Kerberus APIkerberus.com ↗
Scan Web3 domains against the Kerberus blocklist and whitelist. Returns safety classification, blacklist/whitelist status, and blocked flag for any domain.
What is the Kerberus API?
The Kerberus API exposes 1 endpoint — scan_domain — that checks any Web3 domain against the Kerberus detection engine and returns 6 structured fields including is_blacklisted, is_whitelisted, is_blocked, and an overall status of green or red. It covers crypto and DeFi domains such as DEX frontends, NFT marketplaces, and Web3 wallets, giving developers a fast programmatic way to flag phishing and scam sites before users interact with them.
curl -X POST 'https://api.parse.bot/scraper/e190f387-aef2-46e6-9d62-1464e9b69c9c/scan_domain' \
-H 'X-API-Key: $PARSE_API_KEY' \
-H 'Content-Type: application/json' \
-d '{}'Typed, relational, agent-ready
A generated client with real types, enums, and the links between objects — the structure a flat JSON response can't carry. Autocompletes in your editor and reads cleanly to coding agents.
- Fully typed · autocompletes
- Objects link to objects
- Typed errors & pagination
Typed Python client. Set up the SDK in your uv project, then pull this API’s typed client:
uv add parse-sdk uv run parse init uv run parse add --marketplace kerberus-com-api
uv run parse add --marketplace pulls a pinned snapshot of this canonical API — it won’t change underneath you. To customize it, subscribe and swap to your own copy.
"""
Kerberus Domain Safety Scanner API Client
Scan Web3 domains for scam, phishing, and fraud detection.
Get your API key from: https://parse.bot/settings
"""
import os
import requests
from typing import Optional
class ParseClient:
"""Client for interacting with the Kerberus Domain Safety Scanner API."""
def __init__(self, api_key: Optional[str] = None):
"""
Initialize the Parse API client.
Args:
api_key: Optional API key. If not provided, reads from PARSE_API_KEY env var.
"""
self.base_url = "https://api.parse.bot"
self.scraper_id = "e190f387-aef2-46e6-9d62-1464e9b69c9c"
self.api_key = api_key or os.getenv("PARSE_API_KEY")
if not self.api_key:
raise ValueError("API key must be provided or set in PARSE_API_KEY environment variable")
def _call(self, endpoint: str, method: str = "POST", **params) -> dict:
"""
Make a request to the Parse API.
Args:
endpoint: The endpoint name (e.g., 'scan_domain')
method: HTTP method ('GET' or 'POST')
**params: Query parameters or JSON payload
Returns:
Response JSON as dictionary
Raises:
requests.RequestException: If the API request fails
"""
url = f"{self.base_url}/scraper/{self.scraper_id}/{endpoint}"
headers = {
"X-API-Key": self.api_key,
"Content-Type": "application/json"
}
if method.upper() == "GET":
response = requests.get(url, headers=headers, params=params)
elif method.upper() == "POST":
response = requests.post(url, headers=headers, json=params)
else:
raise ValueError(f"Unsupported HTTP method: {method}")
response.raise_for_status()
return response.json()
def scan_domain(self, domain: str) -> dict:
"""
Scan a Web3 domain for safety classification.
Checks if a domain is flagged as a scam, phishing site, or whitelisted as safe.
Args:
domain: The domain to scan (e.g., 'uniswap.org', 'opensea.io')
Returns:
Dictionary containing:
- domain: The scanned domain
- is_blocked: Whether the domain is actively blocked
- is_blacklisted: Whether the domain is on the blacklist
- is_whitelisted: Whether the domain is on the whitelist
- status: Overall safety classification ('green' or 'red')
- request_id: Unique identifier for this scan
- processed_time: Time taken to process the scan
Raises:
requests.RequestException: If the API request fails
"""
return self._call("scan_domain", method="POST", domain=domain)
def print_scan_result(result: dict) -> None:
"""Pretty print a domain scan result."""
status_emoji = "✅" if result["status"] == "green" else "🚨"
print(f"\n{status_emoji} Domain: {result['domain']}")
print(f" Status: {result['status'].upper()}")
print(f" Blocked: {result['is_blocked']}")
print(f" Blacklisted: {result['is_blacklisted']}")
print(f" Whitelisted: {result['is_whitelisted']}")
print(f" Request ID: {result['request_id']}")
print(f" Processed in: {result['processed_time']}")
if __name__ == "__main__":
# Initialize the client
client = ParseClient()
# Practical workflow: scan multiple Web3 domains and categorize results
domains_to_scan = [
"uniswap.org",
"opensea.io",
"etherscan.io",
"suspicious-defi-site.xyz",
"pancakeswap.finance"
]
safe_domains = []
blocked_domains = []
print("🔍 Scanning Web3 domains for safety...\n")
print("=" * 60)
# Scan each domain and collect results
for domain in domains_to_scan:
try:
result = client.scan_domain(domain)
print_scan_result(result)
# Categorize results for summary
if result["status"] == "green":
safe_domains.append({
"domain": result["domain"],
"whitelisted": result["is_whitelisted"]
})
else:
blocked_domains.append({
"domain": result["domain"],
"blacklisted": result["is_blacklisted"]
})
except requests.RequestException as e:
print(f"\n❌ Error scanning {domain}: {e}")
except Exception as e:
print(f"\n⚠️ Unexpected error scanning {domain}: {e}")
# Print summary report
print("\n" + "=" * 60)
print("\n📊 SCAN SUMMARY REPORT")
print(f"Total domains scanned: {len(domains_to_scan)}")
print(f"Safe domains: {len(safe_domains)}")
print(f"Blocked domains: {len(blocked_domains)}")
if safe_domains:
print("\n✅ Safe domains:")
for item in safe_domains:
whitelist_status = "(whitelisted)" if item["whitelisted"] else "(verified safe)"
print(f" • {item['domain']} {whitelist_status}")
if blocked_domains:
print("\n🚨 Blocked domains:")
for item in blocked_domains:
blacklist_status = "(blacklisted)" if item["blacklisted"] else "(blocked)"
print(f" • {item['domain']} {blacklist_status}")
print("\n" + "=" * 60)Scan a Web3 site domain to check if it is flagged as a scam, phishing site, or is whitelisted as safe. Returns blocklist/whitelist status and an overall safety classification (green for safe, red for blocked).
