Fakeshop-Check API
Check online shops and websites for fraud signals programmatically – the same AI-powered analysis that drives our fake-shop check. Free to try, with an API key for production use.
Your first API call
A single POST request to /api/check is all it takes. Without an API key, the free quota of 50 requests per day and IP address applies – more than enough for initial testing.
curl -X POST "https://fakeshop.ai/api/check?v=2&lang=de" \
-H "Content-Type: application/json" \
-H "X-Api-Key: fsk_live_ihr_schluessel" \
-d '{"url": "https://beispiel-shop.de"}'const res = await fetch('https://fakeshop.ai/api/check?v=2&lang=de', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'X-Api-Key': 'fsk_live_ihr_schluessel',
},
body: JSON.stringify({ url: 'https://beispiel-shop.de' }),
});
const data = await res.json();
console.log(data.verdict, data.score);API key in the header
Authenticated requests send their key in the X-Api-Key header. Without a key, requests run anonymously through the IP-based free quota. You create your own key for free and independently in the developer portal – including free credit for testing. For questions about larger volumes, reach us at [email protected].
X-Api-Key: fsk_live_ihr_schluesselTest for free, fairly limited
Without an API key, 50 checks per day and IP address are available for free. With an API key, your plan's quota (prepaid credits, included in the free plan) applies instead. Once the quota is used up, the API responds with status 429, the error code quota_exceeded and a Retry-After header (seconds until the reset at midnight UTC).
Systematic scraping or abuse of the free quotas is prohibited and may lead to the IP address being blocked. For higher limits or production integrations, please contact us at [email protected].
POST /api/check
Request parameters:
| Parameter | Location | Type | Required | Description |
|---|---|---|---|---|
url | Body | string | Yes | The shop or website URL to check. |
checkType | Body | shop | website | No | Check profile. Default is shop. website allows a trustworthiness check when the URL is not an online shop. |
force | Body | boolean | No | Forces a fresh check instead of a cached result (max. 24 h cache). |
v | Query | 2 | Yes | Response version. With v=2 the current, English enum values are returned – without this parameter, an outdated legacy format. |
lang | Query | de | en | No | Language of the text fields (summary, recommendation, reasons, …). Default is de. |
Response schema
Top-level fields of the response:
| Field | Type | Description |
|---|---|---|
domain | string | Checked domain without protocol. |
score | number | null | Trust score 0–100. null for not_a_shop or unreachable. |
verdict | safe | suspicious | danger | not_a_shop | unreachable | Overall assessment. |
checkType | shop | website | Applied check profile. |
trustLevel | { level, label } | level is 1–5 (machine-readable), label is a language-dependent display text. |
confidenceBand | high | medium | low | How reliable the data basis for this assessment is. |
summary | string | null | Short, language-dependent summary of the result. |
recommendation | string | null | Plain-text recommendation for action. |
factors | Factor[] | Individual check signals: { id, label, status, impact, reasons[], display? }. |
topSignals | Factor[] | The most notable signals, same shape as factors. |
cached | boolean | true if the result comes from the 24 h cache. |
checkedAt | string (ISO 8601) | Timestamp of the (most recent) check. |
faviconUrl | string | null | Favicon of the checked domain, if available. |
previewImage | string | null | Screenshot URL of the homepage, if available. |
Fields per entry in factors / topSignals:
| Field | Type | Description |
|---|---|---|
id | string | Stable code of the check signal, e.g. impressum, domainAge, fakeshopLists. |
label | string | Language-dependent display name. |
status | ok | warn | fail | unknown | Result of this individual signal. |
impact | positive | negative | neutral | Effect on the overall score. |
reasons | string[] | Language-dependent reasoning sentences. |
display | object (optional) | Additional, harmless display values (e.g. domain age in months). |
Example response:
{
"domain": "beispiel-shop.de",
"score": 82,
"verdict": "safe",
"checkType": "shop",
"cached": false,
"checkedAt": "2026-07-02T10:15:32.000Z",
"trustLevel": {
"level": 4,
"label": "sehr sicher"
},
"confidenceBand": "high",
"summary": "Dieser Shop zeigt keine der bekannten Warnsignale für Fake-Shops.",
"recommendation": "Der Kauf erscheint unbedenklich.",
"factors": [
{
"id": "impressum",
"label": "Impressum & Rechtstexte",
"status": "ok",
"impact": "positive",
"reasons": [
"Vollständiges Impressum mit Handelsregisternummer gefunden."
]
},
{
"id": "domainAge",
"label": "Domain-Alter",
"status": "ok",
"impact": "positive",
"reasons": [
"Domain ist seit 47 Monaten registriert."
],
"display": {
"ageMonths": 47
}
}
],
"topSignals": [
{
"id": "impressum",
"label": "Impressum & Rechtstexte",
"status": "ok",
"impact": "positive",
"reasons": [
"Vollständiges Impressum mit Handelsregisternummer gefunden."
]
}
],
"faviconUrl": "https://beispiel-shop.de/favicon.ico",
"previewImage": null,
"previewCapturedAt": null
}errorCode catalog
In addition to a human-readable error text, error responses always contain a stable errorCode field. Build your error handling against errorCode, not against the text – the text can differ depending on the lang parameter.
| errorCode | HTTP status | Meaning |
|---|---|---|
url_required | 400 | url is missing from the request body, or the value is not a string. |
invalid_check_type | 400 | checkType contains an unknown value. Only shop and website are allowed. |
quota_exceeded | 429 | The daily limit has been reached. The Retry-After header states the seconds until the reset (midnight UTC). |
invalid_api_key | 401 | The provided X-Api-Key is invalid, unknown or has been blocked. |
too_many_requests | 429 | Short-term burst limit exceeded, independent of the daily limit. |
db_unavailable | 503 | The database is temporarily unavailable. Please try again later. |
Ready for production?
Create an API key in the developer portal for free – including free credit for testing. For higher volumes or questions, you can reach us any time at [email protected].