Live
Service status
Check live service health and documented failure responses before you integrate.
Security & Trust
Website legal compliance API
Screen merchants, partners and your own sites for the legal pages and consent tooling they are expected to have. Each signal comes back found, not found or unknown, with the link or text it was found from.
Category
Security & Trust
Endpoints
1
Key Features
4
Frequently asked questions
4
Used by people at these companies
Trust signals before you integrate
Transparent docs, authenticated requests, and visible reliability details make it easier to evaluate DomScan before you ship.
OpenAPI
API artifacts
OpenAPI, Swagger, Postman, CLI, SDK, and MCP links are one click away.
API keys
Protected access
Authenticated endpoints use API keys with clear credit costs before you call them.
10,000
Free allowance
Start with 10,000 monthly credits and upgrade only when usage grows.
What this API helps you ship
Use this page as a production brief: endpoints, examples, response shape, and the workflow pieces needed to plug DomScan into your own product.
Embed domain checks, DNS intelligence, risk signals, or enrichment into onboarding, search, and internal tools.
Replace repeated manual lookups with scheduled jobs, alerting, and reproducible investigation steps.
Use predictable fields, documented status codes, and credit costs instead of scraping provider pages.
Feed agents, dashboards, SOAR playbooks, and CRMs through OpenAPI, SDK, Postman, or MCP.
Integration workflow
A simple path from first request to repeatable production usage.
Authenticate once
Send your API key with the documented header and keep requests consistent across services.
Query with examples
Start from the curl and HTTP samples, then map the parameters into your application code.
Operate and monitor
Use status codes, credit costs, and response fields to build retries, logs, and alerts.
Developer kit
Jump from this page into machine-readable docs, request collections, SDKs, or agent tooling.
OpenAPI schema
Generate clients or inspect every request and response shape.
Postman collectionImport ready-made requests for manual testing and team handoff.
SDKs and CLIUse maintained packages and command-line workflows instead of writing boilerplate.
MCP integrationExpose domain intelligence to AI agents and internal assistant workflows.
Parameters and response map
Scan the inputs, output fields, and status codes before wiring the endpoint into your client.
Parameter
urlrenderverify_links
Example response
statuscontextcontext.html_langcontext.regionscontext.typical_signalslinkslinks.privacy_policylinks.privacy_policy.statuslinks.privacy_policy.evidencelinks.terms_of_servicelinks.terms_of_service.statuslinks.terms_of_service.evidence
HTTP status codes
200400401402429
Endpoints
GET
/v1/legal-compliance
Trust signals before you integrate
Transparent docs, authenticated requests, and visible reliability details make it easier to evaluate DomScan before you ship.
Live
Service status
Check live service health and documented failure responses before you integrate.
OpenAPI
API artifacts
OpenAPI, Swagger, Postman, CLI, SDK, and MCP links are one click away.
API keys
Protected access
Authenticated endpoints use API keys with clear credit costs before you call them.
10,000
Free allowance
Start with 10,000 monthly credits and upgrade only when usage grows.
Key Features
Legal pages in 15 languages
Privacy policy, terms, cookie policy, imprint, accessibility statement, privacy choices, contact and refund policy.
Consent tooling
Common consent managers, the IAB TCF and GPP frameworks and Google Consent Mode, plus cookie settings links.
Trackers on the page
Known analytics, advertising, social and session replay trackers, and a flag when trackers appear with no consent tool.
Regional context
The page language and domain set which signals are normally expected, such as an imprint for German and Austrian sites.
Example request
curl -H "X-API-Key: $DOMSCAN_API_KEY" "https://domscan.net/v1/legal-compliance?url=allbirds.com"Example response
{
"status": "ok",
"context": { "html_lang": "en-US", "regions": [], "typical_signals": ["privacy_policy", "terms_of_service", "contact"] },
"links": {
"privacy_policy": { "status": "found", "evidence": { "text": "Privacy policy" } },
"terms_of_service": { "status": "found", "evidence": { "text": "Terms of service" } },
"privacy_choices": { "status": "found", "evidence": { "text": "Do Not Sell My Personal Information" } },
"imprint": { "status": "not_found" }
},
"consent": { "status": "found", "platforms": [{ "id": "onetrust", "name": "OneTrust" }] },
"trackers": { "status": "found", "detected": [{ "name": "Microsoft Clarity", "category": "session_replay" }] },
"coverage": { "score": 89, "checks_unknown": 0, "score_confidence": "full" }
}Frequently asked questions
Is this a legal assessment?
No. It reports technical evidence of what a page links to and loads. Compliance depends on what the policies say and how data is handled.
What about sites built with JavaScript?
When links are added by scripts, absences are reported as unknown. Set render=true to check the page after JavaScript runs.
What does verify_links do?
It also loads the privacy policy to confirm it is reachable and reads the site's Global Privacy Control file.
How many credits does it cost?
Two credits per page, or six with render=true. Pages that cannot be read are refunded.
Related tools and resources
HTTP status codes
These are the HTTP status codes to handle, so you can tell apart successful responses, auth issues, credits, rate limits, missing data, and upstream failures.
OK
200
Request successful
Bad Request
400
Invalid parameters
Unauthorized
401
Missing or invalid API key/session.
Payment Required
402
Not enough credits to run this request.
Too Many Requests
429
Rate limit exceeded
Check a website