On this page

Links, websites & email

Safety tools

API · Pro

Coverage: Checks wording and visible links only. The sender, attachments and website contents are not verified.

Open tool
On this page

Purpose

Check numbers, messages and links

Requirements

Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.

Text to check

How to use it

  1. Phishing email checker · Check if a text message is a scam · Check a link or website · Phone number formats · Calling codes

  2. In Email, paste the message text; in Link, its address. Press Check and review the signals and actual domain. It does not open links or authenticate senders.

  3. Enter the full number with its international code. For a national number, first check the edition country or country selector.

Synthetic example

Note

Invented example, not a real lookup. Do not call or open its links.

Synthetic example
https://delivery.example/notice

Interpret the result

Warning signs to review

No obvious warning signs found

Limitations

Warning

Checked on this device. Your text is not uploaded or saved.

Checks wording and visible links only. The sender, attachments and website contents are not verified.

Formats and supported calling codes only. They do not prove a number’s location, owner or active status. Some codes are shared.

Troubleshooting

Maximum 2000 characters. Nothing was checked; shorten the text to continue.

Enter one complete HTTP or HTTPS link, or a domain name.

Use with the API

Warning

Needs an API key and credits. Each completed call costs 1 credit, even when there is no data. An active Pro account includes 20 credits per UTC calendar month, shared by every API route and spent first; unused monthly credits do not roll over. Credits bought on your account page work without Pro and never expire.

Note

Errors are never charged: 401 invalid_api_key (missing or invalid key), 403 pro_required (no Pro credits and no purchased credits), 422 invalid input, 429 quota_exceeded (no credits left), rate_limit_exceeded or ai_busy (the AI of sms-check is at capacity), 503 tool_warming (the data is still being prepared) or tool or provider unavailable. After a 429 or 503, retry once the seconds in the Retry-After header have passed.

The same rule engine on a pasted email or message: attention, signals, hosts and link flags. Never a safe verdict.

Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.

Endpoint
POST https://api.nocall.io/v2/safety-tools
POST https://api.nocall.io/v2/tools  {"tool":"safety-tools","text":"URGENTE: su cuenta BBVA ha sido bloqueada, verifique en https://bbva-seguro.com/login","mode":"email","country":"ES"}

Parameters

NameTypeRequiredDescription
textstring (1–2000)YesEmail or message text to inspect.
mode"email" | "message"YesWhether the text is an email or a message.
countrystring (enum, 55)No (default: "ES")Country whose SMS rule set is used.
bash
REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/safety-tools' \
  --header "Authorization: Bearer $NOCALL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $REQUEST_ID" \
  --data '{"text":"URGENTE: su cuenta BBVA ha sido bloqueada, verifique en https://bbva-seguro.com/login","mode":"email","country":"ES"}'

Example response (200)

This is the documented example from the API reference. Lookups use a fictional number, and aggregates and AI answers show the shape of the result, not live data.

JSON
{
  "data": {
    "tool": "safety-tools",
    "result": {
      "attention": true,
      "signals": [
        "suspicious_domain",
        "urgency",
        "brand_impersonation"
      ],
      "hosts": [
        "bbva-seguro.com"
      ],
      "linkFlags": []
    }
  },
  "meta": {
    "requestId": "req_example",
    "unitsCharged": 1,
    "usage": {
      "periodStart": "2026-10-01",
      "unitLimit": 20,
      "unitsUsed": 3,
      "unitsRemaining": 17
    }
  }
}

Result fields (data.result)

FieldTypeDescription
attentionbooleanWhether the content deserves a closer look.
signalsarray<string (enum, 10)>Rule signals that matched.
hostsarray<string>Host names found in the text.
linkFlagsarray<"http" | "userinfo" | "internationalHost" | "ipAddress" | "nonStandardPort">Structural warnings about the link: http, userinfo, international host, IP address or non-standard port.