Authentication
Every request needs a Bearer API key:
Authorization: Bearer <your-api-key>
Generate one from Integrations → API Access → Manage Keys:
- Enter a Key Name.
- Choose an Access Scope: Full Access, or SIEM Read-Only (can only call the SIEM event feed, nothing else).
- Click Generate. The raw key is shown once, in a copy-to-clipboard banner, so store it now: DMARCS never shows it again (only a hash is kept).
- Existing keys can be renamed at a glance in the list (name, scope, creation date) and Revoked at any time.
Rate limits
300 requests per minute per key. Going over returns HTTP 429 with a Retry-After header. Every API call is scoped to your organization; a key can never see another organization's data, and a domain-scoped call is rejected if your org doesn't own/monitor that domain.
What you can do
| Category | What it returns |
|---|
| Domain inventory | Your primary and monitored domains |
| DMARC reporting | Raw aggregate report rows (source IP, disposition, SPF/DKIM results, counts) for a domain, or all domains, up to 1000 rows per call |
| PDF reports | Generate/download an Executive or Technical report for a date range |
| Domain security | A live SPF/DMARC check plus a 0–100 security score for a domain you own |
| Vendor risk | Risk/threat scores, DMARC policy, and SPF status for each known sending vendor |
| Brand protection | Lookalike/typosquat domain risk data |
| Audit logs | Your organization's audit trail (up to 100 rows per call) |
| SIEM feed | A cursor-paginated event feed for piping into a SIEM (e.g. FortiSIEM); requires an SIEM-scoped key |
Every data export through the API is itself logged to your Audit Logs, recording which API key was used, so pulling data via the API is just as traceable as doing it through the UI.
