Get Business Trust data with one API
The Business Trust API returns a trust signal for a business as clean JSON.
2 active endpoints, on 7 and 24 credit tiers.
- POST/enrich-trust/v1/business_trust
- POST/enrich-trust/v1/batch
What Business Trust endpoints does ReefAPI ship?
2 live read endpoints. Read-only data API: no writes, no account actions, no dashboard access on the target site.
Business Trust API
1 of 2 endpoints, ready to run
domain‖company_name → entity-resolved PUBLIC trust signals.
// Press "Try it" and this pane shows exactly what the // live site returned this second — including an empty // result, if that is the truth. No key, no account.
How the Business Trust API works
Business Trust is a normal ReefAPI surface — the same four rules that hold for every other engine on the key.
No OAuth app, no request signing, no per-site account. One key covers all 185 engines.
Every route is a POST with a JSON body. Parameters are validated against the published schema before anything is charged.
Credits, not seats. Failed and blocked calls are never charged, and cache hits cost nothing.
One envelope everywhere. meta carries latency_ms, record_count and the endpoint that answered.
There is no trust score here, and that is deliberate
This engine does not return a number. It returns three lists (positive_signals, risk_signals, unknowns), a four-value recommendation, and a score_method string that reads "heuristic_signal_summary_v1". If you want a 0-100 figure, its siblings have one: enrich-package for a package, enrich-app for an app's reputation index, email-health for a sending domain. Everything below was measured on stripe.com, cloudflare.com, Trendyol, an unregistered domain and a made-up company name.
| Field | Measured values | What to know |
|---|---|---|
| recommendation | proceed / review / high_risk / insufficient_data | the only verdict field; there is no numeric score to threshold on |
| entity.match + confidence | "exact-domain" 0.9 / "fuzzy" 0.5 / "fuzzy" 0.3 | 0.9 came with evidence kind "trustpilot-domain-match"; 0.5 is a name-only input echoed back; 0.3 was a stem guess off an unregistered domain |
| positive_signals[].code | domain_age_mature, ssl_present, email_authenticated, review_volume, no_negative_news, real_world_presence, app_store_presence | app_store_presence appeared only at depth rich; each row carries label, evidence and source |
| risk_signals[].code | domain_unregistered, negative_news | an unregistered domain produced exactly one risk row and a "review" verdict |
| unknowns[].reason | not_checked / not_found / not_applicable / unsupported | a sanctions row with reason "not_checked" is present in every response we made, without exception |
| domain_signals | age_days 11306, age_band "mature", registrar, has_certificate, dnssec, mail{mx,spf,dmarc}, parked, for_sale, risk_level | for a name-only input this object is empty and unknowns gains domain_lifecycle "not_applicable" |
| reputation.trustpilot.rating_note | "1.5/5 over 17438 reviews - public review rating; review scores reflect self-selected reviewers and are NOT a fraud/risk signal" | the note ships with the number so a low rating cannot be read as a risk finding |
| depth | basic / rich | rich adds rating_distribution, is_claimed and sample_reviews to Trustpilot plus region-routed sources; the top-level shape does not change |
| meta.record_count | 6 for stripe.com, 3 for Trendyol, 0 for a made-up name | it counts positive_signals, so a 0 means no positive signal resolved, not an empty response |
Scope is stated in the payload rather than only in the docs. Every response carries scope {kyb_aml: "out-of-scope", sanctions: "not-checked (gov-pending)", person_pii: "excluded"} and a disclaimer saying this is not KYB, AML, sanctions screening, credit or identity verification, and not an approve or reject decision. business_type is a hint that suppresses false risks rather than a filter: passing b2b means an absent public review presence is treated as normal, and country drives which regional reputation sources are consulted (measured TR routing on a Trendyol lookup).
What people build with Business Trust
The jobs this data is most often used for.
endpoints
credits per call
Marketplaces call business_trust to vet a seller's legitimacy at onboarding.
Trust-and-safety teams score a merchant against multiple signals.
Due-diligence workflows use batch to screen many businesses at once.
What Business Trust data costs
The cheapest call here is 7 credits, so $15/mo (Pro) buys 1,428 of them — $1.50 per 1,000 credits. Credits roll over and never expire, and failed or blocked calls are not charged.
Full pricing →- 1,000 free credits on signup, no card
- One key, all 185 APIs, one credit pool
- Failed and blocked calls are never charged
- Credits roll over and never expire
Call it in two lines
Sign up, get 1,000 credits and one key that works on every engine. Then this is the whole protocol.
curl -X POST https://api.reefapi.com/enrich-trust/v1/business_trust \
-H "x-api-key: $REEF_KEY" \
-H "content-type: application/json" \
-d '{"domain":"stripe.com","depth":"basic"}'import requests
r = requests.post(
"https://api.reefapi.com/enrich-trust/v1/business_trust",
headers={"x-api-key": REEF_KEY},
json={
"domain": "stripe.com",
"depth": "basic"
},
)
print(r.json()["data"])Have a question? We got answers.
The questions people actually ask before wiring up Business Trust.
