---
title: "Bulk entity check"
method: POST
path: "/bulk/check"
tags: ["check"]
---

# Bulk entity check

`POST /bulk/check`

Check up to N entities per request (N depends on subscription plan). Each
entity may be a domain, IP, URL, or file hash string. With
`format: "csv"` the 200 response is `text/csv` instead of JSON.
Validation failures (empty list, over the plan limit) answer 400 with the
same `BulkCheckResponse` shape (`success: false` + `errors`).

## Request body

- BulkCheckRequest
  - `enrichment` string, nullable
  - `entities` string[], required
  - `format` string, nullable

## Response `200`

Batch results (JSON, or CSV when `format: "csv"`)

- BulkCheckResponse
  - `errors` string[], nullable
  - `processed` integer, required
  - `processingTimeMs` integer, required
  - `results` EntityResult[], required
    - `analystStatus` string, required
    - `categories` string[], required
    - `confidence` number, double, required
    - `entity` string, required
    - `error` string, nullable
    - `evidence` unknown
    - `isMalicious` boolean, required
    - `observedAt` string, required
    - `recommendedAction` string, required
    - `riskLevel` string, nullable
    - `riskScore` integer, nullable
    - `sources` integer, required
    - `type` string, required
  - `success` boolean, required
  - `total` integer, required

## Other responses

- `400` — Empty entity list or plan limit exceeded — same shape with `success: false` and `errors`
- `401` — Unauthorized - Missing or invalid API key
- `429` — Too many requests - Rate limit exceeded

## Changes

- **2026-08-31** `9d9ef31d83e5` — 12 breaking, 12 info
  - the response property `message` became nullable for the status `401`
  - the response property `message` became nullable for the status `429`
  - the response property `message` became optional for the status `401`
  - the response property `message` became optional for the status `429`
  - …20 more

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/bulk/check/post.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ismalicious/ismalicious-threat-intelligence-api/revisions/9d9ef31d83e5/schema)