PHP SDK security services

Use $avraapi->security() for the two released Security operations. Both methods return an ApiResponse. A false signal means the configured provider did not classify the value for that signal; it is not a standalone allow or block decision.

Every Security operation can use the shared one-request privacy control: $avraapi->security()->withPrivacyMode()->checkVpn('IP_ADDRESS'). It sends X-Privacy-Mode: 1 only for that next request, then clears automatically. Privacy Mode keeps normal routing, billing, and usage tracking while suppressing request and response payload storage.

Check VPN, proxy, and IP risk

checkVpn(string $ip): ApiResponse evaluates one permitted IPv4 or IPv6 address for VPN, proxy, Tor, relay, and hosting signals. SDK function

Copy the SDK call

$response = $avraapi->security()->checkVpn(
    ip: 'IP_ADDRESS',
);

Argument	Use
`ip`	Permitted IPv4 or IPv6 address.

Read IP-risk signals

<?php

// AvraAPI SDK call.
$response = $avraapi->security()->checkVpn('194.195.93.1');

// Your application code.
$riskSignals = [
    'vpn' => $response->data['is_vpn'],
    'proxy' => $response->data['is_proxy'],
    'tor' => $response->data['is_tor'],
    'hosting' => $response->data['is_hosting'],
];
$networkName = $response->data['network_name'];
$requestId = $response->requestId;

Response

{
  "success": true,
  "request_id": "1fa95b0c-f0da-4b07-9b1d-5235aca6ca20",
  "data": {
    "ip_address": "194.195.93.1",
    "is_vpn": true,
    "is_proxy": false,
    "is_tor": false,
    "is_relay": false,
    "is_hosting": true,
    "country_code": "US",
    "city": "San Jose",
    "asn": "AS212238",
    "network_name": "Datacamp Limited",
    "provider_name": "iplocate"
  }
}

Some network fields can be null. Combine the returned signals with your own risk policy and only submit IP addresses that you are permitted to process. For field and error details, read Check VPN, proxy, and IP risk.

Check a disposable email address

checkBurnerEmail(string $email): ApiResponse evaluates one email address for syntax and configured disposable-domain signals. SDK function

Copy the SDK call

$response = $avraapi->security()->checkBurnerEmail(
    email: 'EMAIL_ADDRESS',
);

Argument	Use
`email`	Email address to evaluate.

Use a disposable-email signal

<?php

// AvraAPI SDK call.
$response = $avraapi->security()->checkBurnerEmail('customer@example.com');

// Your application code.
$isDisposable = $response->data['is_disposable'];
$domain = $response->data['domain'];
$matchSource = $response->data['source'];

if ($isDisposable) {
    // Apply your application's registration or recovery policy.
}

Response

{
  "success": true,
  "request_id": "82512122-5a64-459c-a0cb-0ba07be4a600",
  "data": {
    "email": "hodil14324@ellbit.com",
    "domain": "ellbit.com",
    "is_valid_syntax": true,
    "is_disposable": true,
    "source": "custom",
    "execution_time_ms": 5.89
  }
}

is_disposable: false means the configured lists did not contain a matching domain. It does not verify ownership, inbox reachability, or user trust. Process only email addresses you are permitted to use. For the complete contract, see Check a disposable email address.

Handle Security errors

Security methods throw typed SDK exceptions for API failures. Keep $exception->getRequestId() with your support record, avoid exposing provider diagnostics to a browser, and follow the common handling pattern in PHP Overview and setup.

Introduction

PHP SDK (v1.5.2)

Laravel SDK (v1.2.0)

Node.js SDK (v1.2.0)

PHP SDK security services

Check VPN, proxy, and IP risk

Response

Check a disposable email address

Response

Handle Security errors

​Check VPN, proxy, and IP risk

​Response

​Check a disposable email address

​Response

​Handle Security errors

Check VPN, proxy, and IP risk

Response

Check a disposable email address

Response

Handle Security errors