# StormDoor docs /docs — A family of small, stateless HTTP APIs for screening untrusted inbound content before it reaches your app. /docs/quickstart — Get an API key and make your first call. /docs/authentication — Bearer keys, kept server-side. Browsers can't call this API directly. /docs/response — One envelope, identical across every gate. /docs/errors — One error shape, stable codes, and what fail-open actually means. /docs/rate-limits — Per-key limits, reported on every response. /docs/gates/emails — Screens an email address before you accept it: syntax, MX records, disposable domain (61,733 known as of 27 Sep 2026), role account, typo domain and alias normalisation, in one call. It does not verify that the mailbox exists. /docs/findings/email.disposable_domain — The domain is a known disposable/throwaway email provider. /docs/findings/email.disposable_infrastructure — The domain is not on the disposable list, but its mail servers also host known disposable domains. /docs/findings/email.domain_not_found — The address's domain doesn't exist in DNS at all. /docs/findings/email.invalid_syntax — The address is not structurally valid — it can't be mail, regardless of the domain. /docs/findings/email.no_mx — The domain resolves but publishes no MX records at all. /docs/findings/email.null_mx — The domain explicitly declares, via RFC 7505, that it accepts no mail. /docs/findings/email.role_account — The address's local part matches a known shared or automated mailbox name. /docs/findings/email.typo_domain — The domain looks like a one- or two-character typo of a major webmail provider. /docs/findings/email.young_domain — The address's domain was registered less than 30 days ago. /docs/gates/domains — Screens a domain name: whether it resolves, whether and when it was registered (via RDAP), whether it is parked, and whether it typosquats a known brand. /docs/findings/domain.newly_registered — The domain was registered fewer than 30 days ago. /docs/findings/domain.not_found — The domain has no DNS presence at all — it doesn't exist. /docs/findings/domain.not_registered — RDAP has no registration record for this domain. /docs/findings/domain.parked — The domain is delegated to a known domain-parking nameserver, not in active use. /docs/findings/domain.typosquat — The domain looks like a one- or two-character typo of a well-known brand domain. /docs/gates/links — Screens a URL by following its redirect chain (up to 10 hops), checking the destination domain with the domain checks, and flagging known URL shorteners. /docs/findings/link.hop_cap_exceeded — The redirect chain didn't reach a final response within 10 hops. /docs/findings/link.shortener_chain — The redirect chain passes through two or more distinct link-shortener services. /docs/findings/link.unsafe_redirect_target — A hop in the chain redirected somewhere the walker refused to follow. /docs/gates/profanity — Matches a text against 1,311 profane words in 12 languages, detects the language, and can flag text in a language you did not expect. /docs/findings/profanity.word — The text matches a word or phrase on the applicable language's profanity list. /docs/findings/text.unexpected_language — The text is confidently written in a language outside the languages you told us your users write in. /docs/gates/spam — Screens a message with seven rule-based checks (link density, invisible characters, mixed-script lookalikes, shouting, known phrases in English and Swedish, language checks) plus an optional, separately labelled model classifier. /docs/findings/spam.invisible_characters — The text contains zero-width, bidi-control or other invisible formatting characters. /docs/findings/spam.known_phrase — The text matches a curated known spam or scam phrase for the applicable language. /docs/findings/spam.likely_spam — A model classifier scored this text as likely spam. /docs/findings/spam.link_density — The message is mostly links rather than text. /docs/findings/spam.mixed_script — A single word mixes Latin letters with Cyrillic or Greek letters that look like Latin ones. /docs/findings/spam.off_platform_contact — The message invites the reader to continue on a messenger. /docs/findings/spam.sales_pitch — The message reads like a cold sales pitch aimed at the site owner. /docs/findings/spam.shouting — The message is almost entirely capital letters. /docs/gates/prompts — Screens text bound for an LLM with seven rule-based checks (override-instruction phrasing in 17 languages, fake chat delimiters, hidden text, exfiltration links, system-prompt extraction, jailbreak