Quickstart

This page takes you step by step from your API key to a takedown request and its status. You need an API key (see API access) and curl.

The responses below are shortened. The IDs are examples; use the IDs from your own responses.

1. Store your key

export NEBTY_API_KEY="nbty_your_key"

2. Check the key

curl -s https://app.nebty.de/core/api/users/profile/ \
  -H "Authorization: Api-Key $NEBTY_API_KEY"

If the key works, you get the user it belongs to:

{
  "id": "baaa409d-985c-41d8-8153-7f137fb70a57",
  "username": "jane.doe",
  "email": "[email protected]",
  "account_type": "standard"
}

3. List your brands

curl -s "https://app.nebty.de/core/api/brands/?compact=true" \
  -H "Authorization: Api-Key $NEBTY_API_KEY"

{
  "count": 1,
  "next": null,
  "previous": null,
  "results": [
    {
      "id": "f5705d11-6786-4f60-b52c-59a882ecf305",
      "name": "Solara",
      "domain": "solara.example",
      "plan": "free",
      "monitoring_enabled": true
    }
  ]
}

Copy the id of the brand you want to work with.

4. List the brand’s domains

BRAND_ID="f5705d11-6786-4f60-b52c-59a882ecf305"

curl -s "https://app.nebty.de/core/api/brands/$BRAND_ID/domains/?compact=true" \
  -H "Authorization: Api-Key $NEBTY_API_KEY"

{
  "count": 3,
  "next": null,
  "previous": null,
  "results": [
    {
      "id": "a4ac4f4c-5d7f-44b2-9ec3-8f51e4c097e3",
      "name": "solara-login.example",
      "source": "VARIATION",
      "latest_scan": null,
      "open_takedown": null
    }
  ]
}

latest_scan holds the newest scan result of the domain, and open_takedown shows a takedown that is already running for it. For the full evidence of one domain, call GET /brands/{id}/domains/{domain_id}/.

5. Request a takedown

curl -s https://app.nebty.de/core/api/takedowns/ \
  -H "Authorization: Api-Key $NEBTY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target_website": "https://solara-login.example/",
    "brand": "f5705d11-6786-4f60-b52c-59a882ecf305",
    "user_comment": "Phishing page copying our login"
  }'

The API answers 201 Created with the new takedown:

{
  "id": "ba4486fa-e8b3-48a6-9c39-6c92fb9393e4",
  "target_website": "https://solara-login.example/",
  "brand": "f5705d11-6786-4f60-b52c-59a882ecf305",
  "brand_display": "Solara",
  "status": "OPEN",
  "status_display": "Open",
  "is_open": true,
  "created_at": "2026-10-02T07:24:39.314682Z"
}

For a brand with active monitoring, the takedown starts as OPEN and the nebty team starts work. Without a brand, or for a brand without active monitoring, it starts as REQUESTED and waits for approval by nebty.

6. Follow the takedown

TAKEDOWN_ID="ba4486fa-e8b3-48a6-9c39-6c92fb9393e4"

curl -s https://app.nebty.de/core/api/takedowns/$TAKEDOWN_ID/ \
  -H "Authorization: Api-Key $NEBTY_API_KEY"

curl -s https://app.nebty.de/core/api/takedowns/$TAKEDOWN_ID/events/ \
  -H "Authorization: Api-Key $NEBTY_API_KEY"

The first call gives the current status. The second gives the case’s event timeline, the same one you see in the dashboard.

Next steps

• Basics: pagination, compact responses and errors.
• API reference: all fields of every endpoint.