Check indicators in bulk
check_indicatorsReputation of up to 100 indicators in one call, for triaging a list rather than one alert: IPs, domains, URLs, file hashes (MD5, SHA-1 or SHA-256), email addresses and phone numbers, mixed freely; defanged input is accepted. Each row: malicious, recommendedAction (block, escalate, review, monitor, allow, unverified; unverified means nothing is known either way, and an email address or phone number is never allow), risk 0-100 with level, the number of threat blocklists citing it, categories, lookupStatus, and infrastructure (cloud, cdn, tor-exit…) when the entity is known as such. A row with pending (e.g. ["circl"] for a hash whose lookup outlasted the API's deadline) is not settled: re-check it once, after a few seconds. A URL row is judged on its host. BILLING: every unique indicator the API receives charges one request of the monthly quota — unique after trimming and lowercasing, and including rows the API cannot type, which come back with an error. Exact duplicates are free; entries under 3 characters, SHA-512, TLSH and ssdeep, and input that is none of the six kinds (an address or a number in a shape the API cannot read, a number written with letters, a host that is not a dotted domain name) are refused here with a per-row error, never sent and never charged. Plans cap the batch below the tool ceiling (Free 10, Basic 50, Pro 100); over the cap the API refuses the whole batch. Use check_indicator for the full picture of one indicator.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| country | No | ISO 3166-1 alpha-2 country applied to every phone number written in national format (06 12 34 56 78 with FR). Numbers written with + or 00 ignore it. | |
| enrichment | No | "standard" (default) adds the risk score; "basic" is the verdict and blocklist count only and answers faster; "full" adds nothing visible in this projection. | |
| indicators | Yes | The indicators to check, at most 100. Each unique one sent costs one request. |