API overview
Open takedown cases and follow their status from your own systems, with the same rules and the same monthly takedowns as the console.
The OpenBait API lets your own systems do what you do in the console when you find a fake site: open a takedown case for a URL, check how the case is going, and hear about status changes by webhook.
An API call acts for your organization, exactly as if someone on your team had clicked in the console. The same checks apply, and every case it opens uses the same monthly takedowns.
What you can do
| Task | How |
|---|---|
| Open a takedown case for a URL | POST /v1/ext/cases |
| Check one case | GET /v1/ext/cases/{id} |
| List your cases, newest first | GET /v1/ext/cases |
| Be told when a case changes status | A webhook; handle the events whose event is takedown.status_changed |
Base URL:
https://openbait.com/api/v1/extWho can use it
The API is part of the Enterprise plan. In an Enterprise organization, everyone can see the API keys in the console under Settings > API keys; only owners and admins can generate or revoke them.
If the organization moves to another plan, its keys stop working at once and every call answers 403 plan_required. The keys are kept, and they work again when the organization is back on Enterprise.
Limits
| Limit | Value |
|---|---|
| Takedowns | Shared with the console: a case opened by the API uses one of the month's takedowns, as a case opened in the console does |
| When the month's takedowns are used up | POST /cases answers 402 quota_exhausted. Report the URL in the console, then add a $199 takedown on its case page; the API never charges your card |
| Rate limit | 60 requests per minute per key. Requests from the same IP address also share a limit across all keys. Over either, 429 rate_limited with Retry-After: 60 |
| Request body | 16 KB at most. Larger bodies get 413 payload_too_large |
| Active keys | 10 per organization |
Conventions
- JSON in and out, UTF-8. Send
Content-Type: application/jsonwith a body. - Times are UTC, RFC 3339 (
2026-10-22T12:00:00Z). - IDs are opaque strings. Store them as they are.
- New fields can appear in any response. Ignore fields you don't know. See Changelog and versioning.
- The API is for servers. It sends no CORS headers, so a browser page can't call it, and it ignores cookies.
Next
- Authentication: create, rotate and revoke keys
- Endpoints: every request and response field
- Webhooks: status changes pushed to you, and how to verify them
- Errors: every error code and what to do about it
- Examples: the whole flow in curl, Node and Python