Email & Communication Security API Documentation

POSThttps://www.brainiac.software/api/v1/email-security/header-forensics$0.04 USDC

Analyze email headers

Analyze caller-supplied email headers for routing hops and suspicious inconsistencies (From/Return-Path/Reply-To, auth results, dates). Indicators only—not confirmed malice.

Body

Field	Required	Notes
`text`	No	string
`eml`	No	string
`headers`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`emails`	No	array; Array
`attachments`	No	array; Array
`urls`	No	array; Array
`urlHops`	No	array; Array
`brandDomains`	No	array; Array
`companyNames`	No	array; Array
`conversations`	No	array; Array
`authenticationResults`	No	object; Object
`asOf`	No	string
`publicDns`	No	boolean
`followPublicUrls`	No	boolean
`dkimSelectors`	No	array; Array

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "emails": [
    {
      "id": "M1",
      "headers": "From: Alice <alice@example.com>\nReturn-Path: <bounce@mailer.example.net>\nReply-To: help@totally-different.example\nReceived: from mail.example.net by mx.example.com; Tue, 4 Nov 2026 20:00:00 +0000\nAuthentication-Results: mx.example.com; spf=fail; dkim=fail; dmarc=fail\nMessage-ID: <m1@example.com>\nSubject: Invoice\nDate: Tue, 4 Nov 2026 20:00:00 +0000\n",
      "source": "Caller-supplied headers"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "header-forensics-M1",
      "detector": "header-forensics",
      "title": "Suspicious email header inconsistencies",
      "observedFacts": [
        "1 Received hop(s) supplied.",
        "From domain example.com differs from Return-Path domain mailer.example.net.",
        "From domain example.com differs from Reply-To domain totally-different.example.",
        "Authentication-Results report spf=fail, dkim=fail, dmarc=fail."
      ],
      "inferredThreat": "Header inconsistencies can indicate spoofing, diversion, or forged routing metadata.",
      "confidence": "high",
      "reasons": [
        "from_return_path_mismatch",
        "from_reply_to_mismatch",
        "auth_results_fail"
      ],
      "evidence": [
        {
          "subject": "M1",
          "fact": "Received chain length=1",
          "confidence": "high"
        },
        {
          "subject": "M1",
          "fact": "From=example.com; Return-Path=mailer.example.net",
          "inference": "Envelope and header domains differ.",
          "confidence": "medium"
        },
        {
          "subject": "M1",
          "fact": "From=example.com; Reply-To=totally-different.example",
          "inference": "Replies may be diverted.",
          "confidence": "medium"
        },
        {
          "subject": "M1",
          "fact": "spf=fail; dkim=fail; dmarc=fail",
          "inference": "Failed auth results are spoofing indicators, not confirmed compromise.",
          "confidence": "high"
        }
      ],
      "relatedIds": [
        "M1"
      ],
      "source": "Caller-supplied headers",
      "status": "signal",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "emailSent": false,
  "attachmentUploadedExternally": false,
  "confirmedMaliciousClaimed": false,
  "publicDnsQueried": false,
  "publicUrlsFollowed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "header_inconsistency",
      "subject": "M1",
      "detail": "Header forensics found from_return_path_mismatch, from_reply_to_mismatch, auth_results_fail (confirmedMalicious=false)."
    }
  ],
  "limitations": [
    "Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.",
    "No attachment or email content is uploaded to an external malware or sandbox scanning service.",
    "Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.",
    "Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.",
    "Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/email-security/header-forensics" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "emails": [
    {
      "id": "M1",
      "headers": "From: Alice <alice@example.com>\nReturn-Path: <bounce@mailer.example.net>\nReply-To: help@totally-different.example\nReceived: from mail.example.net by mx.example.com; Tue, 4 Nov 2026 20:00:00 +0000\nAuthentication-Results: mx.example.com; spf=fail; dkim=fail; dmarc=fail\nMessage-ID: <m1@example.com>\nSubject: Invoice\nDate: Tue, 4 Nov 2026 20:00:00 +0000\n",
      "source": "Caller-supplied headers"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/email-security/spoofing-detect$0.05 USDC

Detect email spoofing indicators

Detect sender spoofing indicators from supplied SPF/DKIM/DMARC authentication results and optional public DNS TXT evidence. Not a confirmed spoof verdict without multi-signal evidence.