roleplay, encoded payloads) plus an optional, separately labelled model classifier that on its own cannot produce block. /docs/findings/prompt.addressed_to_model — The text speaks to an AI reading it and gives it an instruction. /docs/findings/prompt.encoded_payload — Text hidden behind an encoding (base64, hex, URL-percent, HTML entities, ROT13) that decodes to instruction-like content. /docs/findings/prompt.exfiltration_link — A Markdown image or link whose URL query string carries an unresolved template placeholder. /docs/findings/prompt.fake_delimiter — The text contains a forged chat-template role delimiter (ChatML, Llama/Mistral, or a Markdown-heading-style turn marker). /docs/findings/prompt.hidden_text — The text contains zero-width, bidi-control, Unicode Tag, variation-selector, filler or private-use characters that hide content from a human reader. /docs/findings/prompt.jailbreak_roleplay — The text matches known jailbreak role-play framing — DAN-style personas, "developer mode", claims of no restrictions. /docs/findings/prompt.likely_injection — A model classifier scored this text as a likely prompt injection or jailbreak attempt. /docs/findings/prompt.override_instructions — The text matches a curated, multilingual "ignore/disregard/forget the previous instructions" phrase. /docs/findings/prompt.persistence_instruction — The text tries to make an instruction outlive the conversation, by writing to the assistant's memory or changing its behaviour from now on. /docs/findings/prompt.system_prompt_extraction — The text asks the assistant to reveal its own system prompt or instructions. /docs/findings/prompt.unicode_smuggling — Invisible Unicode characters that decode to a readable message addressed to the model. /docs/gates/ip — Screens an IP address for non-public ranges, cloud hosting ranges (AWS, Azure, GCP, Oracle, DigitalOcean) and Tor exit nodes. It does not detect VPNs. /docs/findings/ip.hosting_provider — The address is inside a published cloud-hosting-provider range (AWS, GCP, Oracle Cloud, DigitalOcean, or Azure). /docs/findings/ip.not_public — The address is private, loopback, link-local, carrier-grade NAT, documentation/benchmarking, or reserved — not publicly routable. /docs/findings/ip.tor_exit — The address is a known Tor exit node. /docs/findings/ip.vpn_provider — The address is inside a known commercial VPN range. /docs/gates/pii — Finds personal data in a block of text: email addresses, phone numbers, IBANs, payment card numbers and national IDs for Sweden, Norway, Finland, Denmark, Germany and the Netherlands. /docs/findings/pii.bank_routing_us — A US ABA bank routing number appears next to a routing keyword in the free text. /docs/findings/pii.email_address — An email address appears in the free text. /docs/findings/pii.iban — An IBAN — valid mod-97 checksum and matching the issuing country's fixed length — appears in the free text. /docs/findings/pii.national_id_de — A German Steuer-ID / IdNr appears near a recognisable label like "Steuer-ID" or "IdNr" in the free text. /docs/findings/pii.national_id_dk — A Danish CPR number appears near the word "CPR" in the free text. /docs/findings/pii.national_id_fi — A Finnish henkilötunnus — a valid century sign, a valid mod-31 check character, and a plausible date — appears in the free text. /docs/findings/pii.national_id_gb — A UK National Insurance number appears in the free text. /docs/findings/pii.national_id_nl — A Dutch BSN (burgerservicenummer) appears near a recognisable label like "BSN" in the free text. /docs/findings/pii.national_id_no — A Norwegian fødselsnummer or D-number — two valid mod-11 check digits and a plausible date — appears in the free text. /docs/findings/pii.national_id_se — A Swedish personnummer or samordningsnummer, 10- or 12-digit form — valid Luhn checksum and a plausible date — appears in the free text. /docs/findings/pii.national_id_us — A US Social Security number appears in the free text. /docs/findings/pii.payment_card — A payment card number — valid Luhn checksum and a real issuer's BIN prefix — appears in the free text. /docs/findings/pii.phone_number — A phone number, written with a "+" country code, appears in the free text. /docs/gates/secrets — Finds leaked credentials in text: PEM private keys, 221 provider token formats (from gitleaks v8.30.1) and generic keyword-plus-entropy credentials. It returns the offset and pattern name, never the matched value. /docs/findings/secret.connection_string — A database or broker URL with a password embedded in it appears in the text. /docs/findings/secret.generic_credential — A credential-shaped keyword next to a high-entropy value appears in the text, with no named provider's format matched. /docs/findings/secret.jwt — A JSON Web Token whose claims do not mark it as a public key appears in the text. /docs/findings/secret.private_key — A "-----BEGIN ... PRIVATE KEY-----" PEM block appears in the text. /docs/findings/secret.provider_token — A named provider's own credential format — AWS, GitHub, Stripe, Slack, and ~215 more — appears in the text. /docs/findings/secret.test_mode_token — A Stripe test-mode secret key (sk_test_ or rk_test_) appears in the text. /docs/findings/secret.url_credentials — A username and password embedded in an http(s) URL or an HTTP Basic Authorization header appears in the text. /docs/gates/signups — Screens a signup in one call by running the email, domain and IP checks (13 in total) concurrently and returning a single verdict for the form. /docs/findings/signup.automation_user_agent — The end user's User-Agent names a scripted HTTP client or a headless browser. /docs/findings/signup.honeypot_filled — The hidden honeypot field arrived with a value in it. /docs/findings/signup.suspicious_name — The name contains a URL, an email address, or a long run of random-looking consonants. /docs/findings/signup.too_fast — The form was submitted less than 1.5 seconds after it rendered. /docs/gates/forms — Screens a contact, feedback, lead or quote-request form submission in one call by running the spam, prompt-rule, email, domain, IP and signup-behaviour checks concurrently and returning a single verdict, plus an optional, separately labelled model classifier. /docs/findings/form.link_in_name — The name field contains a URL, a domain or an email address. /docs/findings/form.link_in_subject — The subject field contains a URL with a scheme, a www. address or an email address. Every gate is a POST with a small JSON body, returns the same envelope with a verdict of clean, suspect or block, runs every entitled check on every call, retains nothing, and fails open with fail_open: true when it cannot answer. # Free tools (rules only, no account — run any gate above from the website) /tools/email-checker — Email checker /tools/mx-lookup — MX lookup /tools/disposable-email-checker — Disposable email checker /tools/domain-age-checker — Domain age checker /tools/link-checker — Link checker /tools/redirect-checker — Redirect checker /tools/iban-checker — IBAN checker # Guides (reference pages with sources and dates; /guides lists them by topic) /guides/best-disposable-email-detection-apis — Disposable email detection APIs compared (2026). Which disposable email API should you use? Eight options compared on price per 1,000 lookups, approach and list size. Prices checked October 2026. /guides/email-validation-vs-verification — Email validation vs email verification: what each one does to your users. Validation checks an address without contacting the mailbox, SMTP verification probes it, and only a confirmation email proves ownership. /guides/disposable-email-infrastructure — How disposable email services hide, and how shared mail servers give them away. Disposable email domains change constantly, but the mail servers behind them do not. Measured results from a 61,888-domain list. /guides/disposable-email-domain-age — How old are disposable email domains? RDAP registration dates for 335 live disposable email domains: median age 5.3 years, only 2.1% under 30 days old. /guides/disposable-email-mail-providers — Which mail servers disposable email domains run on. We resolved MX for 2,000 random disposable domains: 69% have no mail server, and the rest cluster on a few dozen hosts. /guides/link-redirect-chains — How link shorteners and redirect chains hide where a link goes. How HTTP redirects, meta refresh, JavaScript and shorteners hide a link's destination, with hop counts we measured on 23 public URLs. /guides/iban-formats-by-country — IBAN formats and lengths for every country. IBAN length and format for all 89 countries, with a valid example for each and a worked mod-97 checksum. /guides/perspective-api-alternatives — Perspective API is shutting down: alternatives for toxicity and comment moderation. Perspective API ends 31 December 2026. Compare OpenAI, Azure, Google, AWS, Hive, Sightengine, Detoxify and Llama Guard on attributes and self-hosting. /guides/best-prompt-injection-detection-tools — Prompt injection detection tools compared (2026). Which prompt injection detector fits your stack? Lakera, Prompt Guard 2, LLM Guard, Bedrock, Azure, Model Armor and more, with sourced prices.