Google Safe Browsing API

Anti-malware / API Key Intermediate HTTPS

77 B

Metadata Score Metadata estimate · not endpoint-tested

Visit Official Site Compare Alternatives

Overview

Google Safe Browsing lets you check any URL against Google's constantly updated lists of phishing sites, malware distributors, and unwanted software. It is the same technology that powers Chrome's built-in warnings. Beginners can use it to validate user-submitted links before displaying or visiting them in an application.

Beginner Tip

Enable the API in Google Cloud Console and use the threatMatches:find endpoint with a POST body — a GET request will not work. The free quota is 10,000 lookups per day.

Available Data

The kind of data this API exposes, based on its documentation. We could not call the endpoint to confirm the exact field names.

Use case: Integrate google link/domain flagging data into web and mobile applications

Google Safe Browsing data via REST API

Example Response

Illustrative shape only — we were not able to call this endpoint (it requires credentials or exposes no public sample URL), so the fields below show the kind of data this API returns rather than a recorded response.

JSON Response · Illustrative

{
  "status": "success",
  "data": {
    "result": "Data from Google Safe Browsing",
    "description": "Google Link/Domain Flagging",
    "timestamp": "2025-01-15T10:00:00Z"
  }
}

Field Reference

matches List of threat matches found; empty array or absent field means the URL is safe

matches[].threatType Type of threat detected, e.g. MALWARE or SOCIAL_ENGINEERING

matches[].platformType Platform the threat targets, such as WINDOWS or ANY_PLATFORM

matches[].threat.url The URL that matched a threat list entry

matches[].cacheDuration How long to cache this result before re-checking, in seconds with an s suffix

Implementation Example

Calls a real endpoint of this API. Replace any placeholder credentials with your own key.

Request

const url = "https://safebrowsing.googleapis.com/v4/threatMatches:find?key=YOUR_API_KEY";
// Replace headers or query params with the values required by this API.
const response = await fetch(url, {
  headers: {
  "X-API-Key": "YOUR_API_KEY"
  }
});
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

What Can You Build?

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

Common Errors & Troubleshooting

Generated guidance based on this API's documentation, not observed by us. Treat it as a starting point and check against the provider's own error reference.

400 Bad Request The request body JSON is malformed or a required field like clientId is missing

✓ Ensure your POST body includes client.clientId, client.clientVersion, and at least one entry in threatEntries

403 Forbidden The API key is invalid or the Safe Browsing API is not enabled for your project

✓ Go to Google Cloud Console, enable the Safe Browsing API, and verify the key has no IP/referrer restrictions blocking your request

Empty response body The URL is not found in any threat list, which is returned as an empty JSON object

✓ An empty {} response means the URL is safe — this is expected behavior, not an error

Metadata Score Breakdown

Estimated from metadata — endpoint not independently tested

This score is estimated from observable metadata — HTTPS support, authentication model, declared CORS, and documentation reachability — because the API requires authentication or exposes no publicly testable endpoint. The five-signal breakdown is only shown for live-tested APIs.

Metadata estimate · endpoint not independently tested

How is this scored? →