Node.js SDK security services

Use avraapi.security() for the two released Security operations. Both are async ApiResponse calls. A false signal means the configured provider did not classify that signal; it is not an allow or block decision by itself.

Every Security operation supports the shared one-request privacy control: avraapi.security().withPrivacyMode().checkVpn({ ip: 'IP_ADDRESS' }). It sends X-Privacy-Mode: 1 for that request only, then clears.

Check VPN, proxy, and IP risk

checkVpn({ ip }): Promise<ApiResponse> evaluates one permitted IPv4 or IPv6 address for VPN, proxy, Tor, relay, and hosting signals. SDK function

Copy the SDK call

const response = await avraapi.security().checkVpn({
  ip: 'IP_ADDRESS',
});

Field	Use
`ip`	Permitted IPv4 or IPv6 address.

Read IP-risk signals

import type { VpnShieldData } from '@avraapi/node-sdk';

// AvraAPI SDK call.
const response = await avraapi.security().checkVpn({
  ip: '194.195.93.1',
});

// Your application code.
const data = response.data as VpnShieldData;
const riskSignals = {
  vpn: data.is_vpn,
  proxy: data.is_proxy,
  tor: data.is_tor,
  hosting: data.is_hosting,
};
const requestId = response.requestId;

Response

{
  "success": true,
  "request_id": "1fa95b0c-f0da-4b07-9b1d-5235aca6ca20",
  "data": {
    "ip_address": "194.195.93.1",
    "is_vpn": true,
    "is_proxy": false,
    "is_tor": false,
    "is_relay": false,
    "is_hosting": true,
    "country_code": "US",
    "city": "San Jose",
    "asn": "AS212238",
    "network_name": "Datacamp Limited",
    "provider_name": "iplocate"
  }
}

Some network fields can be null. Combine the signals with your own risk policy and process only IP addresses you are permitted to use. Read the Security REST API Reference for field and error details.

Check a disposable email address

checkBurnerEmail({ email }): Promise<ApiResponse> evaluates one email address for syntax and configured disposable-domain signals. SDK function

Copy the SDK call

const response = await avraapi.security().checkBurnerEmail({
  email: 'EMAIL_ADDRESS',
});

Field	Use
`email`	Email address to evaluate.

Use a disposable-email signal

import type { BurnerEmailData } from '@avraapi/node-sdk';

// AvraAPI SDK call.
const response = await avraapi.security().checkBurnerEmail({
  email: 'customer@example.com',
});

// Your application code.
const data = response.data as BurnerEmailData;
if (data.is_disposable) {
  // Apply your application's registration or recovery policy.
}

Response

{
  "success": true,
  "request_id": "82512122-5a64-459c-a0cb-0ba07be4a600",
  "data": {
    "email": "hodil14324@ellbit.com",
    "domain": "ellbit.com",
    "is_valid_syntax": true,
    "is_disposable": true,
    "source": "custom",
    "execution_time_ms": 5.89
  }
}

is_disposable: false means configured lists did not contain a matching domain. It does not verify ownership, inbox reachability, or user trust.

Handle Security errors

Security calls reject with typed SDK errors. Keep error.requestId in backend support records, never expose provider diagnostics to a browser, and follow the common pattern in Node.js Overview and setup.

Introduction

PHP SDK (v1.5.2)

Laravel SDK (v1.2.0)

Node.js SDK (v1.2.0)

Node.js SDK security services

Check VPN, proxy, and IP risk

Response

Check a disposable email address

Response

Handle Security errors

​Check VPN, proxy, and IP risk

​Response

​Check a disposable email address

​Response

​Handle Security errors

Check VPN, proxy, and IP risk

Response

Check a disposable email address

Response

Handle Security errors