check

Bulk entity check

Check up to N entities per request (N depends on subscription plan). Each entity may be a domain, IP, URL, or file hash string. With format: "csv" the 200 response is text/csv instead of JSON. Validation failures (empty list, over the plan limit) answer 400 with the same BulkCheckResponse shape (success: false + errors).

post/bulk/check

Request body

enrichmentstring nullable

entitiesstring[] required

formatstring nullable

Example request

{
  "enrichment": "full",
  "entities": [
    "example.com",
    "8.8.8.8",
    "https://malicious.site",
    "44d88612fea8a8f36de82e1278abb02f"
  ],
  "format": "json"
}

Response

Batch results (JSON, or CSV when format: "csv")

errorsstring[] nullable

processedinteger required

processingTimeMsinteger required

successboolean required

totalinteger required

Example response

{
  "processed": 3,
  "processingTimeMs": 150,
  "results": [
    {
      "analystStatus": "new",
      "categories": [
        "phishing",
        "malware"
      ],
      "confidence": 95,
      "entity": "example.com",
      "infrastructure": {
        "attributes": [
          "cloud",
          "saas"
        ],
        "sources": [
          {
            "category": "infrastructure",
            "id": "azure-ip-ranges",
            "name": "Azure - Published IP Ranges",
            "threatClass": "infrastructure"
          }
        ]
      },
      "isMalicious": true,
      "lookupStatus": "unknown",
      "observedAt": "2026-05-09T00:00:00Z",
      "recommendedAction": "review",
      "riskLevel": "high",
      "riskScore": 82,
      "sources": 12,
      "type": "domain"
    }
  ],
  "success": true,
  "total": 3
}

Changes

Changed in 4 of the 14 revisions of this API.1616

Sep 25, 20260fa256b179f34See the full diff
- ▲
  the response property // became nullable for the status
  response-property-became-nullable
- ▲
  the response property // became nullable for the status
  response-property-became-nullable
- ▲
  the response property // became optional for the status
  response-property-became-optional
- ▲
  the response property // became optional for the status
  response-property-became-optional
Sep 20, 2026eb1bf7b5e7852See the full diff
- ○
  added the optional property // to the response with the status
  response-optional-property-added
- ○
  added the optional property // to the response with the status
  response-optional-property-added
Sep 19, 20261bc3c7aeff822See the full diff
- ○
  added the optional property // to the response with the status
  response-optional-property-added
- ○
  added the optional property // to the response with the status
  response-optional-property-added
Aug 31, 20269d9ef31d83e51212See the full diff
- ▲
  the response property became nullable for the status
  response-property-became-nullable
- ▲
  the response property became nullable for the status
  response-property-became-nullable
- ▲
  the response property became optional for the status
  response-property-became-optional
- ▲
  the response property became optional for the status
  response-property-became-optional
- ▲
  the response's property format changed from int32 to no format for status
  response-property-type-changed
- ▲
  the // response's property format changed from int32 to int64 for status
  response-property-type-changed
- ▲
  the // response's property format changed from int32 to int64 for status
  response-property-type-changed
- ▲
  the response's property format changed from int32 to no format for status
  response-property-type-changed
- ▲
  removed the required property from the response with the status
  response-required-property-removed
- ▲
  removed the required property from the response with the status
  response-required-property-removed
- ▲
  removed the required property from the response with the status
  response-required-property-removed
- ▲
  removed the required property // from the response with the status
  response-required-property-removed
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  the response property // became required for the status
  response-property-became-required
- ○
  the response property // became required for the status
  response-property-became-required
- ○
  the response property // became required for the status
  response-property-became-required
- ○
  removed subschema #1 from the // response property oneOf list for the response status
  response-property-one-of-removed
- ○
  added the required property to the response with the status
  response-required-property-added
- ○
  added the required property to the response with the status
  response-required-property-added
- ○
  added the required property to the response with the status
  response-required-property-added
- ○
  added the required property to the response with the status
  response-required-property-added
- ○
  added the required property // to the response with the status
  response-required-property-added
- ○
  added the required property to the response with the status
  response-required-property-added
- ○
  added the required property to the response with the status
  response-required-property-added
This revision also has 17 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Full history