Request a takedown

POST

/core/api/takedowns/

curl --request POST \
  --url https://app.nebty.de/core/api/takedowns/ \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "target_website": "https://example.com", "user_comment": "example", "brand": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" }'

• Production

Requests a takedown of a website. Send target_website (an http or https URL on a public host; localhost and non-public IP addresses are rejected) and optionally brand (UUID) and user_comment.

If you pass brand, the API key’s user must be a member of it, otherwise the request is rejected with 400.

The status of the new takedown depends on the brand. With a brand that has monitoring enabled, the takedown starts as OPEN. Without a brand, or with a brand whose monitoring is disabled, it starts as REQUESTED and waits for approval by nebty; once approved it becomes OPEN, otherwise REJECTED. The status in the 201 response tells you which.

Authorizations

• ApiKeyAuth

Request Body^required

Serializer for creating new takedown requests.

object

target_website

required

The target website URL for the takedown request

string format: uri

<= 500 characters

user_comment

Optional comment from the requesting user

string

nullable

brand

Brand associated with this takedown. All users with access to this brand can view the takedown.

string format: uuid

nullable

Example^generated

{
  "target_website": "https://example.com",
  "user_comment": "example",
  "brand": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
}

Serializer for creating new takedown requests.

object

target_website

required

The target website URL for the takedown request

string format: uri

<= 500 characters

user_comment

Optional comment from the requesting user

string

nullable

brand

Brand associated with this takedown. All users with access to this brand can view the takedown.

string format: uuid

nullable

Example^generated

target_website=https%3A%2F%2Fexample.com&user_comment=example&brand=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0

Serializer for creating new takedown requests.

object

target_website

required

The target website URL for the takedown request

string format: uri

<= 500 characters

user_comment

Optional comment from the requesting user

string

nullable

brand

Brand associated with this takedown. All users with access to this brand can view the takedown.

string format: uuid

nullable

Responses

201

Media typeapplication/json

Serializer for takedown request details.

object

id

required

string format: uuid

target_website

required

The target website URL for the takedown request

string format: uri

<= 500 characters

requesting_user_email

required

string

user_comment

Optional comment from the requesting user

string

nullable

brand

Brand associated with this takedown. All users with access to this brand can view the takedown.

string format: uuid

nullable

brand_display

required

string

nullable

brand_name

Legacy free-text brand name (deprecated, use brand FK instead)

string

nullable <= 255 characters

status

required

Current status of the takedown request

• REQUESTED - Requested (Pending Approval)
• OPEN - Open
• IN_PROGRESS - In Progress
• PENDING_RESPONSE - Pending Response
• CLOSED - Closed
• FAILED - Failed
• REJECTED - Rejected

string

Allowed values: REQUESTED OPEN IN_PROGRESS PENDING_RESPONSE CLOSED FAILED REJECTED

status_display

required

string

is_open

required

boolean

closed_at

required

Timestamp when the takedown case was closed.

string format: date-time

nullable

closed_at_source

required

One of:

string

• MEASURED - Measured at closure
• DERIVED_FROM_EVENT - Derived from status-change event
• DERIVED_FROM_NOTE - Derived from last case note (±1 day)

string

Allowed values: MEASURED DERIVED_FROM_EVENT DERIVED_FROM_NOTE

unknown

How closed_at was arrived at: MEASURED (stamped at closure or entered by staff), DERIVED_FROM_EVENT (reconstructed from the status-change audit event, exact), DERIVED_FROM_NOTE (reconstructed from the last case note, +/-1 day), or blank when no closing date is known. Reports averaging resolution time should state how many inputs were reconstructed.

• MEASURED - Measured at closure
• DERIVED_FROM_EVENT - Derived from status-change event
• DERIVED_FROM_NOTE - Derived from last case note (±1 day)

Allowed values: ""

resolution

required

One of:

string

• DOMAIN_SUSPENDED - Domain Suspended
• CONTENT_REMOVED - Content Removed
• SERVER_HOLD - Server Hold
• VOLUNTARY_TAKEDOWN - Voluntary Takedown
• UNRESOLVED - Unresolved
• FALSE_POSITIVE - False Positive

string

Allowed values: DOMAIN_SUSPENDED CONTENT_REMOVED SERVER_HOLD VOLUNTARY_TAKEDOWN UNRESOLVED FALSE_POSITIVE

unknown

Outcome of the takedown case.

• DOMAIN_SUSPENDED - Domain Suspended
• CONTENT_REMOVED - Content Removed
• SERVER_HOLD - Server Hold
• VOLUNTARY_TAKEDOWN - Voluntary Takedown
• UNRESOLVED - Unresolved
• FALSE_POSITIVE - False Positive

nullable

resolution_display

required

string

nullable

registrar

Domain registrar, e.g. ‘Openprovider’, ‘Sav.com’

string

nullable <= 255 characters

domain_created_at

Domain registration date from WHOIS.

string format: date

nullable

domain_expires_at

Domain expiry date from WHOIS.

string format: date

nullable

domain_status

WHOIS status, e.g. ‘clientTransferProhibited’, ‘serverHold’

string

nullable <= 255 characters

ip_address

Resolved IP address (may be proxy IP).

string

nullable

origin_ip

Real server IP behind CDN/proxy.

