API Reference

Base URL and shape

https://api.ddmarc.com/api/v1

Every path on this page already includes the /api/v1 prefix, so a full URL looks like https://api.ddmarc.com/api/v1/domains. All requests must be made over HTTPS.

Authentication

Programmatic access uses an API key. Create and revoke keys in the dashboard under Settings → Organization → API Keys, or through the /api/v1/api-keys endpoints. Keys are shown once at creation and require the Protect plan or higher.

Included from Protect ($29/mo).·Start a 14-day trial →·See the Protect plan →

X-API-Key: ddmarc_<64 hex characters>

Authorization: Bearer ddmarc_<64 hex characters>

The same Authorization: Bearer header also accepts a short-lived JWT access token from a dashboard sign-in. If both X-API-Key and Authorization are sent, the API key wins. See Authentication for key format, scopes and token lifetimes.

A request and its response

curl -X GET "https://api.ddmarc.com/api/v1/domains?limit=100&offset=0" \
  -H "X-API-Key: $DDMARC_API_KEY"

List endpoints return a bare JSON array — there is no data / meta envelope, and resource ids are integers.

[
  {
    "id": 42,
    "domain": "example.com",
    "rua_token": "a1b2c3d4e5",
    "ruf_token": "f6g7h8i9j0",
    "verification_token": "ddmarc-verify-9f3c1a",
    "is_verified": true,
    "verified_at": "2026-01-15T11:00:00Z",
    "dmarc_verified": true,
    "spf_verified": true,
    "dkim_verified": false,
    "admin_email": null,
    "created_at": "2026-01-15T10:30:00Z",
    "updated_at": "2026-02-01T08:12:44Z",
    "reports_count": 1250,
    "last_report_at": "2026-02-01T06:00:00Z"
  }
]

Every endpoint

Path parameters shown in braces are integers, except {customer_public_id}, which is an opaque string.

Rate limiting

API-key requests are metered hourly and pooled across your whole organization, not per key. There is no per-minute limit and no daily cap.

Errors

{
  "detail": "Invalid API key"
}

{
  "detail": "Internal server error",
  "request_id": "9f2b41c7-..."
}

Validation failures (422) use FastAPI's structured form, where detail is an array of field errors, not a string.

Client libraries

DDMARC does not publish official SDKs. The API is plain JSON over HTTPS with a single authentication header, so any HTTP client works — curl, fetch, requests, or your language's equivalent. If you need a generated client, the running API serves its own OpenAPI schema.