Heatrail API

This host serves an HTTP API. There is no website here.

Heatrail is an advisory fraud signal for e-commerce. A shop asks this API to score a checkout it is already processing, and gets back a number and machine-readable reasons. The answer is advice: Heatrail never blocks, delays or cancels a purchase, and the integration applies a hard 800 ms budget and fails open, so this service being down cannot stop a sale.

Raw e-mail addresses and phone numbers never reach this host. They are hashed inside the shop, under a key that stays there, before the request is sent.

Checkable from here, without an account

• /v1/health — liveness
• /disclosure — the public, customer-facing description of what is processed and why
• /.well-known/security.txt — coordinated disclosure policy (RFC 9116)

Elsewhere

• heatrail.eu — how it works, the security page, pricing, API reference
• portal.heatrail.eu — the partner portal

Authenticated endpoints require an HR1-signed request. An unsigned or unknown caller gets a generic 401 that says nothing about which part was wrong. Found something? security@heatrail.eu — we will not pursue good-faith research.