OrbGuard Labs API Overview
Advanced threat intelligence and device security API for spyware detection, scam prevention, and enterprise security.
OrbGuard Labs API
Advanced threat intelligence and device security platform. Detect Pegasus spyware, prevent scams with AI, monitor the dark web, audit app permissions, analyze network threats, and integrate with enterprise SIEM and MDM systems -- all through a unified API.
Base URL
| Protocol | Base URL | Description |
|---|---|---|
| REST | https://guard.orbai.world | All REST API endpoints (under /api/v1) |
| WebSocket | wss://guard.orbai.world/ws/threats | Real-time threat alert stream |
One Unified REST Surface
Every OrbGuard Labs capability -- threat intelligence, forensics, scam detection, dark web monitoring, network and app security, enterprise SIEM/MDM, and more -- is exposed through a single versioned REST surface at https://guard.orbai.world/api/v1. The real-time threat stream is delivered over a WebSocket at wss://guard.orbai.world/ws/threats. A high-throughput gRPC interface for bulk indicator checking is on the roadmap (see gRPC Services).
Authentication
Every authenticated request carries a bearer token in the Authorization header. OrbGuard Labs accepts three credential types in that header: a device API key issued when a device registers, a session token from the OrbGuard auth flow, and -- for server-to-server integrations -- a provisioned service secret.
Bearer authentication (all clients):
Authorization: Bearer your_token_hereObtaining a Credential
Mobile and desktop clients receive a device credential automatically by calling POST /api/v1/auth/device (device registration) and POST /api/v1/auth/login. Tokens are refreshed via POST /api/v1/auth/refresh. Enterprise and server-to-server integrations are provisioned a dedicated service secret with higher rate limits and priority processing. All three credential types are presented the same way -- as a Bearer token in the Authorization header. There is no separate X-API-Key header.
Security Modules
OrbGuard Labs provides more than 25 specialized security modules, each targeting a different threat vector.
Threat Intelligence
IoC database with millions of indicators. Check IPs, domains, hashes, and URLs against known threat feeds in real time.
Forensic Analysis
Pegasus and mercenary spyware detection. Analyze iOS shutdown logs, Android logcat dumps, and device artifacts for compromise indicators.
SMS Protection
Smishing and SMS fraud detection. Analyze incoming messages for phishing URLs, social engineering patterns, and known scam templates.
URL Protection
Real-time URL and phishing detection. Scan links for malicious redirects, credential harvesting, drive-by downloads, and domain impersonation.
Dark Web Monitoring
Monitor the dark web for compromised credentials. Email breach detection, password exposure alerts, and digital asset monitoring.
AI Scam Detection
AI-powered analysis of text, URLs, images, voice calls, and phone numbers. Detects social engineering, deepfakes, and fraud patterns.
gRPC Services (Roadmap)
A high-performance gRPC interface for bulk indicator checking and streaming threat feeds is under active development. Use the REST API and WebSocket stream today.
Unique Capabilities
What sets OrbGuard Labs apart from standard threat intelligence APIs.
Pegasus / Spyware Forensics
Detect NSO Group's Pegasus and other mercenary spyware on iOS and Android devices. Analyze iOS shutdown logs (sysdiagnose), Android logcat dumps, and device artifacts for known compromise indicators used by nation-state surveillance tools.
AI-Powered Scam Detection
A single multi-modal AI engine analyzes text messages, URLs, images, voice recordings, and phone numbers through one unified endpoint (you select the content type). It detects social engineering, impersonation, deepfake audio, investment fraud, romance scams, and phishing with high accuracy -- combining LLM reasoning with pattern matching.
Dark Web Monitoring
Continuous monitoring of dark web marketplaces, paste sites, and breach databases. Real-time alerts when your email, passwords, credit cards, or digital assets appear in new data breaches or are listed for sale on underground forums.
MITRE ATT&CK Mapping
Automatically map all detected threats to MITRE ATT&CK tactics and techniques. Visualize attack kill chains, identify coverage gaps in your security posture, and generate compliance-ready reports aligned to industry frameworks.
Threat Graph Visualization
Neo4j-powered graph database connecting indicators of compromise, threat actors, malware families, campaigns, and attack infrastructure. Query complex relationships and discover hidden connections between seemingly unrelated threats.
Enterprise MDM/SIEM Integration
Deep integration with enterprise security infrastructure. Forward threat alerts to Splunk, Elastic, and QRadar SIEM systems. Manage device fleet security through MDM integration. Enforce Zero Trust policies with real-time threat-aware access control.
Quick Start
Check a threat indicator and analyze a suspicious URL in seconds.
/api/v1/intelligence/checkCheck an indicator (IP, domain, hash, or URL) against the threat intelligence database
# Check if a domain is malicious
curl -X GET "https://guard.orbai.world/api/v1/intelligence/check?value=suspicious-site.example.com&type=domain" \
-H "Authorization: Bearer your_token"{
"value": "suspicious-site.example.com",
"type": "domain",
"is_malicious": true,
"indicator": {
"id": "ioc_7f8a9b2c3d4e",
"value": "suspicious-site.example.com",
"type": "domain",
"severity": "high",
"confidence": 92,
"description": "Domain associated with phishing and credential-harvesting infrastructure.",
"tags": ["phishing", "credential-harvesting"],
"platforms": ["ios", "android"],
"source_name": "orbguard-crawlers",
"first_seen": "2025-11-20T08:30:00Z",
"last_seen": "2026-02-07T14:22:00Z",
"mitre_techniques": ["T1566.002"],
"report_count": 23
}
}Key Endpoints
Query the IoC database for IPs, domains, hashes, and URLs
Upload device logs for Pegasus and mercenary spyware analysis
AI-powered scam detection for text, URLs, images, and voice
Check if an email or password appears in known data breaches
Real-time URL scanning for phishing, malware, and redirects
Analyze SMS messages for smishing and fraud patterns
Integration with OrbVPN
OrbGuard Labs integrates directly with the OrbVPN platform to provide real-time protection during VPN sessions.
Threat-Aware DNS
When connected to OrbVPN, all DNS queries are checked against OrbGuard's threat intelligence in real time. Malicious domains are blocked before they resolve.
Connection Protection
OrbGuard monitors active VPN connections for suspicious traffic patterns, command-and-control beacons, and data exfiltration attempts.
Scam Alerts
SMS, URL, and QR code scanning runs continuously on-device when enabled, with threat data enriched by OrbGuard's cloud intelligence.
Enterprise Fleet Protection
Organizations can deploy OrbGuard across all employee devices via MDM, with centralized threat monitoring and SIEM integration.
Free Tier Available
OrbGuard Labs offers a free tier with 100 API calls per day for threat intelligence checks and URL scanning. Enterprise plans include unlimited calls, priority processing, dedicated support, and SIEM integration. See pricing for details.
Secure Your Users with OrbGuard Labs
Access 200+ REST endpoints across 25+ security modules for comprehensive threat intelligence, spyware forensics, scam detection, and enterprise security -- all through one unified API.