Body

Field	Required	Notes
`text`	No	string
`eml`	No	string
`headers`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`emails`	No	array; Array
`attachments`	No	array; Array
`urls`	No	array; Array
`urlHops`	No	array; Array
`brandDomains`	No	array; Array
`companyNames`	No	array; Array
`conversations`	No	array; Array
`authenticationResults`	No	object; Object
`asOf`	No	string
`publicDns`	No	boolean
`followPublicUrls`	No	boolean
`dkimSelectors`	No	array; Array

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "publicDns": false,
  "emails": [
    {
      "id": "M1",
      "from": "ceo@acme.example",
      "returnPath": "bounce@attacker.example",
      "authenticationResults": {
        "spf": "fail",
        "dkim": "fail",
        "dmarc": "fail",
        "source": "Caller-supplied Authentication-Results"
      },
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "spoofing-M1",
      "detector": "spoofing-detect",
      "title": "Sender spoofing indicators",
      "observedFacts": [
        "Caller/header SPF result=fail.",
        "Caller/header DKIM result=fail.",
        "Caller/header DMARC result=fail.",
        "From domain acme.example != Return-Path domain attacker.example."
      ],
      "inferredThreat": "Authentication failures or missing domain auth records can indicate spoofing.",
      "confidence": "high",
      "reasons": [
        "spf_fail",
        "dkim_fail",
        "dmarc_fail",
        "envelope_from_mismatch"
      ],
      "evidence": [
        {
          "subject": "M1",
          "fact": "Caller/header SPF result=fail. Caller/header DKIM result=fail. Caller/header DMARC result=fail. From domain acme.example != Return-Path domain attacker.example.",
          "inference": "Spoofing indicators only; not confirmed malicious.",
          "confidence": "high"
        }
      ],
      "relatedIds": [
        "M1"
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "emailSent": false,
  "attachmentUploadedExternally": false,
  "confirmedMaliciousClaimed": false,
  "publicDnsQueried": false,
  "publicUrlsFollowed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "spoofing_signal",
      "subject": "M1",
      "detail": "Spoofing indicators: spf_fail, dkim_fail, dmarc_fail, envelope_from_mismatch (confirmedMalicious=false)."
    }
  ],
  "limitations": [
    "Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.",
    "No attachment or email content is uploaded to an external malware or sandbox scanning service.",
    "Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.",
    "Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.",
    "Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/email-security/spoofing-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "publicDns": false,
  "emails": [
    {
      "id": "M1",
      "from": "ceo@acme.example",
      "returnPath": "bounce@attacker.example",
      "authenticationResults": {
        "spf": "fail",
        "dkim": "fail",
        "dmarc": "fail",
        "source": "Caller-supplied Authentication-Results"
      },
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/email-security/phishing-signal-detect$0.04 USDC

Detect phishing signals

Identify phishing indicators in caller-supplied email content and URLs (urgency phrases, lookalike hosts, IP URLs, password forms). Indicators are not confirmed malicious activity.

Body

Field	Required	Notes
`text`	No	string
`eml`	No	string
`headers`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`emails`	No	array; Array
`attachments`	No	array; Array
`urls`	No	array; Array
`urlHops`	No	array; Array
`brandDomains`	No	array; Array
`companyNames`	No	array; Array
`conversations`	No	array; Array
`authenticationResults`	No	object; Object
`asOf`	No	string
`publicDns`	No	boolean
`followPublicUrls`	No	boolean
`dkimSelectors`	No	array; Array

