List takedowns

GET

/core/api/takedowns/

const url = 'https://app.nebty.de/core/api/takedowns/?category=website&resolution=DOMAIN_SUSPENDED&status=REQUESTED';
const options = {method: 'GET', headers: {Authorization: '<Authorization>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://app.nebty.de/core/api/takedowns/?category=website&resolution=DOMAIN_SUSPENDED&status=REQUESTED' \
  --header 'Authorization: <Authorization>'

Returns the takedown cases the API key’s user can see: those they requested and those belonging to a brand they are a member of. Newest first.

Filters: brand (UUID), status, resolution, created_after (inclusive) and created_before (exclusive), both ISO 8601. Invalid values, and created_after not earlier than created_before, are rejected with 400.

Paginated: page and page_size (default 50). On this endpoint a page_size above 100 is rejected with 400 rather than reduced.

A takedown’s status is one of REQUESTED (not yet started), OPEN, IN_PROGRESS, PENDING_RESPONSE, CLOSED, FAILED or REJECTED. CLOSED alone does not mean the site was taken down; read resolution for the outcome. price and price_currency are the price per successful takedown (net, VAT on top) agreed when the takedown was ordered, or null and empty when none was agreed at order.

Authorizations

ApiKeyAuth

Parameters

Query Parameters

brand

string format: uuid

Filter takedowns for a specific brand ID

category

string

>= 1 characters

Allowed values: website token

What the case is against: website, or token (a fake crypto token).

website - Website
token - Token

created_after

string format: date-time

Created at or after this ISO 8601 timestamp (inclusive).

created_before

string format: date-time

Created before this ISO 8601 timestamp (exclusive).

page

integer

A page number within the paginated result set.

page_size

integer

>= 1 <= 100

Items per page, 1–100; default 50. Keep this value unchanged while paging.

resolution

string

>= 1 characters

Allowed values: DOMAIN_SUSPENDED CONTENT_REMOVED SERVER_HOLD VOLUNTARY_TAKEDOWN UNRESOLVED FALSE_POSITIVE TOKEN_LISTING_REMOVED TOKEN_TRADING_BLOCKED TOKEN_WARNING_ADDED

Exact outcome. CLOSED alone does not mean successful removal.

DOMAIN_SUSPENDED - Domain Suspended
CONTENT_REMOVED - Content Removed
SERVER_HOLD - Server Hold
VOLUNTARY_TAKEDOWN - Voluntary Takedown
UNRESOLVED - Unresolved
FALSE_POSITIVE - False Positive
TOKEN_LISTING_REMOVED - Agreed token listing removed
TOKEN_TRADING_BLOCKED - Trading blocked on agreed platform
TOKEN_WARNING_ADDED - Token warning added (partial mitigation)

status

string

>= 1 characters

Allowed values: REQUESTED OPEN IN_PROGRESS PENDING_RESPONSE CLOSED FAILED REJECTED

REQUESTED - Pending review
OPEN - Open
IN_PROGRESS - In Progress
PENDING_RESPONSE - Pending Response
CLOSED - Closed
FAILED - Failed
REJECTED - Rejected

Responses

200

application/json

object

count

required

integer

next

string format: uri

nullable

previous

string format: uri

nullable

results

required

Array<object>

Serializer for takedown request details.

object

required

string format: uuid

target_website

required

The target website URL for the takedown request

string format: uri

<= 500 characters

category

What the case is against. ‘token’ is a fake crypto token (smart contract); target_website then holds the contract’s block-explorer URL, and the domain autofill and post-close rescan skip the row. Only staff may set ‘token’.

website - Website
token - Token

string

Allowed values: website token

token_platform

Token only: the specific listing or trading platform covered by the customer’s order.

string format: uri

<= 500 characters

token_objective

One of:

string
unknown

listing_removed - Remove the agreed token listing
trading_blocked - Block trading on the agreed platform

string

Allowed values: listing_removed trading_blocked

Token only: the removal or trading block agreed before work starts.

listing_removed - Remove the agreed token listing
trading_blocked - Block trading on the agreed platform

Allowed values: ""

token_agreed_at

required

Server timestamp when the complete token order scope was first recorded. The scope is then immutable.

string format: date-time

nullable

requesting_user_email

required

string

user_comment

Optional comment from the requesting user

string

nullable

brand

Brand associated with this takedown. All users with access to this brand can view the takedown.

string format: uuid

nullable

brand_display

required

string

nullable

brand_name

Legacy free-text brand name (deprecated, use brand FK instead)

string

nullable <= 255 characters

status

required

Current status of the takedown request

REQUESTED - Pending review
OPEN - Open
IN_PROGRESS - In Progress
PENDING_RESPONSE - Pending Response
CLOSED - Closed
FAILED - Failed
REJECTED - Rejected

string

Allowed values: REQUESTED OPEN IN_PROGRESS PENDING_RESPONSE CLOSED FAILED REJECTED

status_display

required

string

is_open

required

boolean

closed_at

required

Timestamp when the takedown case was closed.

