> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fraudtraceai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FraudTrace AI API Reference — Endpoints and Quick Start

> Complete reference for the FraudTrace AI REST API — authenticate, explore endpoints, and integrate fraud detection into your platform.

The FraudTrace AI API gives you programmatic access to real-time UPI mule detection, merchant screening, and fraud signal intelligence — purpose-built for banks, PSPs, wallets, and fintechs operating in India. Every endpoint follows standard REST conventions, returns JSON, and requires a Bearer token for authentication. This reference covers all available and upcoming endpoints, request conventions, and a quick-start example to get your first call working in minutes.

## Base URL

All API requests are made to the following base URL:

```
https://api.fraudtraceai.com
```

Every endpoint path is versioned and begins with `/v1/`. When breaking changes are introduced in future versions, a new version prefix (e.g. `/v2/`) will be released alongside the existing version with advance notice.

## Authentication

Every request to the FraudTrace AI API must include a valid Bearer token in the `Authorization` header. Connections are accepted over TLS 1.3 only — plain HTTP requests are rejected.

```http theme={null}
Authorization: Bearer YOUR_API_KEY
```

You can find your API key in the FraudTrace AI dashboard. Keep it secret; do not expose it in client-side code or public repositories. For a full guide on token management and security best practices, see the [Authentication](/authentication) page.

<Warning>
  Never commit your API key to source control or embed it in front-end applications. Rotate your key immediately from the dashboard if you suspect it has been compromised.
</Warning>

## Request and Response Format

Set the `Content-Type` header to `application/json` on all requests that include a body (e.g. `POST` endpoints). All responses are returned as JSON, including error payloads.

```http theme={null}
Content-Type: application/json
```

## Endpoints

The table below lists every current and planned endpoint. Live endpoints are available for use today. Endpoints marked **Coming Soon** are in active development — see the note below the table for how to get early access.

| Method | Endpoint                              | Description                                  | Status      |
| ------ | ------------------------------------- | -------------------------------------------- | ----------- |
| `GET`  | `/v1/verify/upi`                      | Verify a single UPI VPA for mule signals     | Live        |
| `POST` | `/v1/verify/upi/batch`                | Verify up to 100 UPI VPAs in one request     | Live        |
| `GET`  | `/v1/verify/upi/cluster/{cluster_id}` | Get detailed mule cluster analysis by ID     | Live        |
| `GET`  | `/v1/cyber/check`                     | Check an entity for dark web exposure        | Coming Soon |
| `POST` | `/v1/audit/app`                       | Submit a mobile app for automated risk audit | Coming Soon |

<Note>
  **CyberTrace** (dark web exposure checks) and **Mobile Trace** (mobile app risk audits) are currently in development and not yet available for production use. Join the waitlist at [fraudtraceai.com](https://fraudtraceai.com) to be notified when early access opens.
</Note>

## Quick Start

The example below shows the minimal `curl` command to verify a single UPI Virtual Payment Address (VPA). Replace `YOUR_API_KEY` with your actual key and `user@upi` with the VPA you want to screen.

<CodeGroup>
  ```bash cURL theme={null}
  curl --request GET \
    --url "https://api.fraudtraceai.com/v1/verify/upi?upi=user@upi" \
    --header "Authorization: Bearer YOUR_API_KEY"
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      "https://api.fraudtraceai.com/v1/verify/upi",
      params={"upi": "user@upi"},
      headers={"Authorization": "Bearer YOUR_API_KEY"}
  )

  print(response.json())
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch(
    "https://api.fraudtraceai.com/v1/verify/upi?upi=user%40upi",
    {
      method: "GET",
      headers: {
        Authorization: "Bearer YOUR_API_KEY",
      },
    }
  );

  const data = await response.json();
  console.log(data);
  ```
</CodeGroup>

A successful response returns a JSON object containing the VPA's risk score, mule signal flags, and cluster association if applicable.

## Versioning

The current API version is **v1**, reflected in every endpoint path. FraudTrace AI follows a stable versioning policy:

* **Non-breaking changes** (new optional fields, new endpoints) are added to the current version without notice.
* **Breaking changes** (removed fields, changed response shapes, altered behavior) are released under a new version prefix.
* Old versions remain supported for a minimum of 12 months after a new version is published.

<Tip>
  Pin your integration to `/v1/` paths explicitly so you are insulated from any future version rollouts until you are ready to migrate.
</Tip>

## Next Steps

* Read the [Authentication](/authentication) guide to set up your API key and understand token scopes.
* Explore the MuleTrace endpoints to start screening UPI VPAs.
* Check [Rate Limits](/api-reference/rate-limits) to understand throughput constraints and plan your integration.
* Review [Error Codes](/api-reference/errors) to build robust error handling before going to production.