Anti-Phishing HTTP API
Fetch the phishing tracking pixel via the BotBye HTTP API directly — no SDK required. This approach works with any language or platform that can make an outbound HTTP request.
Phishing is identified by a public, browser-safe clientKey carried in the URL path, so no server key is required.
Expose a single endpoint on your own origin that the phishing pixel points at. When the browser loads the pixel, your endpoint receives the Origin header and the pixel's query string (the JS tag adds format, image_id, and its own module_name / module_version). Forward that request to BotBye's /server route — preserving the incoming query string verbatim — and relay the response bytes back to the browser.
Proxy the tracking pixel
1
GET https://verify.botbye.com/api/v1/phishing/image/{clientKey}/server?{incoming_query_string}
Request headers:
| Header | Required | Description |
|---|---|---|
| Origin | yes | The browser's Origin header, passed straight through |
| Module-Name | no | Your module / platform name, for attribution |
| Module-Version | no | Your module / platform version, for attribution |
Copy the incoming pixel query string (format, image_id, module_name, module_version, …) onto the upstream request unchanged — BotBye uses it to pick the image format and to attribute the integration. The response carries the image bytes; relay its Content-Type (image/png or image/svg+xml, per the forwarded format) and body back to the browser as-is.
When you use an SVG image, your application must also expose an endpoint on the client origin that handles requests to /{imageId}.png, where imageId is the value that arrives in the forwarded pixel query as image_id.
1
2
3
4
5
# Proxy a PNG pixel — forward the browser's Origin and query string verbatim
curl -X GET 'https://verify.botbye.com/api/v1/phishing/image/00000000-0000-0000-0000-000000000000/server?format=png' \
--header 'Origin: https://your-site.example' \
--header 'Module-Name: HTTP' \
--header 'Module-Version: 1.0.0'
Report the server-side integration (recommended)
Once, at startup, send a best-effort init handshake so the Get Started flow marks the server-side integration as complete. Ignore failures — it must never block startup.
1
2
3
curl -X POST 'https://verify.botbye.com/api/v1/phishing/init-request/v1/00000000-0000-0000-0000-000000000000' \
--header 'Module-Name: HTTP' \
--header 'Module-Version: 1.0.0'