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "brandDomains": [
    "acme.example"
  ],
  "companyNames": [
    "Acme"
  ],
  "emails": [
    {
      "id": "M1",
      "from": "\"Acme Support\" <support@acme-secure.example>",
      "subject": "Urgent action required",
      "bodyText": "Verify your account immediately: http://203.0.113.50/login",
      "urls": [
        "http://203.0.113.50/login"
      ],
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "phishing-M1",
      "detector": "phishing-signal-detect",
      "title": "Phishing indicators in email content/URLs",
      "observedFacts": [
        "Content contains phrase \"verify your account\".",
        "URL uses IP host 203.0.113.50."
      ],
      "inferredThreat": "Content and URL patterns resemble phishing lures.",
      "confidence": "medium",
      "reasons": [
        "phishing_phrase",
        "ip_literal_url"
      ],
      "evidence": [
        {
          "subject": "M1",
          "fact": "Matched phrase: verify your account",
          "inference": "Urgency/credential language is a phishing indicator.",
          "confidence": "medium"
        },
        {
          "subject": "http://203.0.113.50/login",
          "fact": "IP URL http://203.0.113.50/login",
          "confidence": "medium"
        }
      ],
      "relatedIds": [
        "M1"
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "emailSent": false,
  "attachmentUploadedExternally": false,
  "confirmedMaliciousClaimed": false,
  "publicDnsQueried": false,
  "publicUrlsFollowed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "phishing_signal",
      "subject": "M1",
      "detail": "Phishing indicators: phishing_phrase, ip_literal_url (confirmedMalicious=false)."
    }
  ],
  "limitations": [
    "Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.",
    "No attachment or email content is uploaded to an external malware or sandbox scanning service.",
    "Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.",
    "Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.",
    "Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/email-security/phishing-signal-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "brandDomains": [
    "acme.example"
  ],
  "companyNames": [
    "Acme"
  ],
  "emails": [
    {
      "id": "M1",
      "from": "\"Acme Support\" <support@acme-secure.example>",
      "subject": "Urgent action required",
      "bodyText": "Verify your account immediately: http://203.0.113.50/login",
      "urls": [
        "http://203.0.113.50/login"
      ],
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/email-security/bec-pattern-detect$0.05 USDC

Detect BEC patterns

Detect Business Email Compromise patterns such as payment-change language, executive persona cues, external Reply-To, and lookalike sender domains from supplied mail.

Body

Field	Required	Notes
`text`	No	string
`eml`	No	string
`headers`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`emails`	No	array; Array
`attachments`	No	array; Array
`urls`	No	array; Array
`urlHops`	No	array; Array
`brandDomains`	No	array; Array
`companyNames`	No	array; Array
`conversations`	No	array; Array
`authenticationResults`	No	object; Object
`asOf`	No	string
`publicDns`	No	boolean
`followPublicUrls`	No	boolean
`dkimSelectors`	No	array; Array

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "brandDomains": [
    "acme.example"
  ],
  "companyNames": [
    "Acme"
  ],
  "emails": [
    {
      "id": "M1",
      "from": "\"Acme CFO\" <cfo@acme-examp1e.example>",
      "replyTo": "payments@attacker.example",
      "subject": "Urgent payment",
      "bodyText": "Please process a wire transfer today and keep this confidential.",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "bec-M1",
      "detector": "bec-pattern-detect",
      "title": "Business Email Compromise patterns",
      "observedFacts": [
        "Content contains BEC-related phrase \"wire transfer\".",
        "Sender presentation suggests an executive/finance persona (\"acme cfo\"\").",
        "Reply-To domain attacker.example differs from From domain acme-examp1e.example.",
        "Display/company name does not align with supplied brand domains."
      ],
      "inferredThreat": "Payment-change / executive-fraud patterns resemble BEC activity.",
      "confidence": "high",
      "reasons": [
        "bec_phrase",
        "executive_persona",
        "reply_to_external",
        "company_name_untrusted_domain"
      ],
      "evidence": [
        {
          "subject": "M1",
          "fact": "Matched BEC phrase: wire transfer",
          "confidence": "medium"
        },
        {
          "subject": "M1",
          "fact": "From=acme-examp1e.example; Reply-To=attacker.example",
          "inference": "External Reply-To is common in BEC threads.",
          "confidence": "medium"
        }
      ],
      "relatedIds": [
        "M1"
      ],
      "source": "Caller-supplied",
      "status": "signal",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "emailSent": false,
  "attachmentUploadedExternally": false,
  "confirmedMaliciousClaimed": false,
  "publicDnsQueried": false,
  "publicUrlsFollowed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "bec_signal",
      "subject": "M1",
      "detail": "BEC indicators: bec_phrase, executive_persona, reply_to_external, company_name_untrusted_domain (confirmedMalicious=false)."
    }
  ],
  "limitations": [
    "Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.",
    "No attachment or email content is uploaded to an external malware or sandbox scanning service.",
    "Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.",
    "Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.",
    "Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/email-security/bec-pattern-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "brandDomains": [
    "acme.example"
  ],
  "companyNames": [
    "Acme"
  ],
  "emails": [
    {
      "id": "M1",
      "from": "\"Acme CFO\" <cfo@acme-examp1e.example>",
      "replyTo": "payments@attacker.example",
      "subject": "Urgent payment",
      "bodyText": "Please process a wire transfer today and keep this confidential.",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/email-security/domain-impersonation-check$0.03 USDC

Check domain impersonation

Identify domains resembling supplied company or brand domains using edit distance, hyphen variants, homoglyph folding, and brand-token embedding. Resemblance is not proof of abuse.

