Shop check API

You send a shop address and get back the same check as on our website: verdict, trust score and the reasons behind it. That lets you build, for example, a warning before payment or a pre-check for support.

Create an API key Go to quickstart

POST /api/check

{ "url": "https://beispiel-shop.example" }

200 OK

{
  "domain": "beispiel-shop.example",
  "score": 82,
  "verdict": "safe",
  "checkedAt": "2026-09-28T10:15:32.000Z",
  …
}

Shown on the websiteNo major warning

Fictional example with a made-up address (.example).

Your first API call

A single POST request to /api/check is all it takes. Without an API key, a free quota of 50 checks per day and IP address applies.

RequestPOST /api/check

curl -X POST "https://fakeshop.ai/api/check?lang=de" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: fsk_live_ihr_schluessel" \
  -d '{"url": "https://beispiel-shop.example"}'

Response200 OK

Point at a field name or tap it to see what the field contains.

{: "beispiel-shop.example",: 82,: "safe",: "shop",: true,: "2026-09-28T10:15:32.000Z",: { "level": 4, "label": "no findings" },: "high",: "fashion",: "none",: "Fictional example: no clear warning signs in the features checked.",: "Still pay with a method that offers buyer protection.",: [{: "tradeRegister",: "Commercial register",: "ok",: "positive",: ["The company from the legal notice is registered under the stated number."]},{: "domainAge",: "Domain age",: "ok",: "positive",: ["The domain has been registered for 47 months."],: { "ageMonths": 47 }}],: [{: "tradeRegister",: "Commercial register",: "ok",: "positive",: ["…"]}],: {"kind": "ai","text": "Automated assessment, partly generated with AI. No guarantee, not legal advice. Liability as set out in our terms of use.","aiInvolved": true,"regulation": "EU 2024/1689 Art. 50","termsUrl": "https://fakeshop.ai/en/nutzungsbedingungen","methodUrl": "https://fakeshop.ai/en/methodik#ki-einsatz"}}

verdictsafe | suspicious | danger | not_a_shop | unreachable

Overall assessment.

verdict is a code value. The website shows safe as “No major warning”. All values

Access and limits

50
Without a key
50 checks per day and IP address, free
100
With a key
1 credit per check, 100 credits per month are free
20
Short-term limit
Independently of that, all requests are subject to a short-term limit of 20 checks per minute per IP address (status 429, too_many_requests).
JSON
Format
JSON over HTTPS, texts in German or English

Authentication with an API key

Authenticated requests send their key in the X-Api-Key header. Without a key, requests run anonymously through the IP-based quota. You create a key yourself in the developer portal. Accounts with an API key receive 100 free credits per month. For questions about larger volumes, reach us at [email protected].

Header

X-Api-Key: fsk_live_ihr_schluessel

We store keys only as a hash. A lost key therefore cannot be shown again. You delete it and create a new one. You can set a daily limit per key.

Quotas and limits

Without an API key, 50 checks per day and IP address are free. With a key, each check costs one credit. In addition, all requests are subject to a short-term limit of 20 checks per minute per IP address.

Status	Error code	When
`402`	`insufficient_credits`	The credit balance is used up.
`429`	`quota_exceeded`	The keyless daily quota is used up. The Retry-After header gives the seconds until the reset at midnight UTC.
`429`	`too_many_requests`	More than 20 checks per minute per IP address.

Systematic scraping or abuse of the free quotas is prohibited and may lead to the IP address being blocked. For higher limits or production integrations, please contact us at [email protected].

What the verdict values mean

The verdict field always returns an English code value. Our website shows verdict words for it; safe appears as “No major warning”, never as “safe”. A code value is not a recommendation, it summarises the features checked as of the check date.

verdict	Shown on the website*	Meaning
`safe`	No major warning	No substantiated warning signs in the features checked. Not a recommendation and not a guarantee.
`suspicious`	Suspicious	A mixed picture: some features count in the shop’s favour, others are missing or unclear.
`danger`	Danger	Several serious warning signs or an entry on an evaluated warning list.
`not_a_shop`	Not a shop	The address does not lead to an online shop. score is null.
`unreachable`	Not verifiable	The site could not be reached. score is null.

Automated assessment, partly generated with AI. No guarantee, not legal advice. Liability as set out in our terms of use. How we check.

API reference

POST /api/check accepts these parameters.

Parameter	Location	Type	Required	Description
`url`	Body	string	Yes	The shop or website URL to check.
`checkType`	Body	shop \| website	No	Check profile. Default is shop. website allows a credibility check when the URL is not an online shop.
`force`	Body	boolean	No	Forces a fresh check instead of a stored result. Stored results are reused for up to 7 or 90 days depending on the case.
`lang`	Query	de \| en	No	Language of the text fields (summary, recommendation, reasons). Alternatively via Accept-Language. Default is de.