string format: date-time

nullable

closed_at_source

required

One of:

string
unknown

MEASURED - Measured at closure
DERIVED_FROM_EVENT - Derived from status-change event
DERIVED_FROM_NOTE - Derived from last case note (±1 day)

string

Allowed values: MEASURED DERIVED_FROM_EVENT DERIVED_FROM_NOTE

How closed_at was arrived at: MEASURED (stamped at closure or entered by staff), DERIVED_FROM_EVENT (reconstructed from the status-change audit event, exact), DERIVED_FROM_NOTE (reconstructed from the last case note, +/-1 day), or blank when no closing date is known. Reports averaging resolution time should state how many inputs were reconstructed.

MEASURED - Measured at closure
DERIVED_FROM_EVENT - Derived from status-change event
DERIVED_FROM_NOTE - Derived from last case note (±1 day)

Allowed values: ""

resolution

required

One of:

string
unknown

DOMAIN_SUSPENDED - Domain Suspended
CONTENT_REMOVED - Content Removed
SERVER_HOLD - Server Hold
VOLUNTARY_TAKEDOWN - Voluntary Takedown
UNRESOLVED - Unresolved
FALSE_POSITIVE - False Positive
TOKEN_LISTING_REMOVED - Agreed token listing removed
TOKEN_TRADING_BLOCKED - Trading blocked on agreed platform
TOKEN_WARNING_ADDED - Token warning added (partial mitigation)

string

Allowed values: DOMAIN_SUSPENDED CONTENT_REMOVED SERVER_HOLD VOLUNTARY_TAKEDOWN UNRESOLVED FALSE_POSITIVE TOKEN_LISTING_REMOVED TOKEN_TRADING_BLOCKED TOKEN_WARNING_ADDED

Outcome of the takedown case.

DOMAIN_SUSPENDED - Domain Suspended
CONTENT_REMOVED - Content Removed
SERVER_HOLD - Server Hold
VOLUNTARY_TAKEDOWN - Voluntary Takedown
UNRESOLVED - Unresolved
FALSE_POSITIVE - False Positive
TOKEN_LISTING_REMOVED - Agreed token listing removed
TOKEN_TRADING_BLOCKED - Trading blocked on agreed platform
TOKEN_WARNING_ADDED - Token warning added (partial mitigation)

nullable

resolution_display

required

string

nullable

price

required

Price per successful takedown, net plus VAT, that the customer accepted with the order. 0.00 is a real price; null means no price was frozen.

string format: decimal

nullable /^-?\d{0,8}(?:\.\d{0,2})?$/

price_currency

required

One of:

string
unknown

USD - US$
CAD - CA$
EUR - EUR

string

Allowed values: USD CAD EUR

Currency of price; blank when no price was accepted with the order.

USD - US$
CAD - CA$
EUR - EUR

Allowed values: ""

registrar

Domain registrar, e.g. ‘Openprovider’, ‘Sav.com’

string

nullable <= 255 characters

domain_created_at

Domain registration date from WHOIS.

string format: date

nullable

domain_expires_at

Domain expiry date from WHOIS.

string format: date

nullable

domain_status

WHOIS status, e.g. ‘clientTransferProhibited’, ‘serverHold’

string

nullable <= 255 characters

ip_address

Resolved IP address (may be proxy IP).

string

nullable

origin_ip

Real server IP behind CDN/proxy.

string

nullable

asn

AS number, e.g. ‘AS13335’

string

nullable <= 20 characters

hosting_provider

Hosting provider, e.g. ‘Hostinger’, ‘Hetzner’

string

nullable <= 255 characters

cdn_proxy

CDN/proxy provider, e.g. ‘Cloudflare’

string

nullable <= 255 characters

is_proxied

Whether the domain is behind a CDN/proxy.

boolean

backend_provider

Backend service, e.g. ‘Supabase’, ‘Vercel’

string

nullable <= 255 characters

backend_project_id

Project ID at backend provider.

string

nullable <= 255 characters

ssl_issued_at

SSL certificate issue date.

string format: date

nullable

ssl_expires_at

SSL certificate expiry date.

