Skip to content
nebtynebtynebty Docs

Get a takedown

GET
/core/api/takedowns/{id}/
curl --request GET \
  --url https://app.nebty.de/core/api/takedowns/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/ \
  --header 'Authorization: <Authorization>'

Returns one takedown case with its abuse contacts and blacklist submissions. Answers 404 if the takedown does not exist or the API key’s user can neither see it as its requester nor through a brand membership.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

UUID of the takedown.

Responses

Section titled “Responses”

200

Section titled “200”
Media typeapplication/json

Serializer for takedown request details.

object
id
required
string format: uuid
target_website
required

The target website URL for the takedown request

string format: uri
<= 500 characters
requesting_user_email
required
string
user_comment

Optional comment from the requesting user

string
nullable
brand

Brand associated with this takedown. All users with access to this brand can view the takedown.

string format: uuid
nullable
brand_display
required
string
nullable
brand_name

Legacy free-text brand name (deprecated, use brand FK instead)

string
nullable <= 255 characters
status
required

Current status of the takedown request

  • REQUESTED - Requested (Pending Approval)
  • OPEN - Open
  • IN_PROGRESS - In Progress
  • PENDING_RESPONSE - Pending Response
  • CLOSED - Closed
  • FAILED - Failed
  • REJECTED - Rejected
string
Allowed values: REQUESTED OPEN IN_PROGRESS PENDING_RESPONSE CLOSED FAILED REJECTED
status_display
required
string
is_open
required
boolean
closed_at
required

Timestamp when the takedown case was closed.

string format: date-time
nullable
closed_at_source
required
One of:
  • MEASURED - Measured at closure
  • DERIVED_FROM_EVENT - Derived from status-change event
  • DERIVED_FROM_NOTE - Derived from last case note (±1 day)
string
Allowed values: MEASURED DERIVED_FROM_EVENT DERIVED_FROM_NOTE
resolution
required
One of:
  • DOMAIN_SUSPENDED - Domain Suspended
  • CONTENT_REMOVED - Content Removed
  • SERVER_HOLD - Server Hold
  • VOLUNTARY_TAKEDOWN - Voluntary Takedown
  • UNRESOLVED - Unresolved
  • FALSE_POSITIVE - False Positive
string
Allowed values: DOMAIN_SUSPENDED CONTENT_REMOVED SERVER_HOLD VOLUNTARY_TAKEDOWN UNRESOLVED FALSE_POSITIVE
resolution_display
required
string
nullable
registrar

Domain registrar, e.g. ‘Openprovider’, ‘Sav.com’

string
nullable <= 255 characters
domain_created_at

Domain registration date from WHOIS.

string format: date
nullable
domain_expires_at

Domain expiry date from WHOIS.

string format: date
nullable
domain_status

WHOIS status, e.g. ‘clientTransferProhibited’, ‘serverHold’

string
nullable <= 255 characters
ip_address

Resolved IP address (may be proxy IP).

string
nullable
origin_ip

Real server IP behind CDN/proxy.

string
nullable
asn

AS number, e.g. ‘AS13335’

string
nullable <= 20 characters
hosting_provider

Hosting provider, e.g. ‘Hostinger’, ‘Hetzner’

string
nullable <= 255 characters
cdn_proxy

CDN/proxy provider, e.g. ‘Cloudflare’

string
nullable <= 255 characters
is_proxied

Whether the domain is behind a CDN/proxy.

boolean
backend_provider

Backend service, e.g. ‘Supabase’, ‘Vercel’

string
nullable <= 255 characters
backend_project_id

Project ID at backend provider.

string
nullable <= 255 characters
ssl_issued_at

SSL certificate issue date.

string format: date
nullable
ssl_expires_at

SSL certificate expiry date.

string format: date
nullable
ssl_issuer

Certificate issuer, e.g. ‘Let’s Encrypt’, ‘Cloudflare’

string
nullable <= 255 characters
a_entry

DNS A record information (DEPRECATED - use dns_raw)

string
nullable
ns_entry

DNS NS record information (DEPRECATED - use dns_raw)

string
nullable
dns_raw

Full DNS records as JSON. Expected structure: {“a”: […], “aaaa”: […], “cname”: […], “mx”: […], “ns”: […], “txt”: […], “soa”: […], “caa”: […]}

nullable
virustotal_score

Score, e.g. ‘16/93’

string
nullable <= 20 characters
virustotal_url

Link to VirusTotal report.

