canonical: https://jentic.com/apis/defastra.com/defastra

# Defastra API

Jentic maintains a curated OpenAPI specification for Defastra API, generated from Defastra's published reference documentation and kept agent-ready. Defastra is a fraud detection and risk-scoring service that runs deep checks against email addresses and phone numbers to surface signals such as disposable status, social presence, deliverability, and reputation. The API is intentionally narrow with two POST endpoints, one for email and one for phone, each returning a structured risk profile. Authentication is by API key passed in a header, making it well suited for synchronous calls during signup, checkout, and account-takeover screening.

## For AI agents

Score the fraud risk of an email address or phone number with deep enrichment checks covering deliverability, disposable detection, and social signals.

## Scope

Does not handle IP reputation, address validation, document verification, or KYC - use for email and phone fraud risk scoring only.

## Capabilities

- Score the fraud risk of an email address with deep checks via POST /deep_email_check
- Score the fraud risk of a phone number with deep checks via POST /deep_phone_check
- Detect disposable or temporary email addresses during signup
- Surface social and reputation signals attached to a phone number
- Validate email deliverability before sending transactional mail

## Use cases

### Signup Fraud Screening

Block disposable, throwaway, or high-risk email signups before they create accounts. POST /deep_email_check returns a risk score plus signals like disposable status, deliverability, and social footprint, so the application can challenge or reject suspicious registrations within a single synchronous call.

Example prompt: Call POST /deep_email_check for an incoming signup email and reject the registration if the returned risk score exceeds the configured threshold.

### Checkout Risk Decisioning

At checkout, score the supplied email and phone number to feed a fraud decision engine. Defastra returns deep signals beyond simple syntax validation, helping merchants distinguish stolen credentials from genuine customers without adding friction for low-risk orders.

Example prompt: Call POST /deep_email_check and POST /deep_phone_check for a checkout payload and route the order to manual review when either score is high.

### Lead Quality Enrichment

Enrich inbound leads from forms or campaigns by running each contact through deep email and phone checks. Sales teams get a quality score and social context per lead, allowing low-quality records to be deprioritised before they hit the CRM.

Example prompt: For each new lead, call /deep_email_check and /deep_phone_check, then attach the returned scores and social signals to the CRM record.

### AI Agent Integration via Jentic

An agent investigating a suspicious account can call Defastra through Jentic to get a structured risk view of the user's email and phone. Jentic resolves the API key from the vault and returns the scored response in one step, so the agent can incorporate the verdict directly into its reasoning.

Example prompt: Use Jentic to search for 'check fraud risk of an email', load the deep_email_check operation, and execute it for a user-supplied email.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/deep_email_check` | Run deep fraud checks on an email address |
| POST | `/deep_phone_check` | Run deep fraud checks on a phone number |

## Key resources

- **Email Verification** — Deep risk and validation checks against email addresses
- **Phone Verification** — Deep risk and reputation checks against phone numbers

## Why Jentic

- **Setup:** Wiring the Defastra API by hand means learning its X-API-KEY header and posting to the deep email and deep phone check endpoints yourself. Through Jentic you install once, import the Defastra API from the API Directory, store the API key once, and your agent calls it.
- **Permission scoping:** Defastra carries the email or phone value in the request body rather than as a resource id in the URL path, so limit the agent to the operations it needs, such as scoring an email or a phone number for fraud risk. Because you pick the operations, the agent runs only the checks you grant.
- **Credential handling:** Your Defastra API key is stored once, encrypted, by your own Jentic One instance and injected into the X-API-KEY header at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'check if an email is fraudulent', and Jentic returns the matching Defastra operation with its input schema so the agent fills in the email or phone and calls the right endpoint without reading docs.

## Related APIs

- **AbstractAPI** — Suite of validation APIs covering email, phone, and IP risk in separate endpoints.
- **Hunter API** — Email finder and verifier focused on B2B prospecting rather than fraud scoring.
- **Emailable API** — Email verification service with deliverability checks and bulk list cleaning.
- **Numverify API** — Phone number lookup and validation focused on carrier and line type.

## FAQ

### Does Defastra publish an official OpenAPI description of its API?

Yes. Defastra serves an OpenAPI 3.1 description of its fraud prevention endpoints from its ReadMe documentation at `https://docs.defastra.com/openapi/63c586606d4e010017ed07b5`, covering the same two operations as this page: POST /deep_email_check and POST /deep_phone_check. Jentic keeps its own curated spec for those endpoints, generated from Defastra's reference docs; both declare the same base URL, `https://api.defastra.com`, and the same X-API-KEY header, so an agent calling through Jentic reaches the same API surface. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Defastra API use?

The Defastra API uses an API key passed in a request header. Through Jentic, the key is stored encrypted in the vault and injected at execution time, so the raw secret never enters the agent's prompt or memory.

### Can I detect disposable email addresses with the Defastra API?

Yes. POST /deep_email_check returns disposable-email indicators alongside deliverability and social-presence signals, so signup flows can flag throwaway addresses in a single call.

### Does the Defastra API check phone numbers as well as emails?

Yes. POST /deep_phone_check accepts a phone number and returns risk signals including reputation, social footprint, and validity. The two endpoints are usually used together for combined identity screening.

### How do I screen a signup email through Jentic?

Run `pip install jentic`, search for 'check fraud risk of an email', load the /deep_email_check operation, and execute with the email value. Jentic returns the structured risk response your agent can act on.

### What are the rate limits for the Defastra API?

The OpenAPI spec does not declare hard rate limits, so applied limits depend on your Defastra plan. Treat each /deep_email_check and /deep_phone_check call as billable and cache results for repeat lookups within a session.

### Can I limit what my agent is allowed to do with the Defastra API?

Yes. Because Jentic One is self-hosted, your own rules decide which Defastra operations and credentials your agent may use. The Defastra API exposes just two operations, POST /deep_email_check and POST /deep_phone_check, so you can grant only the check the agent needs, such as scoring an email while blocking phone lookups. Since each request carries the email or phone value in the body rather than a resource id in the URL, restricting the operation set is what controls exactly what the agent can call.