The reports API.

Authentication

Create a key under Settings, API access. The full key is shown once, at creation; we keep only a fingerprint, so a lost key is replaced, not recovered. A key reads the reports of the account that created it and nothing else. There is no write access behind a key anywhere.

Send it on every request as either header:

Authorization: Bearer adc_YOUR_KEY
x-api-key: adc_YOUR_KEY

Revoke a key from the same card. Revoked keys answer 401 immediately and stay listed for your records.

Endpoint and filters

GET https://adcrime.com/api/v1/reports

All filters are optional and combine with AND.

Response shape

JSON responses carry a page of records under data and a pagination block, newest detection first. total is an estimate for large accounts; walk pages until page reaches totalPages.

{
  "data": [
    {
      "report_id": "6b1f…",
      "detected_at": "2026-08-28T10:14:02.000Z",
      "classification": "CONFIRMED_AFFILIATE_FRAUD",
      "confidence": "96",
      "keyword": "yourbrand coupon",
      "market": "us",
      "brand_domain": "yourbrand.com",
      "offender_domain": "coupon-site.example",
      "affiliate_network": "Awin",
      "account_id": "123456",
      "account_provenance": "captured",
      "report_url": "https://adcrime.com/dashboard/reports/6b1f…"
    }
  ],
  "pagination": { "page": 1, "limit": 100, "total": 412, "totalPages": 5 }
}

format=csv streams every matching row as one file with the same columns, oldest first, plus an X-Row-Count header. Cells that begin with =, +, - or @ are prefixed with an apostrophe so spreadsheets read them as text: ad titles come from other people’s pages.

Record fields

Every record has all 23 fields, as strings. Blank means we have nothing defensible to put there, never that the value is zero.

Rate limits

Each key has 60 units per 60 seconds. A JSON page costs 1 unit; a CSV pull costs 10, because it returns everything at once. Every response tells you where you stand:

X-RateLimit-Limit: …
X-RateLimit-Remaining: …
X-RateLimit-Reset: …

Over the limit, the request answers 429 with Retry-After in seconds. Nothing is charged for a refused request. If you need more, reply to any AdCrime email and say what you are building.

Errors

Errors are JSON with a single error string written for a person, not a parser. Branch on the status code.

Examples

curl "https://adcrime.com/api/v1/reports?classification=CONFIRMED_AFFILIATE_FRAUD&limit=50" \
  -H "Authorization: Bearer adc_YOUR_KEY"

curl "https://adcrime.com/api/v1/reports?format=csv&date_from=2026-08-01" \
  -H "Authorization: Bearer adc_YOUR_KEY" \
  -o adcrime-reports.csv

import requests

KEY = "adc_YOUR_KEY"
url = "https://adcrime.com/api/v1/reports"
page = 1
while True:
    r = requests.get(url, params={"page": page, "limit": 200},
                     headers={"Authorization": f"Bearer {KEY}"}, timeout=60)
    r.raise_for_status()
    body = r.json()
    for record in body["data"]:
        print(record["detected_at"], record["classification"], record["offender_domain"])
    if page >= body["pagination"]["totalPages"]:
        break
    page += 1

Versioning

v1 is stable. We add fields and filters without notice; we never rename or remove a field, change a field’s meaning, or tighten a limit under the same path. Anything that would break a client ships under a new path, and the changelog says so first.