API Endpoints
Every bearer-token endpoint under /api/v1, grouped by resource
API Endpoints Reference
Every endpoint that accepts a bearer token. All paths are relative to https://app.dmarcbusta.com/api/v1. Other paths under /api belong to the web app and require a browser session.
Domains
GET /domains
List the domains in your account with DMARC policy, delegation and automation level.
POST /domains
Add a domain. Body: {"name": "example.com"}. Returns the domain and its ownership verification token; a baseline scan is queued. Ownership verification is completed in the app.
GET /domains/{name}
Details for one domain.
GET /domains/{name}/status
DMARC, SPF, DKIM and automation status.
GET /domains/{name}/reports
Aggregate DMARC report statistics with pass rate. Optional ?days=7 (1–90, default 30).
SPF
GET /domains/{name}/spf
Live SPF record from DNS, the record we manage, whether they match, and the sources included.
POST /domains/{name}/spf/activate
Verify that the published SPF record points at us and activate SPF management. Rate limited with DNS writes.
POST /domains/{name}/spf/detect-sources
Detect sending sources from DMARC report data and record them against the domain. Optional body: {"deactivate_old": true}.
Sending sources
GET /domains/{name}/sources
Sending sources detected for the domain. Optional ?include_in_spf=1 to list only sources in the managed SPF record.
GET /domains/{name}/sources/intelligence
Sources with reliability scores, recommendations and whether each is already in the live SPF record.
POST /domains/{name}/sources/{source}/add-to-spf
Include a source in the managed SPF record. {source} is the numeric id from the sources list. Rate limited with DNS writes.
DMARC reports
GET /dmarc-reports/overview
Account-wide compliance summary. Optional ?range=7d|30d|90d (default 7d).
GET /dmarc-reports/domains/{name}/summary
Compliance breakdown for one domain. Optional ?range=.
GET /dmarc-reports/forensic/reports
Paginated forensic (RUF) reports. Optional ?range=, ?domain_id=, ?threat_level=, ?resolved=true|false, ?per_page=.
Alerts
GET /alerts
List alerts, filtered and paginated.
GET /alerts/summary
Alert counts by severity and status.
GET /alerts/configurations
Your alert configurations.
GET /alerts/domains
Domains with alert counts.
GET /alerts/{id}
One alert in full.
PUT /alerts/{id}
Update an alert’s status or notes.
POST /alerts/{id}/acknowledge
Acknowledge an alert.
POST /alerts/{id}/investigate
Mark an alert as under investigation.
POST /alerts/{id}/resolve
Mark an alert as resolved.
DELETE /alerts/{id}
Delete an alert.
Organizations
GET /organizations
List organizations (domain groups) with their domains.
POST /organizations
Create an organization. Body: {"name": "...", "description": "...", "domain_ids": [..]}.
GET /organizations/{id}/domains
Domains in an organization with their DMARC state.
DNS providers
POST /dns-providers/authenticate
Test and store DNS provider credentials. Body: {"provider": "cloudflare", "credentials": {...}, "account_name": "..."}.
POST /dns-providers/{provider}/import-domains
Import domains from a connected provider. Body: {"provider_id": 12, "domain_ids": [...]}. Rate limited with DNS writes.
Conventions
{name}is the domain name, for exampleexample.com. Lookups are limited to your account; a domain that belongs to someone else returns 404.{source}and{id}are numeric ids from the corresponding list endpoint.- Send request bodies as JSON with
Content-Type: application/json. Responses are always JSON. - Endpoints marked as rate limited with DNS writes share a 10-per-minute limit with the DNS write actions in the app.
Embedded scanner
GET /api/embed/{embed_key}/scan
Public scanner endpoint for whitelabel widgets. Uses an embed key, not a bearer token, and is not under /api/v1.