suribs.net — licensed API

Hostname/domain reputation lookup and submission over HTTPS, keyed per account, fully configurable policy (category filters, confirmed-vs-unconfirmed threshold, your own allowlist). Get a key from your suribs.com dashboard.

Authentication

Every route except /health requires an API key:

Authorization: Bearer <your-key>

Keys carry a scope: query (lookup only), query_and_submit (lookup and submit), or admin. Scope is set when a key is issued; admin is operator-granted only.

Endpoints

Method & path	Scope	Description
GET `/health`	none	Service and database health. No auth required.
GET `/v1/lookup/<hostname>`	query, query_and_submit, admin	Look up a hostname against your account's resolved policy (category include/exclude, confirmed-vs-unconfirmed threshold, your allowlist).
POST `/v1/submit`	query_and_submit, admin	Submit a sighting. Two corroborating sightings promote a host to confirmed; a single `deep=true` sighting promotes immediately.

Example

curl -H "Authorization: Bearer $SURIBS_KEY" \
  https://suribs.net/v1/lookup/example.com

curl -X POST -H "Authorization: Bearer $SURIBS_KEY" \
  -H "Content-Type: application/json" \
  -d '{"hostname":"evil.example","kind":"bad","category":"phishing",
       "confidence":0.9,"source":"my-integration","deep":false}' \
  https://suribs.net/v1/submit

Rate limits

Per-key limits (requests/minute and requests/day) are set on your account and enforced via a fixed-window counter. A 429 means you're over the configured limit. If the rate limiter itself is unreachable, requests are allowed through rather than blocked.

Free instead?

For a confirmed-bad-only, keyless lookup with no account needed, see suribs.org — the same data over DNS (RHSBL) or a simple web lookup.