Top-level fields:

Field	Type	Description
`domain`	string	Checked domain without protocol.
`score`	number \| null	Trust score from 0 to 100, higher means more trust. null for not_a_shop, unreachable or while the result is under manual review.
`verdict`	safe \| suspicious \| danger \| not_a_shop \| unreachable	Overall assessment.
`checkType`	shop \| website	Applied check profile.
`productCategory`	string \| null	Product category of the shop, e.g. electronics or fashion, if detected.
`fakeshopStatus`	none \| suspected \| confirmed	none, suspected or confirmed. confirmed means: a warning-list match or manual confirmation.
`trustLevel`	{ level, label }	level is 1 to 5 (machine-readable), label is a language-dependent display text.
`confidenceBand`	high \| medium \| low	How reliable the data basis for this assessment is.
`summary`	string \| null	Short, language-dependent summary of the result.
`recommendation`	string \| null	Plain-text recommendation for action.
`factors`	Factor[]	The individual features: { id, label, status, impact, reasons[], display? }.
`topSignals`	Factor[]	The most notable features, same shape as factors.
`aiContent`	object (optional)	Present only if the response contains text from a language model: regulation (EU 2024/1689 Art. 50), digitalSourceType, label and the list of affected fields in fields. Anyone who publishes these texts must label them themselves under Art. 50(4) AI Act.
`notice`	{ kind, text, aiInvolved, termsUrl, methodUrl }	Note on the classification: kind states its origin (ai = own check with a language model, auto, list, directory, manual, reports), text is the sentence on warranty and liability, aiInvolved says whether a language model took part. termsUrl leads to the terms of use, methodUrl to the methodology. If you display a verdict or the trust score, display this note with it.
`cached`	boolean	true if the result comes from an earlier check (see checkedAt).
`checkedAt`	string (ISO 8601)	Timestamp of the (most recent) check.
`faviconUrl`	string \| null	Favicon of the checked domain, if available.
`previewImage`	string \| null	Image of the home page if available; usually null.

Fields per entry in factors / topSignals:

Field	Type	Description
`id`	string	Stable code of the feature, e.g. impressum, domainAge, fakeshopLists.
`label`	string	Language-dependent display name.
`status`	ok \| warn \| fail \| unknown	Result of this individual feature.
`impact`	positive \| negative \| neutral	Effect on the trust score.
`reasons`	string[]	Language-dependent reasoning sentences.
`aiGenerated`	true (optional)	true if a language model wrote the reasons of this feature. The same flag appears as display.aiGenerated on the research summary of the reputationCheck feature (display.summary). If you publish these texts, label them under Art. 50(4) AI Act.
`display`	object (optional)	Additional, harmless display values (e.g. domain age in months).

In addition to a human-readable error text, error responses always contain a stable errorCode field. Build your error handling against errorCode. The text can differ depending on the lang parameter.

Code	HTTP status	Meaning
`url_required`	400	url is missing from the request body, or the value is not a string.
`invalid_check_type`	400	checkType contains an unknown value. Only shop and website are allowed.
`quota_exceeded`	429	The keyless daily quota or the key’s daily limit has been reached. Retry-After states the seconds until midnight UTC.
`invalid_api_key`	401	The provided X-Api-Key is invalid, unknown or has been blocked.
`too_many_requests`	429	Short-term burst limit exceeded, independent of the daily limit.
`insufficient_credits`	402	The key’s credit balance is used up.
`queue_unavailable`	503	Status query only: the queue is currently unavailable.
`job_not_found`	404	Status query only: the jobId is unknown or has expired.
`scan_failed`	200	Status query only: the check failed (body { status: "failed" }).

Try it without a key

The two endpoints below are public. The button calls them from your browser and shows the response unchanged.

Recorded response from 3 October 2026 (not fetched yet)

200 OK

{
  "totalChecks": 79554,
  "fakeShopsDetected": 37513,
  "cleanShops": 42036,
  "checksToday": 0,
  "fakeQuota": 0.4715413429871534,
  "updatedAt": "2026-10-03T12:10:29.861Z"
}

Equivalent to this call: curl "https://fakeshop.ai/api/stats"

The numbers and domains in the live response change with our data. For fields and status codes, follow the reference above.

About the stats response: fakeQuota is fakeShopsDetected divided by totalChecks (0.47 equals 47%). checksToday counts the checks since UTC midnight, so the value is close to 0 shortly after midnight.

Credit prices

One credit equals one check. You buy credits once in the developer portal, without a subscription. Prices as of: 02/10/2026.

Starter
100credits
€4.90
€0.049 per check
Standard
1,000credits
€24.00
€0.024 per check
Pro
5,000credits
€89.00
€0.018 per check
Business
25,000credits
€299.00
€0.012 per check

Free: 100 credits per month with an account, 50 checks per day and IP without a key.

Further public endpoints

These endpoints need no key and cost no credits.

GET /api/warnlist
Parameters
limit (default 50, max 1000), offset
Returns
Domains on the warning list with category and check date
GET /api/fakeshops
Parameters
limit (default 50, max 200)
Returns
Listed shops (warning list or assessment Danger) with product category
GET /api/stats
Parameters
none
Returns
Totals: domains checked, shops listed, timestamp
GET /api/iban-check
Parameters
iban (max. 30 requests per minute and IP)
Returns
Whether there are approved reports for this IBAN, count, date of the first

A key for production use

You create the API key yourself in the developer portal. 100 credits per month are free. For higher volumes or questions, you can reach us at [email protected].

Go to developer portal

Shop check API

Your first API call

Access and limits

Without a key

With a key

Short-term limit

Format