greatapis

Anti-Malware — entry 004 of 15

Google Safe Browsing

Verified Jul 2026

Google Safe Browsing lets clients check URLs against Google's continuously updated lists of malware, phishing, and unwanted-software sites via the v4 threatMatches:find endpoint, the same data that powers warnings in Chrome and Search. A live POST with a syntactically valid but bogus key returned a 400 "API key not valid" error from safebrowsing.googleapis.com, reconfirming API-key auth and HTTPS, and both that call and its OPTIONS preflight echoed the request Origin in Access-Control-Allow-Origin. The API is free for any Google Cloud project under its published quota.

url-scanningphishingmalwaregooglethreat-intelligence
Visit developers.google.com ↗Read the docs ↗Pricing ↗More Anti-Malware
AuthenticationAPI KeySign up with the provider to obtain credentials.
HTTPSSupportedTraffic is encrypted in transit.
CORSEnabledCallable directly from browser JavaScript.
PricingFreeNo paid tier — free for the documented use case.
FormatsJSONResponses can be requested as JSON.

GreatAPIs Score

Score84out of 100
Authentication15/25API key required
Pricing20/20Free to use
Docs20/20Machine-readable spec file bundled
Formats9/15Single response format
Freshness20/20Verified within 6 months

Embed this badge

Scored 84 on greatapis.com
<a href="https://greatapis.com/api/google-safe-browsing/"><img src="https://greatapis.com/badge/google-safe-browsing.svg" alt="Scored 84 on greatapis.com"></a>

Auth quickstart

  1. Get a key at the provider
  2. Send it on every request as a query param?key=<key>
Stored keyNo key stored

Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.

Endpoints

Servers
https://safebrowsing.googleapis.com/
encodedFullHashes1
GET/v4/encodedFullHashes/{encodedRequest}
Parameters
NameInRequiredType
$.xgafvquerynostring
access_tokenquerynostring
altquerynostring
callbackquerynostring
fieldsquerynostring
keyquerynostring
oauth_tokenquerynostring
prettyPrintquerynoboolean
quotaUserquerynostring
upload_protocolquerynostring
uploadTypequerynostring
encodedRequestpathyesstring
clientIdquerynostring
clientVersionquerynostring
Responses
StatusDescriptionSchema
200Successful responseGoogleSecuritySafebrowsingV4FindFullHashesResponse
encodedUpdates1
GET/v4/encodedUpdates/{encodedRequest}
Parameters
NameInRequiredType
$.xgafvquerynostring
access_tokenquerynostring
altquerynostring
callbackquerynostring
fieldsquerynostring
keyquerynostring
oauth_tokenquerynostring
prettyPrintquerynoboolean
quotaUserquerynostring
upload_protocolquerynostring
uploadTypequerynostring
encodedRequestpathyesstring
clientIdquerynostring
clientVersionquerynostring
Responses
StatusDescriptionSchema
200Successful responseGoogleSecuritySafebrowsingV4FetchThreatListUpdatesResponse
fullHashes1
POST/v4/fullHashes:find
Parameters
NameInRequiredType
$.xgafvquerynostring
access_tokenquerynostring
altquerynostring
callbackquerynostring
fieldsquerynostring
keyquerynostring
oauth_tokenquerynostring
prettyPrintquerynoboolean
quotaUserquerynostring
upload_protocolquerynostring
uploadTypequerynostring
Request body

application/json — GoogleSecuritySafebrowsingV4FindFullHashesRequest

Responses
StatusDescriptionSchema
200Successful responseGoogleSecuritySafebrowsingV4FindFullHashesResponse
threatHits1
POST/v4/threatHits
Parameters
NameInRequiredType
$.xgafvquerynostring
access_tokenquerynostring
altquerynostring
callbackquerynostring
fieldsquerynostring
keyquerynostring
oauth_tokenquerynostring
prettyPrintquerynoboolean
quotaUserquerynostring
upload_protocolquerynostring
uploadTypequerynostring
Request body

application/json — GoogleSecuritySafebrowsingV4ThreatHit

Responses
StatusDescriptionSchema
200Successful responseGoogleProtobufEmpty
threatLists1
GET/v4/threatLists
Parameters
NameInRequiredType
$.xgafvquerynostring
access_tokenquerynostring
altquerynostring
callbackquerynostring
fieldsquerynostring
keyquerynostring
oauth_tokenquerynostring
prettyPrintquerynoboolean
quotaUserquerynostring
upload_protocolquerynostring
uploadTypequerynostring
Responses
StatusDescriptionSchema
200Successful responseGoogleSecuritySafebrowsingV4ListThreatListsResponse
threatListUpdates1
POST/v4/threatListUpdates:fetch
Parameters
NameInRequiredType
$.xgafvquerynostring
access_tokenquerynostring
altquerynostring
callbackquerynostring
fieldsquerynostring
keyquerynostring
oauth_tokenquerynostring
prettyPrintquerynoboolean
quotaUserquerynostring
upload_protocolquerynostring
uploadTypequerynostring
Request body