string format: uri
nullable <= 200 characters
urlscan_url

Link to urlscan.io result.

string format: uri
nullable <= 200 characters
screenshot_url

URL to screenshot in Hetzner S3 Object Storage.

string format: uri
nullable <= 2000 characters
screenshot_taken_at

When the screenshot was taken.

string format: date-time
nullable
abuse_contacts
required
Array<object>

Serializer for abuse contact details.

object
id
required
string format: uuid
contact_type
required
  • REGISTRAR - Registrar
  • HOSTING - Hosting Provider
  • CDN - CDN / Proxy
  • BACKEND - Backend Service
  • REGISTRY - Domain Registry
  • OTHER - Other
string
Allowed values: REGISTRAR HOSTING CDN BACKEND REGISTRY OTHER
contact_type_display
required
string
provider_name
required

Provider name, e.g. ‘Cloudflare’, ‘Openprovider’

string
<= 255 characters
abuse_email

Abuse email address.

string format: email
nullable <= 254 characters
abuse_form_url

URL to abuse report form.

string format: uri
nullable <= 200 characters
report_status
  • NOT_SENT - Not Sent
  • SENT - Sent
  • ACKNOWLEDGED - Acknowledged
  • ACTION_TAKEN - Action Taken
  • REJECTED - Rejected
  • NO_RESPONSE - No Response
string
Allowed values: NOT_SENT SENT ACKNOWLEDGED ACTION_TAKEN REJECTED NO_RESPONSE
report_status_display
required
string
reported_at
string format: date-time
nullable
response_received_at
string format: date-time
nullable
case_reference

Provider case reference, e.g. ‘Case 00954977’

string
nullable <= 255 characters
notes
string
nullable
created_at
required
string format: date-time
updated_at
required
string format: date-time
blacklist_submissions
required
Array<object>

Serializer for blacklist submission details.

object
id
required
string format: uuid
tier
required
  • P1 - P1 - Immediate (GSB, Netcraft, SmartScreen)
  • P2 - P2 - Distribution (Spamhaus, Openphish, SpamCop)
  • P3 - P3 - Prevention (VirusTotal, Symantec, ScamAdviser)
string
Allowed values: P1 P2 P3
tier_display
required
string
service_name
required

Blacklist service name, e.g. ‘Google Safe Browsing’, ‘Spamhaus’

string
<= 255 characters
submission_url

URL for submission.

string format: uri
nullable <= 200 characters
status
  • PENDING - Pending
  • SUBMITTED - Submitted
  • LISTED - Listed
  • REJECTED - Rejected
string
Allowed values: PENDING SUBMITTED LISTED REJECTED
status_display
required
string
submitted_at
string format: date-time
nullable
confirmed_at

When listing was confirmed.

string format: date-time
nullable
created_at
required
string format: date-time
updated_at
required
string format: date-time
created_at
required
string format: date-time
updated_at
required
string format: date-time
Example
{
  "status": "REQUESTED",
  "closed_at_source": "MEASURED",
  "resolution": "DOMAIN_SUSPENDED",
  "abuse_contacts": [
    {
      "contact_type": "REGISTRAR",
      "report_status": "NOT_SENT"
    }
  ],
  "blacklist_submissions": [
    {
      "tier": "P1",
      "status": "PENDING"
    }
  ]
}

400

Section titled “400”

Invalid query parameters or request data. Field errors appear directly on the response; malformed JSON has a detail message.

Media typeapplication/json
Any of:
object
detail
required
string
Example
{
  "target_website": [
    "Target host is not a public address."
  ]
}

401

Section titled “401”

The API key is missing, invalid, revoked or belongs to an inactive user.

Media typeapplication/json
object
detail
required
string
Examplegenerated
{
  "detail": "example"
}

404

Section titled “404”

The requested page or record does not exist or cannot be accessed.

Media typeapplication/json
object
detail
required
string
Examplegenerated
{
  "detail": "example"
}

429

Section titled “429”

Too many requests or failed authentication attempts. Try again later.

Media typeapplication/json
object
detail
required
string
Examplegenerated
{
  "detail": "example"
}