> ## Documentation Index
> Fetch the complete documentation index at: https://docs.avraapi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Node.js SDK security services

> Use the AvraAPI Node.js SDK to check IP-risk signals and disposable-email signals.

Use `avraapi.security()` for the two released Security operations. Both are
async `ApiResponse` calls. A `false` signal means the configured provider did
not classify that signal; it is not an allow or block decision by itself.

<Note>
  Every Security operation supports the shared one-request privacy control:
  `avraapi.security().withPrivacyMode().checkVpn({ ip: 'IP_ADDRESS' })`.
  It sends `X-Privacy-Mode: 1` for that request only, then clears.
</Note>

## Check VPN, proxy, and IP risk

`checkVpn({ ip }): Promise<ApiResponse>` evaluates one permitted IPv4 or IPv6
address for VPN, proxy, Tor, relay, and hosting signals.

**SDK function**

```ts title="Copy the SDK call" theme={null}
const response = await avraapi.security().checkVpn({
  ip: 'IP_ADDRESS',
});
```

| Field | Use |
| - | - |
| `ip` | Permitted IPv4 or IPv6 address. |

```ts title="Read IP-risk signals" theme={null}
import type { VpnShieldData } from '@avraapi/node-sdk';

// AvraAPI SDK call.
const response = await avraapi.security().checkVpn({
  ip: '194.195.93.1',
});

// Your application code.
const data = response.data as VpnShieldData;
const riskSignals = {
  vpn: data.is_vpn,
  proxy: data.is_proxy,
  tor: data.is_tor,
  hosting: data.is_hosting,
};
const requestId = response.requestId;
```

### Response

```json theme={null}
{
  "success": true,
  "request_id": "1fa95b0c-f0da-4b07-9b1d-5235aca6ca20",
  "data": {
    "ip_address": "194.195.93.1",
    "is_vpn": true,
    "is_proxy": false,
    "is_tor": false,
    "is_relay": false,
    "is_hosting": true,
    "country_code": "US",
    "city": "San Jose",
    "asn": "AS212238",
    "network_name": "Datacamp Limited",
    "provider_name": "iplocate"
  }
}
```

Some network fields can be `null`. Combine the signals with your own risk
policy and process only IP addresses you are permitted to use. Read the
[Security REST API Reference](/api-reference/security/vpn-shield) for field and
error details.

## Check a disposable email address

`checkBurnerEmail({ email }): Promise<ApiResponse>` evaluates one email
address for syntax and configured disposable-domain signals.

**SDK function**

```ts title="Copy the SDK call" theme={null}
const response = await avraapi.security().checkBurnerEmail({
  email: 'EMAIL_ADDRESS',
});
```

| Field | Use |
| - | - |
| `email` | Email address to evaluate. |

```ts title="Use a disposable-email signal" theme={null}
import type { BurnerEmailData } from '@avraapi/node-sdk';

// AvraAPI SDK call.
const response = await avraapi.security().checkBurnerEmail({
  email: 'customer@example.com',
});

// Your application code.
const data = response.data as BurnerEmailData;
if (data.is_disposable) {
  // Apply your application's registration or recovery policy.
}
```

### Response

```json theme={null}
{
  "success": true,
  "request_id": "82512122-5a64-459c-a0cb-0ba07be4a600",
  "data": {
    "email": "hodil14324@ellbit.com",
    "domain": "ellbit.com",
    "is_valid_syntax": true,
    "is_disposable": true,
    "source": "custom",
    "execution_time_ms": 5.89
  }
}
```

`is_disposable: false` means configured lists did not contain a matching
domain. It does not verify ownership, inbox reachability, or user trust.

## Handle Security errors

Security calls reject with typed SDK errors. Keep `error.requestId` in backend
support records, never expose provider diagnostics to a browser, and follow
the common pattern in [Node.js Overview and setup](/sdk/nodejs/overview-and-setup#handle-errors-safely).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.