API documentation · SI Check

Authentication

Make a key on your account page and send it with every request as Authorization: Bearer sic_live_…. Keys are shown once and stored only as a hash, so keep yours in a secrets manager, never in code that runs in a browser or an app. Revoking a key on the account page stops it at once.

Create a check

POST https://sicheck.com/api/v1/checks with a JSON body:

Field	Meaning
`kind`	`text` (a message, email or DM), `url` (a link) or `phone` (a number, with its country code)
`input`	What to check, exactly as received. Up to 12,000 characters.
`channel`	Optional: how it arrived. `sms`, `email`, `social`, `call`, `letter` or `other`. It helps the judgment.

curl -X POST 'https://sicheck.com/api/v1/checks?wait=1' \
  -H "authorization: Bearer $SICHECK_KEY" \
  -H 'content-type: application/json' \
  -d '{"kind":"url","input":"https://paypa1-secure-login.com/verify"}'

Without ?wait=1 the answer is 202 straight away, with status: "pending", the report’s id and a deleteToken. With it, the request stays open until the report is ready (usually a few seconds) and answers 200 with status: "done" and the report; if it takes longer than 25 seconds you get the 202 and can read it later.

Screenshots and voice notes: send multipart/form-data with kind set to image or audio, the file in a field of the same name, and optionally note and channel.

Read a check

GET /api/v1/checks/:id answers {status: "pending"} (202), {status: "done", report} or {status: "failed", error}. A key can read every report it made. To follow a check step by step instead, open GET /api/v1/checks/:id/events, a server-sent event stream of step events ending in done or failed.

The report

Field	Meaning
`verdict`	`stop`, `verify`, `clear` or `unsure`. Shown to people as STOP, VERIFY FIRST, NO RED FLAGS and CAN’T TELL. `clear` is never a promise that something is safe.
`headline`, `summary`	The verdict in plain words, written to be shown to the person who asked.
`signals[]`	What was measured or matched: `id`, `label`, `value`, `severity` (0–3), `measured` (a fact, or a pattern), `source`, `explain`, `verify`.
`observations[]`	What SI noticed: a `claim` and the exact `quote` behind it, checked to exist in the input.
`nextSteps[]`, `verifySteps[]`	What to do now, and how to confirm it independently.
`limits[]`	What couldn’t be checked this time, so you never present more certainty than there was.
`scamType`, `confidence`, `mode`	The kind of scam it resembles (a field guide slug), how sure the verdict is, and whether SI took part (`si`) or only the measurements did (`signals-only`).
`redactedInput`	The input as stored: card, bank, ID and phone numbers and email addresses masked.

Delete a check

DELETE /api/v1/checks/:id with your key (or the x-delete-token from creation) deletes the report and its masked text at once. Otherwise every report is deleted after 30 days.

Usage and limits

Business includes 1,000 checks per UTC day, shared by the API, the site and your “Ask me first” links, and up to 60 checks a minute. GET /api/v1/usage returns limit, used, remaining and resetsAt. Reading, streaming and deleting don’t count, and a check that fails on our side is given back.

Errors

Every error is JSON with a human-readable error, and a code where there is more than one cause:

Status	code	Meaning
`400`	—	The input couldn’t be checked (empty, too long, a phone number without a country code). `error` says why, in words you can show.
`401`	`key`	No key, or a key that is wrong or revoked.
`403`	`plan`	The key is fine, but the account is no longer on Business.
`403`	`plus`	A screenshot or voice note, on a server that can’t read it.
`404`	—	No such report, or not one this key made. Reports are deleted after 30 days.
`413`	—	The body is too large: 64 KB for JSON, 8 MB for an image, 12 MB for a recording.
`429`	`rate`	Too many checks this minute. Wait `retryAfter` seconds.
`429`	`quota`	Today’s 1,000 checks are used. `resetsAt` is midnight UTC.
`503`	`busy`	Too many checks running at once across the service. Retry after 10 seconds.

Showing results to people

Keep the four verdict names as they are, and never present NO RED FLAGS as “safe” or “verified”.
Show the headline and the nextSteps. Linking to the report page (url) shows everything else; it opens for the account that made it.
Say the check is by SI Check. The Charter applies to every verdict, including the ones you show.

Help

Questions, higher volume, or a data processing agreement: hello@sicheck.com. Security issues: the security page.