About the Abuse API

Overview

The Abuse API lets you submit abuse reports programmatically and follow what happens to them, instead of emailing an abuse alias and waiting. You report a single URL or IP per ticket, and the API returns a ticket ID you can use to track that report to a resolution.

Three operations are public, in two versions. The API is deliberately narrow: you can create a report, list the reports you have submitted, and read one report. Nothing in the public API changes or closes a ticket. That happens through GoDaddy's internal review process.

Reports you submit are reviewed against the GoDaddy Universal Terms of Service and the policies for the brand that hosts or registers the reported content. Submitting a report does not guarantee action.

Authentication

Every request carries a Classic Developer Key (a key and secret pair) in the Authorization header:

Authorization: sso-key $ABUSE_API_KEY:$ABUSE_API_SECRET

Your reporter identity comes from the key. There is no reporter field to send. Every report is attributed to whoever the key belongs to, and the list and retrieve operations return only your own tickets. Requesting a ticket that belongs to someone else returns 404, not 403.

A valid credential is not sufficient on its own. Your identity also has to be enabled for the API, which happens during onboarding.

Choose a version

Use v2 for new integrations. Both versions accept reports and read from the same records, so a ticket created through v1 is visible through v2 and the reverse. The following table compares the two versions:

The closeReason field is the main reason to prefer v2: on v1 you can tell that a ticket closed, but not whether it closed because the content was actioned or because the report was rejected.

v1 remains supported and its behaviour is unchanged. If you run a high-volume v1 integration, size your submission rate against the v2 limit before you move.

Operations

The following table lists the three public operations, with the v1 and v2 page for each:

Typical flow

A typical integration creates a ticket, then polls the retrieve operation until the ticket closes:

POST /v2/abuse/tickets            → 201, {"u_number": "DCU12345678"}
                                    link header points at the new ticket

GET  /v2/abuse/tickets/DCU12345678 → 200, ticket with closed: false
                                    poll periodically; closeReason appears once closed

GET  /v2/abuse/tickets?closed=true → 200, {"ticket_ids": [...], "pagination": {...}}
                                    reconcile your own records

Reports are reviewed asynchronously and there is no callback or webhook. Poll the retrieve operation for the tickets you care about rather than listing everything repeatedly. Listing is subject to the same rate limit as creating.

What to report

Every reporter can submit PHISHING, MALWARE, and CHILD_ABUSE. Further types exist for specific reporting programs and are granted per reporter during onboarding.

Categorise accurately. Reports that do not match the abuse type you select are marked as false positives. If your false-positive rate exceeds 40% of total submissions, GoDaddy can deprioritise your subsequent reports.

Trademark, copyright, and content complaints are not handled by this API. Send those to trademarkclaims@godaddy.com, copyrightclaims@godaddy.com, or contentcomplaints@godaddy.com respectively. For other scenarios not covered by this API, go to legalportal.godaddy.com/abuse.

Conventions

The following table describes the conventions that apply to all Abuse API requests:

Last updated on