Body

Field	Required	Notes
`text`	No	string
`eml`	No	string
`headers`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`emails`	No	array; Array
`attachments`	No	array; Array
`urls`	No	array; Array
`urlHops`	No	array; Array
`brandDomains`	No	array; Array
`companyNames`	No	array; Array
`conversations`	No	array; Array
`authenticationResults`	No	object; Object
`asOf`	No	string
`publicDns`	No	boolean
`followPublicUrls`	No	boolean
`dkimSelectors`	No	array; Array

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "brandDomains": [
    "acme.example"
  ],
  "emails": [
    {
      "id": "M1",
      "from": "billing@acme-example.example",
      "urls": [
        "https://acrne.example/login"
      ],
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 2,
  "items": [
    {
      "id": "impersonation-acme-example.example-acme.example",
      "detector": "domain-impersonation-check",
      "title": "Domain resemblance to brand",
      "observedFacts": [
        "Candidate acme-example.example embeds brand token from acme.example."
      ],
      "inferredThreat": "Domain resemblance can indicate impersonation or typosquatting.",
      "confidence": "medium",
      "reasons": [
        "brand_token_embedded"
      ],
      "evidence": [
        {
          "subject": "acme-example.example",
          "fact": "Compared to brand acme.example",
          "inference": "Resemblance only; ownership/malice not confirmed.",
          "confidence": "medium"
        }
      ],
      "relatedIds": [
        "acme-example.example",
        "acme.example"
      ],
      "source": "Caller-supplied domains/URLs; local resemblance rules",
      "status": "signal",
      "confirmedMalicious": false
    },
    {
      "id": "impersonation-acrne.example-acme.example",
      "detector": "domain-impersonation-check",
      "title": "Domain resemblance to brand",
      "observedFacts": [
        "Registrable form acrne.example is edit distance 2 from acme.example."
      ],
      "inferredThreat": "Domain resemblance can indicate impersonation or typosquatting.",
      "confidence": "medium",
      "reasons": [
        "edit_distance"
      ],
      "evidence": [
        {
          "subject": "acrne.example",
          "fact": "Compared to brand acme.example",
          "inference": "Resemblance only; ownership/malice not confirmed.",
          "confidence": "medium"
        }
      ],
      "relatedIds": [
        "acrne.example",
        "acme.example"
      ],
      "source": "Caller-supplied domains/URLs; local resemblance rules",
      "status": "signal",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "emailSent": false,
  "attachmentUploadedExternally": false,
  "confirmedMaliciousClaimed": false,
  "publicDnsQueried": false,
  "publicUrlsFollowed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "domain_impersonation",
      "subject": "acme-example.example",
      "detail": "Resembles acme.example via brand_token_embedded (confirmedMalicious=false)."
    },
    {
      "kind": "conflict",
      "code": "domain_impersonation",
      "subject": "acrne.example",
      "detail": "Resembles acme.example via edit_distance (confirmedMalicious=false)."
    }
  ],
  "limitations": [
    "Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.",
    "No attachment or email content is uploaded to an external malware or sandbox scanning service.",
    "Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.",
    "Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.",
    "Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/email-security/domain-impersonation-check" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "brandDomains": [
    "acme.example"
  ],
  "emails": [
    {
      "id": "M1",
      "from": "billing@acme-example.example",
      "urls": [
        "https://acrne.example/login"
      ],
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/email-security/url-chain-analyze$0.05 USDC

Analyze email URL redirect chains

Analyze caller-supplied redirect hops or optionally follow public URLs with strict SSRF protections. Never sends email content to external scanners.

Body

Field	Required	Notes
`text`	No	string
`eml`	No	string
`headers`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`emails`	No	array; Array
`attachments`	No	array; Array
`urls`	No	array; Array
`urlHops`	No	array; Array
`brandDomains`	No	array; Array
`companyNames`	No	array; Array
`conversations`	No	array; Array
`authenticationResults`	No	object; Object
`asOf`	No	string
`publicDns`	No	boolean
`followPublicUrls`	No	boolean
`dkimSelectors`	No	array; Array

