# About the Abuse API (https://developer.godaddy.com/en/docs/references/rest/abuse) --- title: About the Abuse API description: > Reference for the Abuse API, a REST API for reporting phishing, malware, and child abuse content hosted or registered with GoDaddy brands, and for tracking the outcome of reports you submit. keywords: >- abuse api, phishing reporting, malware report, child abuse, classic developer key, sso-key, abuse ticket, godaddy abuse related: apis: - title: Abuse v2 — Report abuse href: /docs/references/rest/abuse/create-ticket-v2 --- The Abuse API is not open to self-service signup. Access is granted per reporter identity, and requests are rejected with `403` until yours is enabled. Contact [abuseapisupport@godaddy.com](mailto:abuseapisupport@godaddy.com) to start onboarding. This API supports Classic Developer Keys only. Only submit reports through the API. Don't email `phishing@godaddy.com`, `malware@godaddy.com`, `netabuse@godaddy.com`, or `spam@godaddy.com`. Email submissions are deprioritized and Customer Support can't help with abuse reports or expedite review. ## Overview The Abuse API lets you submit abuse reports programmatically and follow what happens to them, instead of emailing an abuse alias and waiting. You report a single URL or IP per ticket, and the API returns a ticket ID you can use to track that report to a resolution. Three operations are public, in two versions. The API is deliberately narrow: you can create a report, list the reports you have submitted, and read one report. Nothing in the public API changes or closes a ticket. That happens through GoDaddy's internal review process. Reports you submit are reviewed against the GoDaddy Universal Terms of Service and the policies for the brand that hosts or registers the reported content. Submitting a report does not guarantee action. ## Authentication Every request carries a Classic Developer Key (a key and secret pair) in the `Authorization` header: ```text Authorization: sso-key $ABUSE_API_KEY:$ABUSE_API_SECRET ``` Your reporter identity comes from the key. There is no `reporter` field to send. Every report is attributed to whoever the key belongs to, and the list and retrieve operations return only your own tickets. Requesting a ticket that belongs to someone else returns `404`, not `403`. A valid credential is not sufficient on its own. Your identity also has to be enabled for the API, which happens during onboarding. ## Choose a version Use **v2** for new integrations. Both versions accept reports and read from the same records, so a ticket created through v1 is visible through v2 and the reverse. The following table compares the two versions: | | v1 (Legacy) | v2 (Recommended) | | -------------------------- | ----------------------- | ---------------------------------------------- | | Close reason on retrieve | Not returned | `closeReason` once the ticket closes | | `proxy` | Free text | Fixed set of region codes | | `useragent` | Not accepted | `DESKTOP`, `MOBILE`, `OTHER`, `NOT_APPLICABLE` | | `intentional` | Accepted | Removed | | Create and list rate limit | 750 requests per minute | 60 requests per minute | The `closeReason` field is the main reason to prefer v2: on v1 you can tell that a ticket closed, but not whether it closed because the content was actioned or because the report was rejected. v1 remains supported and its behaviour is unchanged. If you run a high-volume v1 integration, size your submission rate against the v2 limit before you move. ## Operations The following table lists the three public operations, with the v1 and v2 page for each: | Operation | v1 (Legacy) | v2 (Recommended) | | ------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | -------------------------------------------------------------------- | | Report abuse (`POST /abuse/tickets`). Returns `201` with the new ticket ID, plus a `link` header pointing at it. | [create-ticket](https://developer.godaddy.com/docs/references/rest/abuse/create-ticket) | [create-ticket-v2](https://developer.godaddy.com/docs/references/rest/abuse/create-ticket-v2) | | List your tickets (`GET /abuse/tickets`). Filter by type, target, source domain or IP, creation date, and open or closed state. | [get-tickets](https://developer.godaddy.com/docs/references/rest/abuse/get-tickets) | [get-tickets-v2](https://developer.godaddy.com/docs/references/rest/abuse/get-tickets-v2) | | Retrieve a ticket (`GET /abuse/tickets/{ticketId}`). Includes the close reason once the ticket has closed. | [get-ticket-info](https://developer.godaddy.com/docs/references/rest/abuse/get-ticket-info) | [get-ticket-info-v2](https://developer.godaddy.com/docs/references/rest/abuse/get-ticket-info-v2) | ## Typical flow A typical integration creates a ticket, then polls the retrieve operation until the ticket closes: ```text POST /v2/abuse/tickets → 201, {"u_number": "DCU12345678"} link header points at the new ticket GET /v2/abuse/tickets/DCU12345678 → 200, ticket with closed: false poll periodically; closeReason appears once closed GET /v2/abuse/tickets?closed=true → 200, {"ticket_ids": [...], "pagination": {...}} reconcile your own records ``` Reports are reviewed asynchronously and there is no callback or webhook. Poll the retrieve operation for the tickets you care about rather than listing everything repeatedly. Listing is subject to the same rate limit as creating. ## What to report Every reporter can submit `PHISHING`, `MALWARE`, and `CHILD_ABUSE`. Further types exist for specific reporting programs and are granted per reporter during onboarding. Categorise accurately. Reports that do not match the abuse type you select are marked as false positives. If your false-positive rate exceeds **40%** of total submissions, GoDaddy can deprioritise your subsequent reports. Trademark, copyright, and content complaints are not handled by this API. Send those to `trademarkclaims@godaddy.com`, `copyrightclaims@godaddy.com`, or `contentcomplaints@godaddy.com` respectively. For other scenarios not covered by this API, go to [legalportal.godaddy.com/abuse](https://legalportal.godaddy.com/abuse). ## Conventions The following table describes the conventions that apply to all Abuse API requests: | Convention | Detail | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Base URL | `https://api.godaddy.com` (production) | | Auth | Classic Developer Key, sent as `Authorization: sso-key {key}:{secret}`. Access is granted per reporter identity during onboarding. | | Ticket ID | Returned from create as `u_number`, and used as `{ticketId}` on retrieve. | | One source per ticket | Each report covers a single URL or IP. More than five URLs for one domain counts as a duplicate submission. Reporters with a duplicate rate above 20% can have reports deprioritized. | | Duplicate reports | Reporting a `source` you already have an open ticket for returns `422` rather than creating a second ticket. | | Shared records | v1 and v2 read the same tickets, so you can migrate reading and writing independently. | | Rate limits | Enforced at the API gateway, per reporter. v2 create and list allow 60 requests per minute; v1 allows 750. Retrieve allows 60 on both. | | Errors | `401` for a missing or invalid credential, `403` for an identity that is not enabled, `404` for a ticket that is not yours, `422` for validation failures and duplicates. |