| Param | Type | Description |
|---|---|---|
| domainrequired | string | The domain to scan for safety (e.g. 'uniswap.org', 'opensea.io'). May include or omit protocol prefix (https:// is stripped automatically). Should be a bare domain without path. |
{
"type": "object",
"fields": {
"domain": "string - the scanned domain",
"status": "string - overall safety classification: 'green' (safe) or 'red' (blocked)",
"is_blocked": "boolean - whether the domain is actively blocked by Kerberus",
"request_id": "string - unique identifier for this scan request",
"is_blacklisted": "boolean - whether the domain is on the Kerberus blacklist",
"is_whitelisted": "boolean - whether the domain is on the Kerberus whitelist",
"processed_time": "string - time taken to process the scan"
},
"sample": {
"domain": "uniswap.org",
"status": "green",
"is_blocked": false,
"request_id": "7e6b4429-ad39-403c-9ac2-a00f405f4d71",
"is_blacklisted": false,
"is_whitelisted": true,
"processed_time": "3ms"
}
}About the Kerberus API
What the API Returns
The single scan_domain endpoint accepts a domain string — with or without a protocol prefix — and returns a JSON object with six fields. The status field is the top-level verdict: green means the domain is considered safe, red means it is blocked. Three boolean fields (is_blocked, is_blacklisted, is_whitelisted) give finer-grained detail about exactly how the Kerberus engine classified the domain. A request_id string uniquely identifies the scan for tracing, and processed_time records how long the scan took.
Input Behavior
The only required input is domain. You can pass bare domains like uniswap.org or full URLs like https://opensea.io — the endpoint normalises both. There are no optional filter parameters; every call returns the full classification object for the submitted domain. Submissions are one domain per request, so batch checking requires multiple sequential or parallel calls.
Blocklist vs. Whitelist
The is_blacklisted and is_whitelisted fields are independent booleans drawn from separate Kerberus lists, so a domain could theoretically appear on neither list (unclassified) while still returning a status. The is_blocked field reflects whether the domain is actively suppressed by the Kerberus engine, which may differ from raw blacklist membership if the engine applies additional scoring logic. When building safety checks, consuming all three fields rather than relying solely on status gives the most complete picture.
The Kerberus API is a managed, monitored endpoint for kerberus.com — not a raw scraper you maintain. Every endpoint is automatically health-checked on a schedule, and when kerberus.com changes and a check fails, the API is automatically queued for repair and re-verified. It is built to keep working as the site underneath it changes.
This isn't an official kerberus.com API — it's an independent, maintained REST wrapper over public data. Where the source has no official API (or only a limited one), Parse gives you a stable contract over a source that never promised one, and keeps it current. Need a new endpoint or field? You can revise it yourself in plain English and the agent rebuilds it against the live site in minutes — contributing the change back to the shared API is free.
Will this API break when the source site changes?+
Is this an official API from the source site?+
Can I fix or extend this API myself if I need a new endpoint or field?+
What happens if I call an endpoint that has an issue?+
- Block Web3 wallet UI from loading known phishing domains using the
is_blockedflag before connecting. - Warn DeFi app users before redirecting to an external DEX or bridge by checking
statusagainstred. - Build a browser extension that pre-screens NFT marketplace links using
is_blacklistedandis_whitelisted. - Log
request_idandprocessed_timeto audit a history of domain safety checks in a security dashboard. - Automate a CI step that rejects any newly added third-party Web3 domain that returns
is_blocked: true. - Cross-reference airdrop claim links against the Kerberus blacklist before distributing them to community members.
| Tier | Price | Credits/month | Rate limit |
|---|---|---|---|
| Free | $0/mo | 100 | 5 req/min |
| Hobby | $30/mo | 1,000 | 20 req/min |
| Developer | $100/mo | 5,000 | 100 req/min |
One credit = one API call regardless of which marketplace API you call. Exceeding the rate limit returns a 429 response. Authenticate with the X-API-Key header.
Does Kerberus have an official developer API?+
What is the difference between `is_blacklisted` and `is_blocked`?+
is_blacklisted indicates the domain appears on the Kerberus blacklist data set. is_blocked indicates the domain is actively blocked by the Kerberus engine, which may reflect additional scoring beyond raw list membership. A domain can be blacklisted without currently being blocked, or blocked through engine logic even if not yet formally listed. For the strictest safety gate, treat either true value as a signal to warn or halt.Can the API return a safety score or confidence level instead of just a binary `green`/`red` status?+
scan_domain endpoint returns a two-value status field (green or red) along with three boolean classification fields. There is no numeric risk score or confidence percentage in the response. You can fork this API on Parse and revise it to add a scoring layer or additional metadata endpoint if the source exposes that data.Can I scan multiple domains in a single request?+
scan_domain endpoint accepts one domain string per call. Checking a list of domains requires multiple requests. You can fork this API on Parse and revise it to add a batch endpoint if that capability becomes available.Does the API cover non-Web3 or traditional web domains?+
is_whitelisted and is_blacklisted fields will reflect whatever the Kerberus dataset contains for a given domain regardless of category.