TrustSniffer API

1. Get your API key

Every TrustSniffer account can create its own key, free and without approval:

• On the website: Dashboard → Settings → API → Create my API key.
• In the Chrome extension: open its Settings → Your API key.

The key looks like ts_live_… and is shown only once, right after you create it, because TrustSniffer stores only a fingerprint of it. Copy it somewhere safe. If you lose it, create a new one: the old key stops working immediately. You can also revoke it at any time in the same place.

Treat the key like a password. Keep it on your server or in an environment variable, never in a web page, a mobile app bundle or a public repository.

2. Energy: the same allowance as your account

There is no separate API quota. The key acts as your account, so API calls spend the same daily energy you use on the website and in the extension, at exactly the same prices. If you have 100 energy today, you have 100 energy in total, however you spend it.

• The daily allowance resets at 00:00 UTC. GET /me returns your balance and the current price of every check.
• Energy is taken only when a new, usable result is produced. A report that already exists and is still fresh is returned without a charge, and a site that could not be assessed (Needs Review) is not charged.
• Reading a published report is always free.
• When your energy runs out, a paid call answers 402 with "error": "insufficient_energy", your balance and the required amount. Nothing is charged.

3. Authentication and base URL

Send the key in the X-API-Key header (or as Authorization: Bearer ts_live_…) over HTTPS. All endpoints below are relative to:

https://trustsniffer.com/api/developer/v1

Requests and responses are JSON. Send Content-Type: application/json with a request body.

4. Endpoints

GET/me

Your account email, today's energy balance, the daily allowance and the price of each check. Free.

{
  "ok": true,
  "email": "[email protected]",
  "energy": { "balance": 84, "daily_allowance": 100, "resets": "00:00 UTC" },
  "costs": { "website_analysis": 16, "wallet_aml_verdict": 16, … },
  "free_to_read": "Opening a report that already exists costs nothing."
}

POST/sites/analyze

Analyse a website, exactly like the Analyze button on trustsniffer.com. Body: {"url": "https://example.com"}. Costs the website analysis price (see /me).

An analysis usually takes under two minutes and can take up to about three, so use a client timeout of at least 300 seconds. Add an Idempotency-Key header (12 to 128 letters, digits, . _ : -) to retry safely: a retry with the same key joins the same run and is never charged twice.

If your connection drops before the answer arrives, the analysis still finishes on our side. Poll the status, then read the report.

GET/sites/{domain}/status

Progress of the latest analysis of a domain, for example /sites/example.com/status. Free.

GET/sites/{domain}

The published report. Free. It is the same report as https://trustsniffer.com/report/{domain}, the dashboard and the PDF, as data:

{
  "ok": true,
  "domain": "example.com",
  "report_url": "https://trustsniffer.com/report/example.com",
  "pdf_url": "https://trustsniffer.com/report/example.com.pdf",
  "schema": "trustsniffer.website-report/1",
  "facts": {
    "score": 74,                       // 0 to 100, 100 is the most trusted; null when not scored
    "band": "MODERATE_TRUST",          // HIGH_TRUST, MODERATE_TRUST, LOW_TRUST, CRITICAL_TRUST or NEEDS_REVIEW
    "band_label": "Moderate Trust",
    "classification_confidence_pct": 50,
    "badges": [{ "text": "Not Scam", "semantic": "HIGH_TRUST" }],
    "domain_age_years": null,          // null means unknown, never zero
    "hosting": "…", "country": "…", "server_ip": "…",
    "archive": { "first": "2007-02-18", "count": null, "lookup": "incomplete" },
    "reputation": { "virustotal_flagged": 0, "safe_browsing_matches": 0,
                    "abuseipdb_reports": 10, "abuseipdb_confidence": 11, "state": "host_reports" },
    …
  },
  "sections": [
    { "id": "verdict", "title": "Verdict", "blocks": [ … ] },
    { "id": "analysis", "title": "Full analysis", "blocks": [ … ] },
    …
  ]
}

Bands: High Trust 75 to 100, Moderate Trust 50 to 74, Low Trust 25 to 49, Critical Risk below 25, and Needs Review when the site could not be assessed (no score). A missing fact is null; it never means zero. 404 means no report has been published for that domain yet.

GET/wallets/{chain}/{address}

An AML risk screen of a wallet. chain is ethereum or tron. Costs the wallet AML verdict price (see /me), and a repeat of the same address inside the pricing window is not charged again.

On wallet scores 100 is the highest risk, the opposite of website scores. If no verdict can be resolved, the answer is 503 with "verdict": null and Retry-After, and nothing is charged. A 503 is not a statement that the address is clean: treat it as unscreened and retry.

5. Errors and limits

Per key: up to 10 analysis requests and 120 other requests a minute. Your daily energy is the real limit on paid checks.

6. Examples

curl:

export TS_KEY="ts_live_…"
curl -s https://trustsniffer.com/api/developer/v1/me -H "X-API-Key: $TS_KEY"

curl -s -X POST https://trustsniffer.com/api/developer/v1/sites/analyze \
  -H "X-API-Key: $TS_KEY" -H "Content-Type: application/json" \
  -H "Idempotency-Key: check-example-com-2026-09-28" \
  --max-time 300 -d '{"url": "https://example.com"}'

curl -s https://trustsniffer.com/api/developer/v1/sites/example.com -H "X-API-Key: $TS_KEY"
curl -s https://trustsniffer.com/api/developer/v1/wallets/tron/TXYZ… -H "X-API-Key: $TS_KEY"

Python:

import os, requests

BASE = "https://trustsniffer.com/api/developer/v1"
H = {"X-API-Key": os.environ["TS_KEY"]}

r = requests.post(f"{BASE}/sites/analyze", headers=H, json={"url": "https://example.com"}, timeout=300)
if r.status_code == 402:
    print("Out of energy for today:", r.json())
else:
    report = requests.get(f"{BASE}/sites/example.com", headers=H, timeout=30).json()
    print(report["facts"]["score"], report["facts"]["band_label"])

JavaScript (Node 18 or later):

const BASE = 'https://trustsniffer.com/api/developer/v1';
const headers = { 'X-API-Key': process.env.TS_KEY, 'Content-Type': 'application/json' };

const run = await fetch(`${BASE}/sites/analyze`, {
  method: 'POST', headers, body: JSON.stringify({ url: 'https://example.com' }),
  signal: AbortSignal.timeout(300_000),
});
if (run.status === 402) throw new Error('Out of energy for today');
const report = await (await fetch(`${BASE}/sites/example.com`, { headers })).json();
console.log(report.facts.score, report.facts.band_label);

7. Good to know

• A report is an automated, evidence-based assessment at a point in time, not a legal finding. Show your users the band and link to the full report rather than turning it into a bare "safe" or "scam" label.
• Analyses you run through the API are published at /report/{domain} exactly like analyses run on the website.
• Organisations with keys provisioned by TrustSniffer for the exchange partner service keep using the endpoints in their agreement; those keys are listed separately in Settings.