Get a free key →Stripe has 1.5 stars on Trustpilot. Why does the verdict still say proceed?▾
Because a public review rating is not treated as a risk signal. A measured stripe.com lookup returned trust_score 1.6, stars 1.5, reviews_count 17438 and recommendation "proceed", and Trustpilot's presence entered the positive list as review_volume, "Established review presence (17438 reviews)". The response even ships a rating_note saying review scores reflect self-selected reviewers and are not a fraud signal. Volume of public reviews is the signal; the star average is context you can display but should not threshold on.
A well-known company came back as "review". What triggers that?▾
One entity-matched negative news article is enough. A measured cloudflare.com lookup returned five positive signals and recommendation "review", with a single risk_signals row whose evidence was the headline "24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages". Cloudflare is the impersonated party in that story, not the actor, and the matcher does not make that distinction. Always read risk_signals[].evidence before acting on a "review", especially for security vendors and large brands that appear in incident coverage about other people.
What comes back for a business that does not exist?▾
ok:true with the emptiness made explicit, in two different shapes. A made-up domain returned recommendation "review", zero positive signals and one risk row, domain_unregistered, with evidence "registered=false / available=true; no live web/DNS/reputation evidence found". A made-up company name returned recommendation "insufficient_data", meta.record_count 0, empty positive and risk lists, and six unknowns rows naming what could not be checked. Nothing was substituted for the input in either case.
entity.confidence came back 0.5 for a company I invented. Does that mean it half-exists?▾
No. For a name-only input, confidence 0.5 with evidence kind "input-name" and source "input" simply means the engine echoed your string back as the canonical name, because there was nothing else to resolve against. We measured exactly 0.5 for both a real brand and an invented one. The number that carries information is 0.9 with match "exact-domain", where the evidence names a real source. Read entity.evidence[].kind, not the number alone.
Does this do sanctions, KYB or AML screening?▾
No, and it says so in every response rather than leaving it to the small print. unknowns always contains a row with code "sanctions", label "Sanctions / watchlist screening", reason "not_checked", source "out-of-scope", and the scope object repeats it as "not-checked (gov-pending)". We saw that row in every call we made, including on stripe.com where six positive signals resolved. Use this to triage a merchant or counterparty quickly; use a regulated provider for the compliance decision.
Which of the enrich engines should I actually call?▾
They divide by question, not by subject. enrich-company turns a domain into facts (WHOIS, DNS, SSL, tech stack, Tranco rank, Wikidata). enrich-store answers what e-commerce platform a storefront runs and what its catalog looks like. enrich-local matches a business to a Google Maps place. enrich-app scores an app's public reputation. enrich-trust sits on top and answers one different question: given the public signals, should a human look at this before you transact. It calls several of the others internally and then makes a judgement they do not make.
Does business_type change the verdict or just the wording?▾
It changes which absences count against you. The enum is auto, local, ecommerce, saas, brand and b2b, and the documented effect is that b2b treats a scarce public review presence as normal rather than as a risk. Similarly country, an ISO-3166 alpha-2 hint, routes which regional reputation sources are consulted and stops an absent US-only source from reading as a risk abroad; a Trendyol lookup with country TR returned region.routing "TR to trustpilot/maps/search". When omitted, country is inferred from the ccTLD.
Why does presence.own_site_indexed say false for a major site?▾
Because the indexed-web-presence check is currently unavailable, not because the site is missing from search. A measured stripe.com response carried presence.own_site_indexed false while unknowns listed code "web_presence" with reason "unsupported". The engine is honest about it in the unknowns list rather than converting the gap into a risk signal, and no risk row was raised. Read unknowns first; a false in presence is not a finding when the matching unknowns row says unsupported.
What is the Business Trust API?▾
Business Trust API is a ReefAPI endpoint group for business trust It returns live JSON through POST requests under /enrich-trust/v1.
Is the Business Trust API free to try?▾
Yes. ReefAPI starts with 1,000 free credits, no card required. Business Trust calls use the same shared credit balance as every other ReefAPI engine.
Do I need a Business Trust login or account?▾
No login to Business Trust is needed for the API response. You call ReefAPI with your x-api-key header, and the playground can run live examples before you create a production key.
How fresh is the Business Trust data?▾
The page example is captured from a live business_trust call, and production requests fetch live data through ReefAPI rather than a static sample.
How many credits does the Business Trust API use?▾
Business Trust actions currently cost 7-24 credits per successful call. Failed or blocked calls are free, and all APIs draw from one credit pool.
Can I call Business Trust from an AI assistant or MCP client?▾
Yes. Connect ReefAPI once through MCP and your assistant can call enrich-trust actions with the same key, credit pool and JSON envelope used by normal REST requests.
14 Reputation & Reviews APIs on the same key
One key, one credit pool, one response envelope. If you are pulling Business Trust, you are one call away from the rest of the category — no second contract, no second integration.
Try it on your own data before you pay anything
The call above is the real endpoint, not a recording. A free key gives you 1,000 credits, the other 184 APIs, and the same envelope everywhere.
Endpoints, parameters and credit costs on this page are read from the live catalog and cannot drift from what the API accepts.