Merchant research API for personal agents
Updated November 6, 2026
Send a public merchant URL to POST https://www.scamwiz.com/api/merchant. The public beta returns first-party evidence and deterministic heuristic findings. No API key is required. Identity and independent reputation remain unverified.
Make a request
curl https://www.scamwiz.com/api/merchant \
-H "Content-Type: application/json" \
-d '{"url":"https://www.allbirds.com"}'Use HTTPS websites. The scanner rejects credentials, custom ports, IP-literal URLs and private-network destinations. It reads the requested page and up to six same-origin policy links without executing JavaScript or checkout.
Read the response
A successful response uses HTTP 200, including when a merchant blocks retrieval. Check coverage and the assessment status before using any finding. The complete recorded example JSON contains an actual dated scan.
| Field | Meaning |
|---|---|
checked_at | UTC timestamp for this scan. |
assessment.engine | heuristic: no model or search-grounding call is made. |
assessment.status | complete means rules ran on usable content; it does not mean complete coverage. insufficient_evidence means no scores could be assigned. |
assessment.findings | Each check has a status, interpretation and evidence excerpts linked by source_id. Unknown checks are not passing checks. |
assessment.sources | Retrieved page URLs and parsed structured-data sources. |
assessment.scores | Separate disclosure completeness, purchase-term favourability and information-access scores, with coverage and assessed/total counts. A null score is unscored. |
coverage | Retrieved pages and failed requests. A successful request can still have limited evidence. |
actions | Sharing personal data and completing a purchase require owner confirmation. These are recommendations; the scanner executes no actions. |
limitations | What this scan did not establish. |
Interpret scores conservatively
Disclosure completeness counts six fixed categories. Other dimensions average only assessed checks, with at least two required. Scores are experimental and are not a probability of fraud, certification or overall safety rating. Read every rule and scoring threshold.
Handle limits and failures
The beta currently permits five scans per ten minutes per IP-derived rate-limit key, with two concurrent scans per server instance. Limits are process-local and may change. Cache results for your own workflow only as appropriate, preserving their original timestamp and limitations.
- 405: use POST with a JSON body.
- 422: invalid or disallowed URL, resolution error or other request failure. Read the returned error.
- 429: rate or capacity limit. Respect Retry-After when supplied; otherwise retry later with backoff.
What should an agent tell its owner?
Summarize the applicable cited terms, identify unknowns, and provide original source links. Ask the owner before sharing personal information or purchasing. Never present a high score or absence of findings as verified merchant legitimacy.