DFIR Suite API Documentation

The DFIR Suite API provides programmatic access to phishing email analysis, IOC enrichment, and a growing set of security tools — all through a simple REST interface secured with API key authentication.

Quick Start

1

Create an API key

Head to the API Keys page and generate a new key. Copy it — you will only see it once.

2

Make your first request

Call the phishing analysis endpoint with a sample email source.

curl -X POST https://api.dfir-lab.ch/v1/phishing/analyze \
  -H "Authorization: Bearer sk-dfir-your-key-here" \
  -H "Content-Type: application/json" \
  -d '{"raw_email": "<your .eml content>"}'
3

Check the response

The API returns a JSON object with the analysis results, verdict, and confidence score. Every successful call deducts credits from your account based on the endpoint used.

API Playground

Try every endpoint in your browser

Free sandbox: 10 credits/week. No signup required — bring your own API key or use the built-in sandbox for anonymous testing.

Base URL

https://api.dfir-lab.ch/v1

Available Endpoints

EndpointMethodDescriptionCredits
/phishing/analyzePOSTHeuristic email analysis1
/phishing/analyze/aiPOSTAI-enhanced verdict10
/phishing/enrichPOSTIOC enrichment2
/phishing/dnsPOSTDNS configuration analysis1
/phishing/blacklistPOSTIP DNSBL check1
/phishing/geoipPOSTIP geolocation1
/phishing/safe-browsingPOSTGoogle Safe Browsing2
/phishing/checkphishPOSTCheckPhish URL scan2
/phishing/urlscanPOSTURLScan.io analysis3
/phishing/url-expandPOSTURL redirect chain1
/enrichment/lookupPOSTIOC enrichment3/indicator
/exposure/scanPOSTAttack surface scan10
/ai/triagePOSTAI alert triage10
/ai/analysisPOSTDeep incident analysis15
/ai/threat-profilePOSTThreat actor profiling20
/ai/detectPOSTDetection rule generation15
/file/analyzePOSTScript static analysis5
/file/deepPOSTDeep/dynamic/AI analysis15–60
/file/status/{sha256}GETPoll analysis status1
/healthGETService status0

Authentication

Include your API key in the Authorization header of every request using the Bearer scheme:

Authorization: Bearer sk-dfir-your-key-here