API Documentation

Access our phishing database programmatically. Our API is free to use.

Overview

The OpenPhish API provides access to our community-maintained phishing URL database. Use it to check URLs, download phishing lists, and integrate phishing protection into your applications.

Base URL

https://openphish.eu/api

GET/api/check

Check if a URL exists in our phishing database.

Parameters

Name	Type	Description
`url`	string	The URL to check (required)

Example Request

curl "https://openphish.eu/api/check?url=https://example-phish.com/login"

Response

{
  "found": true,
  "phish": {
    "id": 123,
    "url": "https://example-phish.com/login",
    "status": "verified",
    "target_brand": "PayPal",
    "verified_at": "2024-01-15T10:30:00Z"
  }
}

GET/api/phish

Get a list of phishing URLs from our database.

Parameters

Name	Type	Description
`status`	string	Filter by status: verified, unverified (optional)
`q`	string	Search query for URL or target brand (optional)
`limit`	number	Number of results (default: 50, max: 1000)

Example Request

curl "https://openphish.eu/api/phish?status=verified&limit=100"

Response

[
  {
    "id": 123,
    "url": "https://example-phish.com/login",
    "url_hash": "abc123...",
    "status": "verified",
    "target_brand": "PayPal",
    "votes_valid": 5,
    "votes_invalid": 0,
    "created_at": "2024-01-15T09:00:00Z",
    "verified_at": "2024-01-15T10:30:00Z"
  }
]

GET/api/phish/:id

Get details for a specific phishing entry.

Example Request

curl "https://openphish.eu/api/phish/123"

POST/api/phish

Submit a new phishing URL to the database.

Request Body

{
  "url": "https://suspicious-site.com/login",
  "targetBrand": "Amazon"
}

Response

{
  "success": true,
  "id": 124
}

Rate Limits

To ensure fair usage, the following rate limits apply:

- Anonymous: 100 requests per hour
- Registered: 1,000 requests per hour
- API Key: 10,000 requests per hour

Response Codes

Code	Description
`200`	Success
`201`	Created (submission successful)
`400`	Bad Request (invalid parameters)
`401`	Unauthorized (authentication required)
`404`	Not Found
`409`	Conflict (URL already exists)
`429`	Too Many Requests (rate limited)
`500`	Server Error