Security APIs

Lets an Enterprise or Teams Bitwarden organization manage members, collections, groups and policies over OAuth2 client credentials, with no free tier and no access to individual vault items.

Searches a continuously updated index of internet connected hosts and devices for security research, needing an API ID and secret, with a limited monthly query quota on free accounts.

Lists community maintained filter lists for ad blockers such as uBlock Origin, Adblock Plus and AdGuard, with details on syntax, licence and maintenance status, free and keyless.

Fingerprints browsers on the client side to flag headless browsers, Selenium and other automation frameworks, free and MIT licensed from npm or a CDN script, no server needed.

Screens an order transaction for payment fraud and returns a 1 to 100 risk score with an approve, reject or review recommendation, with a free license key available to start testing.

Checks whether an email address appears in known data breaches, or a password in the Pwned Passwords set, where breach lookups need a paid key but password checks stay free and keyless.

Searches US arrest records, sex offender registries, inmate rosters and most wanted lists, billed per credit with no monthly fee, and new accounts start with 25 free credits.

Reads and manages bug bounty submissions, programs and payouts through a token issued in account settings, with requests capped at 60 per minute per IP address.

Pulls vulnerability reports from a bug bounty program into your own systems, checks program details, and lets you award bounties to the researcher who found a flaw.

Escapes untrusted text for safe use in HTML, shell commands or file paths to block XSS, command injection and directory traversal, run as a small open source demo on Replit.

Lets researchers submit vulnerability reports to Microsoft and pull CVE style security update data for Microsoft products, free to query without registering a key.

Grades a website security headers such as CSP and HSTS, where the original Python scanner is now archived and replaced by a Node based service backing MDN's hosted Observatory scanner.

Provides managed customer identity and access management covering registration, single sign on, multi factor authentication and profile storage, with a free trial on offer.

Searches a database of verified phishing URLs, domains and IPs refreshed every 90 minutes, where read only access needs no signup and is capped at 50 free lookups a day without a key.

Queries historical and current domain, IP, WHOIS and DNS records for security research, now run by Recorded Future, with a free account required to generate an API key.

Scans source code and repositories for exposed secrets such as API keys and credentials, and manages the resulting incidents through a personal access token, with a free individual tier.

Returns UK crime, stop and search, neighbourhood team and police force data by location and date, free and keyless, though documented call rate limits apply to heavy use.

Generates a stable visitor ID from device signals and flags bots, VPNs and tampering using separate public and secret API keys, with a free trial that needs no credit card.

Classifies an IP as internet background noise or a likely threat using sensor data, where the free Community API allows a limited number of daily lookups without a paid plan.

Discovers subdomains, exposed services and vulnerabilities across an organization's attack surface, where the free tier includes 10 query credits a month after signup.

Searches leaked documents, darknet pages and breach data by email, domain, bitcoin address or phone number with a key from the developer portal, free for personal use and paid for commercial products.

Tracks disclosed vulnerabilities and exploits with risk scoring and change logs going back decades, continuously updated, where API access needs a paid or trial key.

Looks up and scans threat indicators such as IPs, domains and URLs and pulls curated threat feeds for detection workflows, with a free API key to get started.

Serves official US government CVE and vulnerability records through API 2.0, which replaced the retired JSON feeds, needing no key though one raises the limit from 5 to 50 requests per 30 seconds.

Searches a global index of internet connected devices for open ports, banners, SSL versions and known vulnerabilities, where most endpoints need a paid API key or membership.

Issues merchant locked virtual payment cards with spending limits and real time transaction data, where using the API requires completing Privacy's identity verification first.