API Overview

Use the RequestGuard API for fraud decisioning, intelligence lookups, website security scans, protected links, rules, webhooks, events, analytics, and public vulnerability evidence. This overview covers shared REST behavior. Resource-specific endpoints live in their own docs sections.

Base URL

https://api.requestguard.com/v1

All endpoint paths in these docs are relative to /v1.

Authentication

Every intelligence endpoint requires an active workspace API key, including Free geolocation and vulnerability lookups:

curl "https://api.requestguard.com/v1/{resource}" \
  -H "Authorization: Bearer rg_sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"example":true}'

You can also send X-API-Key for platforms where bearer auth is hard to configure.

Access depends on the workspace plan:

Endpoint	Authentication
POST /go/links	API key optional. Anonymous link creation is supported. Invalid keys are rejected.
GET /vulnerabilities/npm/{package}/	API key required; included in Free.
GET /vulnerabilities/packages/{ecosystem}/{coordinate}/	API key required; included in Free.
GET /vulnerabilities/cve/{cveId}/	API key required; included in Free.
GET /vulnerabilities/kev/	API key required; included in Free.

See Authorization for header formats and endpoint-specific behavior.

Request and Response Conventions

JSON endpoints accept Content-Type: application/json and return JSON responses unless a resource documents a different media type, such as CSV exports.

Use ISO 8601 strings for timestamps, URL-encode path parameters, and include only fields supported by the target resource. Response objects can include nullable fields when upstream intelligence is unavailable or not applicable.

Errors

Errors return an error object directly:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing or invalid RequestGuard API key."
  }
}

Common status conventions:

Status	Meaning
400	Invalid or missing request input.
401	Required API key is missing or invalid.
402	Monthly lookup allowance exhausted (QUOTA_EXCEEDED).
403	Missing capability, bulk access or an included key; browser Origin may also be denied.
404	Resource, package, domain, IP, or record was not found.
409	The request conflicts with an existing resource state.
429	Endpoint burst limit exceeded (RATE_LIMITED).
503	Required upstream intelligence source is unavailable.

Rate Limits

Free workspaces share 1,000 geolocation/vulnerability lookup units per UTC calendar month across one API key. Full intelligence requires Suite or Lookups. Monthly limits are 1,000 for Suite Starter, 25,000 for Suite Business/Lookups Developer, and 250,000 for Suite Agency/Lookups Growth. Email subscriptions do not unlock full lookups. Compatible plans combine by the highest allowance, never by addition.

A lookup normally consumes one unit. Blocklist batches consume one per target; CIDR checks consume one per sampled address. Bulk requires Suite Business, Suite Agency or Lookups Growth and reserves all units before provider work. Rejected requests consume no units; admitted analysis attempts count even if a provider fails. Events, analytics, lookup history, rules and webhook management are unmetered but retain their capability checks. Go has separate creation limits and consumes no lookup units.

Monthly exhaustion returns 402 QUOTA_EXCEEDED; burst limits return 429 RATE_LIMITED. Metered responses expose X-RequestGuard-Quota-Limit, -Used, -Remaining and -Reset. See Authorization for capabilities, bulk costs, key pauses and browser CORS.

Idempotency

GET requests do not mutate the target resource, but each admitted lookup retry consumes units. Retry transient failures with bounded backoff. For create or update requests, retry only after checking the resource docs for reuse behavior or conflict handling.

Protected link creation can reuse active, non-expiring links with the same normalized destination and account scope. Other write endpoints may return 409 when the requested state conflicts with an existing resource.

Resource Docs

Area	Docs
Authorization	Authentication, optional keys, and invalid-key behavior
Protected Links	Create go.requestguard.com links
Fraud Decisioning	Assess signups, logins, checkout, forms, and API events
Rules	Manage custom allow, review, challenge, and block rules
Events and Analytics	Search investigation events and summary metrics
Webhooks	Send high-risk assessment notifications
Email Check	Check disposable, free, role, and risky mailbox signals
Email Security	Inspect SPF, DKIM, and DMARC posture
Abuse Contacts	Find abuse reporting contacts
Blocklists	IP and domain blocklist behavior
Package Vulnerabilities	npm, Composer, PyPI, Maven, and Go advisory evidence
CVE and CISA KEV	CVE lookup and known-exploited catalog search
Legacy npm Vulnerabilities	Compatibility endpoint
IP Intelligence	IP reputation, geolocation, and RDAP endpoints
Domain Intelligence	Domain risk and RDAP endpoints
Website Security	Scans, score model, leaderboard, privacy, and badges
DNS	DNS lookup endpoint
Network Checks	ASN, host, online, and CIDR checks
Device and CAPTCHA Diagnostics	Fingerprint and CAPTCHA test endpoints

OpenAPI

Use the machine-readable OpenAPI document when you need schemas, parameters, and the complete endpoint list:

https://requestguard.com/openapi/requestguard.v1.json