer_prohibited",
"update_prohibited",
"other"
]
},
"type": "array"
},
{
"type": "null"
}
],
"title": "Registry Status",
"description": "The status codes the registry publishes for registered_domain (the EPP statuses of RFC 5731 and 3915 as RDAP carries them, RFC 8056), in snake case: server_hold, client_hold, redemption_period, pending_delete, client_transfer_prohibited and the rest. Null when the registry publishes no status."
},
"hold": {
"anyOf": [
{
"type": "string",
"enum": [
"none",
"registrar",
"registry",
"both"
]
},
{
"type": "null"
}
],
"title": "Hold",
"description": "Who holds the name out of the DNS: registry (serverHold), registrar (clientHold), both, or none. A hold is how registries and registrars take a domain down. Null when the registry's status is unknown."
},
"registered": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"title": "Registered",
"description": "true: the registry has registered_domain; false: the registry answered that no such name is registered (it lapsed or was deleted, and anyone may register it). Null when no registration service covers the TLD."
},
"registration_checked_at": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Registration Checked At",
"description": "When the registration record (registered_at, expires_at, registrar, registry_status, hold) was read, RFC 3339 UTC. An answer is kept up to 7 days; a daily pass reads names on our lists again, those that stopped resolving first."
},
"archive": {
"anyOf": [
{
"$ref": "#/$defs/ArchiveHistory"
},
{
"type": "null"
}
],
"description": "The site's history in a public web archive; null until we have read it (a first lookup queues the read)."
},
"first_seen_by_bewary": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "First Seen By Bewary",
"description": "When Bewary's own watch first saw this host, in a new certificate or a new name in a registry's zone file, RFC 3339 UTC; null when it never did."
},
"first_listed_publicly": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "First Listed Publicly",
"description": "When a public list we read first named this host, RFC 3339 UTC; null when none names it, or when a list naming it already did the first time we read that list (the date it was added there is not known)."
}
},
"additionalProperties": false,
"type": "object",
"title": "DomainFacts"
},
"EmailFacts": {
"properties": {
"domain": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Domain",
"description": "Entity id of the address's domain."
},
"mx": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"title": "Mx"
},
"disposable": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"title": "Disposable"
},
"free_provider": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"title": "Free Provider"
},
"role_account": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"title": "Role Account"
},
"disposable_status": {
"anyOf": [
{
"type": "string",
"enum": [
"receiving",
"dead",
"unknown"
]
},
{
"type": "null"
}
],
"title": "Disposable Status",
"description": "For a throwaway provider: receiving (it still takes mail: a mail host that resolves, or the domain's own address when it has no MX, RFC 5321), dead (the name is gone, declares it takes no mail with a null MX, RFC 7505, or has no mail host that resolves), unknown (not re-checked yet). Null when not disposable."
},
"disposable_checked_at": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Disposable Checked At",
"description": "When the throwaway domain was last re-checked, RFC 3339 UTC; null when not disposable or not checked yet."
}
},
"additionalProperties": false,
"type": "object",
"title": "EmailFacts"
},
"Entity": {
"properties": {
"id": {
"type": "string",
"title": "Id",
"description": "e1, e2 and so on, unique in the response."
},
"type": {
"type": "string",
"enum": [
"url",
"domain",
"ip",
"phone",
"shortcode",
"email",
"wallet",
"payment_handle",
"iban",
"app"
],
"title": "Type"
},
# --- truncated at 32 KB (81 KB total) ---
# Full source: https://artifacts.apis.io/bewary/json-schema/bewary-envelope-schema.json
Work with this as data
Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for schemas
4 MCP tools reach this
find_json_schemasBrowse and filter every JSON Schema in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/bewary-envelope"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.