API reference

Base URL https://fraudcheckapi.com. All responses are JSON with stable, snake_case field names. Fields are added, never renamed or removed.

Authentication

Send your key as a bearer token or the X-Api-Key header.

curl https://fraudcheckapi.com/v1/screen \
  -H "X-Api-Key: fck_live_…" \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]"}'

Full composite screen. At least one of ip, email, phone, shipping_country is required.

{
  "ip": "203.0.113.9",
  "email": "[email protected]",
  "phone": "+14045551234",
  "shipping_country": "US"
}

{
  "score": 62,
  "email": {
    "is_disposable": true,
    "domain_has_mx": true
  },
  "reasons": ["DISPOSABLE_EMAIL"]
}

À-la-carte endpoints

Same checks, one family at a time.

Append ?format=xml or ?format=csv to any endpoint for content negotiation (JSON is the default).

Full IP geolocation. Available on every plan — limited by volume and rate only. Returns location data, not a verdict. Non-routable addresses come back with bogon: true and a scope label instead of a location.

curl https://fraudcheckapi.com/v1/geo/8.8.8.8 \
  -H "X-Api-Key: fck_live_…"

{
  "ip": "8.8.8.8",
  "version": 4,
  "scope": "public",
  "bogon": false,
  "country_code": "US",
  "country_name": "United States",
  "region": "California",
  "city": "Mountain View",
  "latitude": 37.751,
  "longitude": -97.822,
  "timezone": "America/Chicago",
  "asn": 15169,
  "org": "GOOGLE"
}

Reason codes

Stable codes returned in reasons[]. A representative set:

Errors & rate limits

Errors return a JSON body of { "code": "…", "message": "…" } with a stable machine-readable code. 401 invalid_key · 400 invalid_request / missing_input / invalid_ip · 403 ip_not_allowed · 429 rate_limited / quota_exceeded / spend_cap_reached.

Inputs carry generous size limits — email 254, phone 32, ip 1024 (enough for a forwarded-for chain), and a 256 KB request body. Anything longer returns 400 invalid_request naming the field. Your dashboard docs list the full table.