string

nullable

asn

AS number, e.g. ‘AS13335’

string

nullable <= 20 characters

hosting_provider

Hosting provider, e.g. ‘Hostinger’, ‘Hetzner’

string

nullable <= 255 characters

cdn_proxy

CDN/proxy provider, e.g. ‘Cloudflare’

string

nullable <= 255 characters

is_proxied

Whether the domain is behind a CDN/proxy.

boolean

backend_provider

Backend service, e.g. ‘Supabase’, ‘Vercel’

string

nullable <= 255 characters

backend_project_id

Project ID at backend provider.

string

nullable <= 255 characters

ssl_issued_at

SSL certificate issue date.

string format: date

nullable

ssl_expires_at

SSL certificate expiry date.

string format: date

nullable

ssl_issuer

Certificate issuer, e.g. ‘Let’s Encrypt’, ‘Cloudflare’

string

nullable <= 255 characters

a_entry

DNS A record information (DEPRECATED - use dns_raw)

string

nullable

ns_entry

DNS NS record information (DEPRECATED - use dns_raw)

string

nullable

dns_raw

Full DNS records as JSON. Expected structure: {“a”: […], “aaaa”: […], “cname”: […], “mx”: […], “ns”: […], “txt”: […], “soa”: […], “caa”: […]}

nullable

virustotal_score

Score, e.g. ‘16/93’

string

nullable <= 20 characters

virustotal_url

Link to VirusTotal report.

string format: uri

nullable <= 200 characters

urlscan_url

Link to urlscan.io result.

string format: uri

nullable <= 200 characters

screenshot_url

URL to screenshot in Hetzner S3 Object Storage.

string format: uri

nullable <= 2000 characters

screenshot_taken_at

When the screenshot was taken.

string format: date-time

nullable

abuse_contacts

required

Array<object>

Serializer for abuse contact details.

object

id

required

string format: uuid

contact_type

required

• REGISTRAR - Registrar
• HOSTING - Hosting Provider
• CDN - CDN / Proxy
• BACKEND - Backend Service
• REGISTRY - Domain Registry
• OTHER - Other

string

Allowed values: REGISTRAR HOSTING CDN BACKEND REGISTRY OTHER

contact_type_display

required

string

provider_name

required

Provider name, e.g. ‘Cloudflare’, ‘Openprovider’

string

<= 255 characters

abuse_email

Abuse email address.

string format: email

nullable <= 254 characters

abuse_form_url

URL to abuse report form.

string format: uri

nullable <= 200 characters

report_status

• NOT_SENT - Not Sent
• SENT - Sent
• ACKNOWLEDGED - Acknowledged
• ACTION_TAKEN - Action Taken
• REJECTED - Rejected
• NO_RESPONSE - No Response

string

Allowed values: NOT_SENT SENT ACKNOWLEDGED ACTION_TAKEN REJECTED NO_RESPONSE

report_status_display

required

string

reported_at

string format: date-time

nullable

response_received_at

string format: date-time

nullable

case_reference

Provider case reference, e.g. ‘Case 00954977’

string

nullable <= 255 characters

notes

string

nullable

created_at

required

string format: date-time

updated_at

required

string format: date-time

blacklist_submissions

required

Array<object>

Serializer for blacklist submission details.

object

id

required

string format: uuid

tier

required

• P1 - P1 - Immediate (GSB, Netcraft, SmartScreen)
• P2 - P2 - Distribution (Spamhaus, Openphish, SpamCop)
• P3 - P3 - Prevention (VirusTotal, Symantec, ScamAdviser)

string

Allowed values: P1 P2 P3

tier_display

required

string

service_name

required

Blacklist service name, e.g. ‘Google Safe Browsing’, ‘Spamhaus’

string

<= 255 characters

submission_url

URL for submission.

string format: uri

nullable <= 200 characters

status

• PENDING - Pending
• SUBMITTED - Submitted
• LISTED - Listed
• REJECTED - Rejected

string

Allowed values: PENDING SUBMITTED LISTED REJECTED

status_display

required

string

submitted_at

string format: date-time

nullable

confirmed_at

When listing was confirmed.

string format: date-time

nullable

created_at

required

string format: date-time

updated_at

required

string format: date-time

created_at

required

string format: date-time

updated_at

required

string format: date-time

Example

{
  "status": "REQUESTED",
  "closed_at_source": "MEASURED",
  "resolution": "DOMAIN_SUSPENDED",
  "abuse_contacts": [
    {
      "contact_type": "REGISTRAR",
      "report_status": "NOT_SENT"
    }
  ],
  "blacklist_submissions": [
    {
      "tier": "P1",
      "status": "PENDING"
    }
  ]
}

400

Invalid query parameters or request data. Field errors appear directly on the response; malformed JSON has a detail message.

Media typeapplication/json

Any of:

object

object

detail

required

string

object

Field names mapped directly to validation error messages.

object

>= 1 properties

key

additional properties

Any of:

string

string

Array<string>

Array<string>

Example

{
  "target_website": [
    "Target host is not a public address."
  ]
}

401

The API key is missing, invalid, revoked or belongs to an inactive user.

Media typeapplication/json

object

detail

required

string

Example^generated

{
  "detail": "example"
}

429

Too many requests or failed authentication attempts. Try again later.

Media typeapplication/json

object

detail

required

string

Example^generated

{
  "detail": "example"
}