REFERENCE

StormDoor docs

A family of small, stateless HTTP APIs for screening untrusted inbound content before it reaches your app.

StormDoor is an API for screening content you didn't produce and don't control — an email address from a signup form, a domain from a contact field, a link someone pasted — before you act on it. One HTTP hostname, api.stormdoor.dev, one path per screening concern. Every gate takes a small JSON body and returns one shared response shape: a verdict, the findings that produced it, and which checks ran.

Live gates#

POST /v1/emails — Screens a single email address for deliverability and abuse signals before you rely on it.
POST /v1/domains — Screens a bare domain for existence, registration age, parking, and brand impersonation.
POST /v1/links — Follows a URL's redirect chain and screens where it actually ends up.
POST /v1/profanity — Scans free text for profane language, per the language it's written in.
POST /v1/spam — A rule-based spam signal layer over free text — links, invisible characters, mixed-script evasion, shouting and known spam phrasing.
POST /v1/prompts — A rule-based prompt-injection and jailbreak detection layer over free text, with a paid model classifier on top.
POST /v1/ip — Screens an IP address for reserved/private ranges, cloud-hosting origin, VPN ranges, and Tor exit nodes.
POST /v1/pii — Scans free text for personal data — email addresses, phone numbers, IBANs, payment cards, SE/NO/FI/DK/DE/NL/US/GB national IDs, and US routing numbers.
POST /v1/secrets — Scans free text for leaked credentials — private keys, named-provider tokens, and generic high-entropy secrets — using gitleaks' default detection rules.
POST /v1/signups — Screens a new signup in one call — the email, its domain, and (if sent) the signup IP and form behaviour.
POST /v1/forms — Screen a contact, feedback, lead or quote-request form submission in one call.

Get started#

Quickstart — get a key and make your first call.
Authentication — Bearer keys, and why browsers can't call this API.
Response format — the envelope every gate returns.
Errors & fail-open — the error shape, and what to do when a call fails.
Rate limits — per-key limits and the headers that report them.

What this API is not#

No file uploads — every gate takes JSON: an address, a domain, a URL, never a document or an image. No malware or virus scanning, no CSAM detection. Detection here is structural and rule-based: DNS lookups, RDAP registry lookups, list matches, and pattern matches — not a content-inspection engine. Each gate's own page documents exactly what it checks and what it doesn't.