Domain Scores

IMPORTANT NOTE:

This endpoint has been deprecated and replaced by the Domain Status and Categorization endpoint above. Please use the Domain Status endpoint and update any API clients as quickly as possible.

This API method is the quickest and easiest way to know whether a domain has been flagged as malicious by Umbrella security researchers (score of -1), if it is believed to be safe (score of 1), or if it hasn't been categorized yet (score of 0).

To query for more than one domain at a time, use the POST example below and post a list of domains as an array. This method will accept up to 1000 domains in a single request.

Sample query for a single domain:

curl -H "Authorization: Bearer %YourToken%" "https://investigate.api.umbrella.com/domains/score/example.com"

Sample query for multiple domains:

curl -H "Authorization: Bearer %YourToken%" --request POST "https://investigate.api.umbrella.com/domains/score/" -d '["example.net","example.org,","example.com"]'

Parameter for input

Field
Type
Description

name

string

Domain name.

Returned value for output if Success 200

Field
Type
Description

score

string

The score will be "-1" if the domain is believed to be malicious, "1" if the domain is believed to be benign, "0" if it hasn't been classified yet.

GET https://investigate.api.umbrella.com/domains/score/name
REQUEST
    curl --include \
     --header "Authorization: Bearer %YourToken%" \
https://investigate.api.umbrella.com/domains/score/{name}
    
RESPONSE (HTTP 200, Content-Type: application/json)
{
  "example.com": 1
}
    
POST https://investigate.api.umbrella.com/domains/score/
REQUEST
    curl --include \
     --request POST
     --header "Authorization: Bearer %YourToken%" \
     --data-binary "[\"example.org\", \"example.net\", \"example.com\"]" \
https://investigate.api.umbrella.com/domains/score/{name}
    
RESPONSE
{
  "example.net": 1,
  "example.org": 1,
  "example.com": 1
}
    

Domain Scores