API documentation

Customer API · v1

API operational

Read every domain status with one request.

Use your account username and API key to retrieve the current Google Safe Browsing state of all active domains from any server or proxy.

GEThttps://remove.red/api/domains

Make your first request

There are only three setup steps. Complete them in this order.

  1. 01
    Load your credentials

    Sign in to autofill your saved API key below. You can also generate a key here or paste an existing key to save it for future visits.

  2. 02
    Check your username

    Your account username is filled in automatically when signed in. The generated API key is the API password.

  3. 03
    Test your request

    Click Run request to test your credentials, or copy a complete example into your own tool. No IP setup is required.

Sign in to autofill your credentials and test the API.

REMOVERED_API_USERNAME='your_account_username'
REMOVERED_API_KEY='rr_live_your_key_here'

curl --request GET \
  --url "https://remove.red/api/domains" \
  --header "Accept: application/json" \
  --user "${REMOVERED_API_USERNAME}:${REMOVERED_API_KEY}"
Use the API key, not your sign-in password. Basic authentication's password field is your generated rr_live_… key. Your remove.red account password should never be stored in an integration.

Username and API password

Every request uses HTTP Basic authentication and can come from any IP address, including changing proxies, serverless functions, and CI runners.

Authorization
Authorization: Basic base64(USERNAME:API_KEY)
Username
Your remove.red account username
API password
Your generated API key
Key format
rr_live_…
Key rotation
Generating a new key immediately invalidates the old one.

Keep the username and key in server-side environment variables or a secret manager. Never put credentials in frontend JavaScript, URLs, logs, or source control. Every request must use HTTPS.

Successful response

Domains are sorted by hostname. Responses are JSON and are never cached.

200 OK · application/json
{
  "domains": [
    {
      "domain": "example.com",
      "status": "clean",
      "last_checked": "4 minutes ago",
      "last_checked_at": "2026-09-04T16:20:00.000Z",
      "message": "All clear! Your domain is safe and verified"
    }
  ],
  "total": 1
}
FieldTypeDescription
domainstringThe monitored hostname.
statusstringclean, flagged, unknown, or error.
last_checkedstringA human-readable relative scan time.
last_checked_atstring | nullISO 8601 UTC, or null before the first scan.
messagestringA short explanation of the current state.

Failures use the same JSON shape

Authentication failures do not reveal whether the username or API key was incorrect.

401 Unauthorized · application/json
{
  "success": false,
  "error": "Invalid API credentials",
  "status": 401
}
401Invalid credentialsMissing, malformed, revoked, or incorrect username or API key.
429Rate limitedWait for the Retry-After duration before trying again.
500Server errorRetry later with exponential backoff.
Rate limit60 requests / minute / public IP

A 429 response includes Retry-After in seconds. Retry 429 and 500 with backoff; correct 401 before retrying.