Trustpositif Archive

Incremental mirror of the Indonesian Trustpositif domain & IP blocklists, served as RSS and a JSON API.

Public endpoints

Service health: top-level status plus per-component (ingest, storage) status. HTTP 200 when healthy, 503 when degraded.

RSS 2.0 feed of blocklist changes (additions & removals per ingest event). Subscribe here for change notifications.

GET/api/v1/calendar?from=YYYY-MM-DD&to=YYYY-MM-DD

Ingest events grouped by Jakarta date. from/to required (max 90-day span).

GET/api/v1/entries?type=domain|ip&limit=N&cursor=

Paginated entries from the current accepted snapshot. Use the returned next_cursor to continue.

POST/api/v1/search

Batch membership check (is a domain/IP currently listed?). Up to N queries per request.

# body
{ "queries": [ {"type":"domain","value":"example.com"}, {"type":"ip","value":"1.2.3.4"} ] }

GET/api/v1/lists/{feed}

Full current snapshot, streamed gzipped (feed = domains | ips).

GET/api/v1/events/{event_id}

Metadata for one ingest event (baseline flag, feed participants, Jakarta date).

GET/api/v1/events/{event_id}/{feed}/{kind}

A diff artifact, streamed gzipped — feed = domains|ips, kind = added|removed.

GET/api/v1/events/{event_id}/dns

DNS observations recorded during that event, streamed gzipped (ndjson).

POST/api/v1/refresh

Force an ingest now. Returns {"operation_id","status":"accepted"} (or already_running if one is in flight).

curl -X POST -H "Authorization: Bearer $ADMIN_TOKEN" \
  {{origin}}/api/v1/refresh

POST/api/v1/dns

On-demand DNS resolution over Cloudflare DoH. Body: {"domains":["example.com",...]}. Returns observations + observation ids.

GET/api/v1/dns/{observation_id}

Fetch a stored on-demand DNS observation, streamed gzipped (ndjson).