string format: date

nullable

ssl_issuer

Certificate issuer, e.g. ‘Let’s Encrypt’, ‘Cloudflare’

string

nullable <= 255 characters

a_entry

DNS A record information (DEPRECATED - use dns_raw)

string

nullable

ns_entry

DNS NS record information (DEPRECATED - use dns_raw)

string

nullable

dns_raw

Full DNS records as JSON. Expected structure: {“a”: […], “aaaa”: […], “cname”: […], “mx”: […], “ns”: […], “txt”: […], “soa”: […], “caa”: […]}

nullable

virustotal_score

Score, e.g. ‘16/93’

string

nullable <= 20 characters

virustotal_url

Link to VirusTotal report.

string format: uri

nullable <= 200 characters

urlscan_url

Link to urlscan.io result.

string format: uri

nullable <= 200 characters

screenshot_url

URL to screenshot in Hetzner S3 Object Storage.

string format: uri

nullable <= 2000 characters

screenshot_taken_at

When the screenshot was taken.

string format: date-time

nullable

abuse_contacts

required

Array<object>

Serializer for abuse contact details.

object

required

string format: uuid

contact_type

required

REGISTRAR - Registrar
HOSTING - Hosting Provider
CDN - CDN / Proxy
BACKEND - Backend Service
REGISTRY - Domain Registry
OTHER - Other

string

Allowed values: REGISTRAR HOSTING CDN BACKEND REGISTRY OTHER

contact_type_display

required

string

provider_name

required

Provider name, e.g. ‘Cloudflare’, ‘Openprovider’

string

<= 255 characters

abuse_email

Abuse email address.

string format: email

nullable <= 254 characters

abuse_form_url

URL to abuse report form.

string format: uri

nullable <= 200 characters

report_status

NOT_SENT - Not Sent
SENT - Sent
ACKNOWLEDGED - Acknowledged
ACTION_TAKEN - Action Taken
REJECTED - Rejected
NO_RESPONSE - No Response

string

Allowed values: NOT_SENT SENT ACKNOWLEDGED ACTION_TAKEN REJECTED NO_RESPONSE

report_status_display

required

string

reported_at

string format: date-time

nullable

response_received_at

string format: date-time

nullable

case_reference

Provider case reference, e.g. ‘Case 00954977’

string

nullable <= 255 characters

notes

string

nullable

created_at

required

string format: date-time

updated_at

required

string format: date-time

blacklist_submissions

required

Array<object>

Serializer for blacklist submission details.

object

required

string format: uuid

tier

required

P1 - P1 - Immediate (GSB, Netcraft, SmartScreen)
P2 - P2 - Distribution (Spamhaus, Openphish, SpamCop)
P3 - P3 - Prevention (VirusTotal, Symantec, ScamAdviser)

string

Allowed values: P1 P2 P3

tier_display

required

string

service_name

required

Blacklist service name, e.g. ‘Google Safe Browsing’, ‘Spamhaus’

string

<= 255 characters

submission_url

URL for submission.

string format: uri

nullable <= 200 characters

status

PENDING - Pending
SUBMITTED - Submitted
LISTED - Listed
REJECTED - Rejected

string

Allowed values: PENDING SUBMITTED LISTED REJECTED

status_display

required

string

submitted_at

string format: date-time

nullable

confirmed_at

When listing was confirmed.

string format: date-time

nullable

created_at

required

string format: date-time

updated_at

required

string format: date-time

created_at

required

string format: date-time

updated_at

required

string format: date-time

Example

{
  "count": 123,
  "next": "http://api.example.org/accounts/?page=4",
  "previous": "http://api.example.org/accounts/?page=2",
  "results": [
    {
      "category": "website",
      "token_objective": "listing_removed",
      "status": "REQUESTED",
      "closed_at_source": "MEASURED",
      "resolution": "DOMAIN_SUSPENDED",
      "price_currency": "USD",
      "abuse_contacts": [
        {
          "contact_type": "REGISTRAR",
          "report_status": "NOT_SENT"
        }
      ],
      "blacklist_submissions": [
        {
          "tier": "P1",
          "status": "PENDING"
        }
      ]
    }
  ]
}

400

Invalid query parameters or request data. Field errors appear directly on the response; malformed JSON has a detail message.

application/json

Any of:

object
object

object

detail

required

string

Example

{
  "target_website": [
    "Target host is not a public address."
  ]
}

401

The API key is missing, invalid, revoked or belongs to an inactive user.

application/json

object

detail

required

string

Example^generated

{
  "detail": "example"
}

404

The requested page or record does not exist or cannot be accessed.

application/json

object

detail

required

string

Example^generated

{
  "detail": "example"
}

429

Too many requests or failed authentication attempts. Try again later.

application/json

object

detail

required

string

Example^generated

{
  "detail": "example"
}

List takedowns

Authorizations

Parameters

Query Parameters

Responses

200

Example

400

Example

401

Examplegenerated

404

Examplegenerated

429

Examplegenerated

Example^generated

Example^generated

Example^generated