Verify a domain or licence number

Query Parameters

domain

string

<= 253 characters

Example

bet365.com

license_number

string

<= 64 characters

Example

039028-R-319297-013

as_of

string format: date

/^\d{4}-\d{2}-\d{2}$/

Retrospective lookup. Reconstructs the matched licence’s status as it stood on this UTC date from transition history — e.g. “was this operator licensed at the time of a transaction three months ago”. match.status stays current; the historical value is returned under a top-level as_of object.

Example

2026-03-01

200

Lookup result (may indicate confidence: "none").

object

query

required

object

domain

string

license_number

string

match

required

One of:

object
null

object

confidence

required

high = domain matched exactly in our registry. medium = domain root matched a trading name or operator name (we can identify the operator but not prove the domain is theirs). low = the domain root is a generic gambling term (casino.com, poker.com), so we refuse to name an operator.

string

Allowed values: high medium low

match_type

required

string

Allowed values: domain_exact trading_name_fuzzy name_similarity

operator

required

string

operator_slug

required

string

jurisdiction

string | null

license_number

string | null

status

unknown means the register lists this licence but published a status we could not classify. It is not a synonym for active — read upstream_status for the regulator’s own words and decide for yourself. We do not guess.

string | null

Allowed values: active suspended revoked expired pending unknown

expires_at

string | null format: date

domain_association

Populated for domain_exact matches only. direct = licensee runs the domain; white_label = licensee authorises a third-party brand on the domain. null for fuzzy matches.

string | null

Allowed values: direct white_label

upstream_status

The regulator’s own words for the licence status, verbatim, before our enum mapping (e.g. Surrendered, Revoked as of the request of the operator, N/A Indefinite). Always informative; essential when status is unknown.

string | null

domain_status

The status of the DOMAIN, which is not the status of the licence. delisted means the regulator has removed this domain from the licensee’s permitted surface: the operator is still licensed, but this site is not covered by that licence — check this field before treating status: "active" as a green light. null for non-domain queries.

string | null

Allowed values: active parked expired redirecting delisted

verification_url

The regulator’s OWN per-domain verification page for this match, when the regulator publishes one — a Curaçao certificate (cert.cga.cw) or a Tobique validation seal (validate.thetgc.ca). Fetch or link it to confirm the verdict against the primary source directly; we re-read these pages nightly to keep domain_status current. null where the regulator has no such page (UKGC, MGA, KH, AN) or for non-domain matches.

string | null format: uri

alternatives

required

Array<object>

<= 3 items

object

operator

required

string

operator_slug

required

string

matched_name

required

string

similarity

required

number format: float

<= 1

confidence

Mirror of match.confidence, or none when no match.

string

Allowed values: high medium low none

match_absence_reason

Present only when match is null. generic_term: the label is an ultra-generic gambling word (e.g. casino.com) we cannot map to one operator. no_record_found: a specific query we checked against every covered register and did not find. Lets a caller phrase the answer precisely instead of treating every miss as “unlicensed”.

string | null

Allowed values: generic_term no_record_found

checked_jurisdictions

Present only when match is null — the jurisdiction codes actually checked, so a “not licensed” claim stays scoped to our coverage. Example: [“AN”,“CW”,“KH”,“MGA”,“TGC”,“UKGC”].

Array<string>

jurisdictions

Present only when a matched domain is licensed by MORE THAN ONE (operator, jurisdiction) pair — dual-licensed brands. Best-first: jurisdictions[0] is the pair match reports. Read this before phrasing a single-jurisdiction verdict about a multi-licensed brand; a domain can be active under one register and delisted under another at the same time.

Array<object>

One (operator, jurisdiction) pair that licenses the matched domain. A brand can be licensed by different legal entities in different jurisdictions at once; status/domain_status are per-link — active in one register and delisted in another are both true simultaneously.

object

operator

required

string

operator_slug

required

string

jurisdiction

required

string | null

license_number

required

string | null

status

required

string | null

domain_status

required

string

Allowed values: active parked expired redirecting delisted

domain_association

required

string

Allowed values: direct white_label

verification_url

required

string | null format: uri

as_of

Point-in-time status, present only when ?as_of= was supplied. Answers ONLY within the observation window: we never extrapolate a status before tracking_since (the first time we recorded the licence).

object

as_of

required

The resolved instant (UTC). Bare YYYY-MM-DD inputs resolve to end-of-day.

string format: date-time

knowledge

required

observed: the date is within our window, status is known. before_tracking: the date predates when we started watching — status is null, NOT a guess. no_such_license: we have no history for this licence. no_license_resolved: a fuzzy /v1/check match with no specific licence to time-travel.

string

Allowed values: observed before_tracking no_such_license no_license_resolved

status_as_of

required

Licence status as of the date, or null when not observed.

string | null

established_by

required

The history transition in effect at the date — when this status was last confirmed relative to the query.

object

changed_at

string format: date-time

new_status

string

change_type

string

source_url

string

tracking_since

required

Lower bound of our knowledge — when we first observed this licence.

string | null format: date-time

_meta

required

Single-resource provenance envelope — answers “where did this come from and how fresh is it?” for one record.

object

scraped_at

required

ISO-8601 timestamp when iGregulator’s scraper last fetched this record.

string format: date-time

source_modified_at

required

ISO-8601 timestamp when the regulator updated the data on their register, not when our scraper fetched it. Always null today across every jurisdiction — our schema doesn’t persist per-record upstream modification time. Will populate for UKGC (the one regulator that exposes it via the ZIP’s last_updated field) once the scraper migration lands; remains null for MGA, CGA, KGC (no upstream timestamp).

