Counterparty Trust Check

One call, one verdict: should your agent trust this domain?

Use it before an AI agent (or a workflow) pays an invoice, sends money or data, signs up, accepts a webhook, or emails a new counterparty. Input a domain, URL or email address; get back ALLOW, REVIEW or DENY with a 0–100 score, plain-language reasons and the raw public evidence.

When an agent should pick this tool

• A payment request, invoice or wallet address arrives from an unfamiliar domain.
• A new vendor, supplier or API provider must be onboarded.
• An inbound email asks for money, credentials or a change of bank details (check the sender's domain).
• A link or checkout page must be judged before entering details.

Input

{"domains": ["stripe.com", "billing@new-vendor.xyz"]}

Output (one dataset item per domain)

{"domain":"nsfas.org.za","verdict":"ALLOW","score":80,
 "flags":["no DMARC: email from this domain can be spoofed"],
 "evidence":{"resolves":true,"mx":["nsfas-org-za.mail.protection.outlook.com"],"spf":"v=spf1 ...","dmarc":{"record":null},"domain_age_days":null,"tls":{"valid":true}},
 "checked_utc":"2026-10-07T14:40:00+00:00"}

Built for repeat use in agent workflows

Every verdict carries:

• recheck_after_utc — when this counterparty should be checked again (24 h for DENY/REVIEW, 72 h for young domains, 7 days otherwise).
• changed_since_last_check + changes — compared with your own previous check of the same domain (DMARC policy, MX, SPF, TLS issuer, score, verdict). A counterparty whose mail setup changes right before a payment request is the classic invoice-fraud pattern.
• next_actions — machine tokens such as do_not_pay_or_send_data, require_out_of_band_confirmation_before_payment, verify_payment_or_bank_detail_requests_by_second_channel.
• history — your last 20 verdicts for that domain.

History is kept in a named key-value store in your own Apify account (counterparty-trust-history), readable and exportable any time. Turn it off with "rememberHistory": false.

Recommended pattern: call before every payment, onboarding or bank-detail change; schedule a re-check of your active vendor list at recheck_after_utc.

Signals

Domain existence (NXDOMAIN → DENY), domain age via RDAP (<30 days heavily penalised), valid TLS certificate, MX present, SPF, DMARC policy (missing / p=none means email from the domain can be spoofed), registry hold status.

Pricing

Pay per event: $0.01 per verdict (one event per unique domain). No platform usage charges. Typical latency 1–3 s per domain. Payable by AI agents with USDC via x402 where eligible.

Limits

Public signals only; a verdict is a risk signal, not a guarantee. Some ccTLDs (e.g. .co.za) do not publish registration dates over RDAP; this is flagged, not hidden.