# LayerCall

> Trust intelligence API for developers. Score any IP, email, phone, domain or
> device — or a whole signup — in a single API call, returning a 0–100 risk
> score and an allow / review / block verdict.

LayerCall detects VPNs, proxies, Tor, datacenter IPs, disposable and risky
email, invalid or high-risk phone numbers, newly-registered or throwaway
domains, and known-abusive values via its own first-seen reputation network.
It also fingerprints devices and scores bot probability, so an attacker who
rotates IPs and email addresses is still recognised by the machine they keep.
Separately, it verifies AI agents by their Web Bot Auth signature and decides
what a verified agent is allowed to do.
It is a self-serve, developer-first trust intelligence API with public pricing
and a free tier (1,000 lookups/month, no credit card).

Long form (every endpoint, parameter and response field, generated from the
OpenAPI spec): https://www.layercall.com/llms-full.txt

## Key pages
- Home: https://www.layercall.com/
- Products: https://www.layercall.com/products (individual pages at /products/<slug>)
- API docs (quickstart): https://www.layercall.com/docs
- API reference (all endpoints): https://www.layercall.com/docs/endpoints
- OpenAPI 3.1 spec: https://www.layercall.com/openapi.json
- Pricing: https://www.layercall.com/pricing
- Live demo: https://www.layercall.com/demo/signup
- Accuracy (measured false-positive figures, method and corpus): https://www.layercall.com/accuracy
- FAQ (fail-open behaviour, GDPR, data sources): https://www.layercall.com/faq
- Trust Index (our own weekly measurements, free to cite): https://www.layercall.com/trust-index
- Comparisons with other providers: https://www.layercall.com/compare
- Implementation guides: https://www.layercall.com/guides
- Use cases: https://www.layercall.com/use-cases
- Industries: https://www.layercall.com/industries
- Integrations: https://www.layercall.com/integrations (individual guides at /integrations/<slug>, enumerated below)
- Blog: https://www.layercall.com/blog
- System status: https://www.layercall.com/status

## Integration guides (working code for each tool)
Each page carries a runnable snippet, what to do with an allow / review /
block verdict in that tool's own idiom, and the mistakes that tool invites.

- Zapier: https://www.layercall.com/integrations/zapier — Score a lead, signup or form submission inside any Zap using the Webhooks action.
- n8n: https://www.layercall.com/integrations/n8n — Self-hosted or cloud n8n workflows can call the API with the standard HTTP Request node.
- Make: https://www.layercall.com/integrations/make — Screen submissions inside a Make scenario using the HTTP module.
- Retool: https://www.layercall.com/integrations/retool — Add a REST resource and score values from inside an internal admin or review queue.
- Supabase: https://www.layercall.com/integrations/supabase — Score a signup from a Supabase Edge Function or a database trigger.
- Cloudflare Workers: https://www.layercall.com/integrations/cloudflare-workers — Screen a request at the edge, before it ever reaches your origin.
- Vercel: https://www.layercall.com/integrations/vercel — Score a signup inside a Next.js Route Handler running on Vercel.
- AWS Lambda: https://www.layercall.com/integrations/aws-lambda — Screen an event in a Lambda behind API Gateway or a Function URL.
- Django: https://www.layercall.com/integrations/django — Screen a registration or form submission from a Django view or signal.
- Laravel: https://www.layercall.com/integrations/laravel — Score a registration from a Laravel controller, or as a custom validation rule.
- WordPress & WooCommerce: https://www.layercall.com/integrations/wordpress — Screen a checkout, registration or comment with wp_remote_post from a small plugin.
- Airtable: https://www.layercall.com/integrations/airtable — Score a row from an Airtable automation and write the verdict back to the record.
- Bubble: https://www.layercall.com/integrations/bubble — Call the API from Bubble's API Connector and branch a workflow on the verdict.
- Postman: https://www.layercall.com/integrations/postman — Try the API, then keep the collection as a smoke test your whole team can run.
- Incoming webhooks: https://www.layercall.com/integrations/webhooks — Screen a payload arriving from a form provider, CRM or payment platform before you act on it.

## Free tools (no signup)
- All tools: https://www.layercall.com/tools
- IP lookup / VPN, proxy & Tor checker: https://www.layercall.com/tools/ip-lookup
- Disposable email checker: https://www.layercall.com/tools/disposable-email-checker
- Domain age & risk checker: https://www.layercall.com/tools/domain-checker
- Phone number validator: https://www.layercall.com/tools/phone-validator

## Core endpoints
- POST/GET https://www.layercall.com/v1/score/ip — IP risk (VPN, proxy, Tor, geo, ASN)
- https://www.layercall.com/v1/verify/email — email validity + disposable/risky
- https://www.layercall.com/v1/lookup/phone — phone validity + risk
- https://www.layercall.com/v1/score/domain — domain age, MX, disposable, risky TLD
- POST https://www.layercall.com/v1/score/device — device fingerprint reputation + bot probability
- https://www.layercall.com/v1/score/user — unified signup score (ip + email + phone + domain + device)

## AI agent authorization
Verify that a request really came from the AI agent it claims to be, using
Web Bot Auth signatures, then decide what that agent is allowed to do. This
answers a different question from bot detection: not "is this automated" but
"is this ChatGPT's fetcher acting for a real person, and may it do this here".
An unsigned claim proves nothing and is scored as unknown, never as verified.
- POST https://www.layercall.com/v1/verify/agent — verify an agent's Web Bot Auth signature
- POST https://www.layercall.com/v1/agent/authorize — decide what a verified agent may do
- GET/PUT https://www.layercall.com/v1/agent/policy — set the policy those decisions follow
- Docs: https://www.layercall.com/docs/agents
- Product page: https://www.layercall.com/products/ai-agent-authorization

## Device fingerprinting
Browser script: https://www.layercall.com/fp.js
LayerCall.fingerprint() returns a stable device_id (sha256 of browser
characteristics — no cookie, survives incognito and cleared storage). Pass it
to /v1/score/device or as device_id on /v1/score/user. Catches a fraudster who
rotates IP and email but keeps the same machine.

## Pricing (USD / month)
- Free: $0 — 1,000 lookups
- Starter: $49 — 20,000 lookups, $0.004 overage
- Growth: $199 — 100,000 lookups, $0.003 overage
- Scale: $749 — 500,000 lookups, $0.0022 overage
- Enterprise: custom — SSO/SAML, SLA