string | null format: date-time

source_url

required

URL of the source register page or dump. Null when not attributable to a single URL.

string | null format: uri

confidence_hint

required

authoritative — direct from an official regulator dump (e.g. UKGC ZIP). scraped — parsed from regulator HTML/PDF (MGA, CGA, KGC). derived — computed match, not a direct lookup (fuzzy match on /v1/check, no direct source row).

string

Allowed values: authoritative scraped derived

{
  "scraped_at": "2026-04-19T03:00:00Z",
  "source_modified_at": null,
  "source_url": "https://www.gamblingcommission.gov.uk/downloads/business-licence-data.zip",
  "confidence_hint": "authoritative"
}

{
  "query": {
    "domain": "paddypower.com"
  },
  "match": {
    "confidence": "medium",
    "match_type": "trading_name_fuzzy",
    "operator": "Power Leisure Bookmakers Limited",
    "operator_slug": "power-leisure-bookmakers-limited",
    "jurisdiction": "UKGC",
    "license_number": "039028-R-319297-013",
    "status": "active",
    "expires_at": null,
    "domain_association": null,
    "upstream_status": "Active",
    "domain_status": null,
    "verification_url": null
  },
  "alternatives": [
    {
      "operator": "PPB Counterparty Services Limited",
      "operator_slug": "ppb-counterparty-services-limited",
      "matched_name": "paddy power",
      "similarity": 1
    }
  ],
  "confidence": "medium",
  "_meta": {
    "scraped_at": "2026-04-19T16:42:10.000Z",
    "source_modified_at": null,
    "source_url": null,
    "confidence_hint": "derived"
  }
}

400

Invalid query / parameters.

object

error

required

Human-readable error summary.

string

code

required

HTTP-status-level class. Stable enum; branch on details.reason for finer control. Current values: invalid_query, invalid_slug, invalid_license_id, invalid_jurisdiction_code, invalid_pagination, not_found, auth_required, auth_invalid, auth_revoked, payment_required, quota_exceeded, rate_limited, server_error.

string

details

required

object

reason

required

Machine-readable refinement of the top-level code. Stable vocabulary; branch on this in clients. Examples: invalid_input, missing_required_parameter, conflicting_parameters, operator_not_found, license_not_found, jurisdiction_not_found, route_not_found, api_key_missing, malformed_header, api_key_invalid, api_key_revoked, quota_exceeded, internal_error.

string

field

Present only when the error maps to a specific request input field (query param, path param, body key). Omitted for errors that aren’t field-scoped (e.g. rate_limited, auth_revoked).

string

suggestion

Optional human-readable / agent-actionable hint describing how to resolve the error.

string

{
  "reason": "api_key_revoked",
  "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
}

{
  "error": "API key has been revoked",
  "code": "auth_revoked",
  "details": {
    "reason": "api_key_revoked",
    "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
  }
}

429

Rate limit reached. Public endpoints: 10 req / IP / hour. Authenticated: per plan tier. Retry after the window surfaced in X-RateLimit-Reset.

object

error

required

Human-readable error summary.

string

code

required

HTTP-status-level class. Stable enum; branch on details.reason for finer control. Current values: invalid_query, invalid_slug, invalid_license_id, invalid_jurisdiction_code, invalid_pagination, not_found, auth_required, auth_invalid, auth_revoked, payment_required, quota_exceeded, rate_limited, server_error.

string

details

required

object

reason

required

Machine-readable refinement of the top-level code. Stable vocabulary; branch on this in clients. Examples: invalid_input, missing_required_parameter, conflicting_parameters, operator_not_found, license_not_found, jurisdiction_not_found, route_not_found, api_key_missing, malformed_header, api_key_invalid, api_key_revoked, quota_exceeded, internal_error.

string

field

Present only when the error maps to a specific request input field (query param, path param, body key). Omitted for errors that aren’t field-scoped (e.g. rate_limited, auth_revoked).

string

suggestion

Optional human-readable / agent-actionable hint describing how to resolve the error.

string

{
  "reason": "api_key_revoked",
  "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
}

{
  "error": "API key has been revoked",
  "code": "auth_revoked",
  "details": {
    "reason": "api_key_revoked",
    "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
  }
}

Headers

X-RateLimit-Limit

integer

X-RateLimit-Remaining

integer

X-RateLimit-Reset

integer

Unix epoch seconds.

X-Upgrade-URL

string format: uri

500

Unexpected server error.

object

error

required

Human-readable error summary.

string

code

required

HTTP-status-level class. Stable enum; branch on details.reason for finer control. Current values: invalid_query, invalid_slug, invalid_license_id, invalid_jurisdiction_code, invalid_pagination, not_found, auth_required, auth_invalid, auth_revoked, payment_required, quota_exceeded, rate_limited, server_error.

string

details

required

object

reason

required

Machine-readable refinement of the top-level code. Stable vocabulary; branch on this in clients. Examples: invalid_input, missing_required_parameter, conflicting_parameters, operator_not_found, license_not_found, jurisdiction_not_found, route_not_found, api_key_missing, malformed_header, api_key_invalid, api_key_revoked, quota_exceeded, internal_error.

string

field

Present only when the error maps to a specific request input field (query param, path param, body key). Omitted for errors that aren’t field-scoped (e.g. rate_limited, auth_revoked).

string

suggestion

Optional human-readable / agent-actionable hint describing how to resolve the error.

string

{
  "reason": "api_key_revoked",
  "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
}

{
  "error": "API key has been revoked",
  "code": "auth_revoked",
  "details": {
    "reason": "api_key_revoked",
    "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
  }
}

Verify a domain or licence number

Parameters

Query Parameters

Example

Example

Example

Responses

200

400

429

Headers

500