application/json — GoogleSecuritySafebrowsingV4FetchThreatListUpdatesRequest

Responses
StatusDescriptionSchema
200Successful responseGoogleSecuritySafebrowsingV4FetchThreatListUpdatesResponse
threatMatches1
POST/v4/threatMatches:find
Parameters
NameInRequiredType
$.xgafvquerynostring
access_tokenquerynostring
altquerynostring
callbackquerynostring
fieldsquerynostring
keyquerynostring
oauth_tokenquerynostring
prettyPrintquerynoboolean
quotaUserquerynostring
upload_protocolquerynostring
uploadTypequerynostring
Request body

application/json — GoogleSecuritySafebrowsingV4FindThreatMatchesRequest

Responses
StatusDescriptionSchema
200Successful responseGoogleSecuritySafebrowsingV4FindThreatMatchesResponse

Try it

Developer reference
Base URLhttps://safebrowsing.googleapis.com
Key endpoints
  • POST/v4/threatMatches:find
  • GET/v4/threatLists
  • POST/v4/threatListUpdates:fetch
  • POST/v4/fullHashes:find
SDKs
Node.js ↗Python ↗PHP ↗Java ↗Ruby ↗Go ↗C# ↗
Changelog
Spec versionv4
Tracked paths7
  • Aug 2026gained a docs link, an OpenAPI spec and a pricing page
Tracking since Sep 2026. See every tracked change ↗ ·Subscribe with RSS ↗
Featured in
2 collections
Spec-backed APIsCORS-ready browser APIs
People comparing Google Safe Browsing also look at…
All 15 →
Google Safe Browsing vs AlienVault Open Threat Exchange (OTX)
Open Threat Exchange is AT&T Cybersecurity's community threat-intelligence platform, now operated under the LevelBlue brand, where contributors publish "pulses" of malicious IPs, domains, hashes, and URLs that anyone can query. A live, unauthenticated GET against its IPv4 general-info endpoint returned a full 200 JSON response, and both that call and its OPTIONS preflight echoed the request's Origin in Access-Control-Allow-Origin, resolving cors to yes; an OTX-API-KEY is still needed for higher rate limits and pulse subscriptions. Signup, the API key, and the community feed itself are all free.
Compare →
Google Safe Browsing vs CAPEsandbox
Google Safe Browsing supports CORS, while CAPEsandbox doesn't — pick Google Safe Browsing for direct browser calls.
Compare →
Google Safe Browsing vs MalShare
Google Safe Browsing supports CORS, while MalShare doesn't — pick Google Safe Browsing for direct browser calls.
Compare →
Google Safe Browsing vs MalDatabase
Google Safe Browsing supports CORS, while MalDatabase doesn't — pick Google Safe Browsing for direct browser calls.
Compare →
Google Safe Browsing vs NoPhishy
NoPhishy (listed on RapidAPI as Exerra Phishing Check) queries a maintained database of 299,000+ known phishing domains, refreshed roughly every two hours, to flag whether a submitted URL or domain is a known phishing attempt. A live GET through the real RapidAPI gateway host with an invalid x-rapidapi-key returned a 403 rejection rather than a network-level block, reconfirming API-key auth over HTTPS, and Access-Control-Allow-Origin echoed the request's Origin on that same call. Like other RapidAPI-distributed APIs it offers a free Basic plan alongside paid tiers for higher request volumes.
Compare →
Google Safe Browsing vs Scanii
Scanii is a REST API that scans uploaded files, images, and text for malware, unsafe imagery, and inappropriate language across more than 100 image formats and 20+ languages, returning findings, checksums, and content metadata as JSON. A live GET and OPTIONS preflight against api.scanii.com/v2.2/files both returned Access-Control-Allow-Origin: *, and the GET's 401 carried a WWW-Authenticate: Basic realm="Scanii API" header, correcting the stored auth from API Key to Basic Auth (the API key is used as the Basic-auth username, its secret as the password) over HTTPS. New accounts start with free trial credits before moving to metered Starter/Plus/Enterprise plans billed per file scanned.
Compare →
URLScan.io
Scan and Analyse URLs
API Key · CORS
AbuseIPDB
IP/domain/URL reputation
API Key
MalwareBazaar
Collect and share malware samples
API Key
URLhaus
Bulk queries and Download Malware Samples
API Key
VirusTotal
VirusTotal File/URL Analysis
API Key
Web of Trust
IP/domain/URL reputation
API Key · CORS