Urlyze API

Submit URLs for full forensic scanning, poll the verdict, pivot-search fingerprints across scans, and export IOC feeds — everything the Urlyze platform does, over a simple JSON API.

Base URL: https://api.urlyze.io · Authentication: X-Api-Key header (details).

Quickstart

1. Submit a URL

curl -X POST https://api.urlyze.io/UrlCheck \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -d '{"url": "https://example.com"}'

If the URL was scanned recently you get an instant 200 with the completed result (a cache hit costs no quota). Otherwise you get a 202:

{ "analyzeId": "3f6c0f2e-…", "scanState": "queued" }

2. Poll the result

curl https://api.urlyze.io/UrlCheck/3f6c0f2e-… \
  -H "X-Api-Key: YOUR_API_KEY"

scanState moves through queued → running → completed (or failed). Poll every few seconds; most scans finish well under a minute. On completion the result object carries the verdict, per-engine details, explanation and guidance:

{
  "analyzeId": "3f6c0f2e-…",
  "scanState": "completed",
  "result": {
    "verdict": "Clean",
    "explanation": "…",
    "verdictGuidance": {
      "headline": "…",
      "whatThisMeans": "…",
      "recommendedAction": "…"
    }
  }
}

3. Read the verdict

Verdict	Meaning
Clean	No malicious or suspicious signals found.
Suspicious	Signals that warrant caution, below the malicious threshold.
Malicious	Confirmed malicious signals (phishing, malware delivery, scams).
Unknown	The page could not be assessed.
AntiBotChallenged	The site presented an anti-bot challenge; content behind it was not fully assessed.

Anonymous submissions are allowed but are always public and more tightly rate-limited. With an API key, scans default to private — see Authentication & visibility.

Urlyze API

Quickstart

1. Submit a URL

2. Poll the result

3. Read the verdict

What else is in the API

Pivot search

Screenshots

IOC feeds

Usage