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "followPublicUrls": false,
  "urlHops": [
    {
      "url": "https://track.example/click",
      "status": 302,
      "location": "https://bounce.example/r",
      "source": "Caller-supplied"
    },
    {
      "url": "https://bounce.example/r",
      "status": 302,
      "location": "http://203.0.113.77/final",
      "source": "Caller-supplied"
    },
    {
      "url": "http://203.0.113.77/final",
      "status": 200,
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "chainCount": 1,
  "items": [
    {
      "id": "url-chain-CHAIN-supplied",
      "detector": "url-chain-analyze",
      "title": "Suspicious URL redirect chain",
      "status": "signal",
      "observedFacts": [
        "Chain has 3 hop(s) starting at https://track.example/click.",
        "Hosts traversed: track.example -> bounce.example -> 203.0.113.77."
      ],
      "inferredThreat": "Redirect features can hide the final landing site.",
      "confidence": "high",
      "reasons": [
        "cross_domain_redirect",
        "ip_literal_hop",
        "plaintext_http_hop"
      ],
      "evidence": [
        {
          "subject": "https://track.example/click",
          "fact": "HTTP 302",
          "confidence": "medium"
        },
        {
          "subject": "https://bounce.example/r",
          "fact": "HTTP 302",
          "confidence": "medium"
        },
        {
          "subject": "http://203.0.113.77/final",
          "fact": "HTTP 200",
          "confidence": "medium"
        }
      ],
      "relatedIds": [
        "https://track.example/click",
        "https://bounce.example/r",
        "http://203.0.113.77/final"
      ],
      "source": "Caller-supplied redirect hops",
      "confirmedMalicious": false
    }
  ],
  "chains": [
    {
      "id": "CHAIN-supplied",
      "startUrl": "https://track.example/click",
      "hopCount": 3,
      "hops": [
        {
          "url": "https://track.example/click",
          "status": 302,
          "location": "https://bounce.example/r",
          "detail": "",
          "blocked": false
        },
        {
          "url": "https://bounce.example/r",
          "status": 302,
          "location": "http://203.0.113.77/final",
          "detail": "",
          "blocked": false
        },
        {
          "url": "http://203.0.113.77/final",
          "status": 200,
          "location": "",
          "detail": "",
          "blocked": false
        }
      ],
      "source": "Caller-supplied redirect hops"
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "emailSent": false,
  "attachmentUploadedExternally": false,
  "confirmedMaliciousClaimed": false,
  "publicDnsQueried": false,
  "publicUrlsFollowed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "url_chain",
      "subject": "CHAIN-supplied",
      "detail": "URL chain indicators: cross_domain_redirect, ip_literal_hop, plaintext_http_hop (confirmedMalicious=false)."
    }
  ],
  "limitations": [
    "Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.",
    "No attachment or email content is uploaded to an external malware or sandbox scanning service.",
    "Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.",
    "Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.",
    "Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/email-security/url-chain-analyze" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "followPublicUrls": false,
  "urlHops": [
    {
      "url": "https://track.example/click",
      "status": 302,
      "location": "https://bounce.example/r",
      "source": "Caller-supplied"
    },
    {
      "url": "https://bounce.example/r",
      "status": 302,
      "location": "http://203.0.113.77/final",
      "source": "Caller-supplied"
    },
    {
      "url": "http://203.0.113.77/final",
      "status": 200,
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/email-security/attachment-risk-analyze$0.04 USDC

Analyze email attachment risk

Inspect caller-supplied attachment filenames, metadata, and local magic-byte structures for suspicious patterns. No external sandbox or scanner is used.

Body

Field	Required	Notes
`text`	No	string
`eml`	No	string
`headers`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`emails`	No	array; Array
`attachments`	No	array; Array
`urls`	No	array; Array
`urlHops`	No	array; Array
`brandDomains`	No	array; Array
`companyNames`	No	array; Array
`conversations`	No	array; Array
`authenticationResults`	No	object; Object
`asOf`	No	string
`publicDns`	No	boolean
`followPublicUrls`	No	boolean
`dkimSelectors`	No	array; Array

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "attachments": [
    {
      "id": "A1",
      "filename": "invoice.pdf.exe",
      "mediaType": "application/octet-stream",
      "contentBase64": "TVoAAGZha2UtcGU=",
      "source": "Caller-supplied attachment"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "attachment-A1",
      "detector": "attachment-risk-analyze",
      "title": "Suspicious attachment structure",
      "status": "signal",
      "observedFacts": [
        "Filename=invoice.pdf.exe",
        "SizeBytes=11.",
        "SHA-256=44ff1cf56b6a4fed47a545653985f22d7c4b37cb01b403e51036738a363cae70.",
        "Local magic kind=pe_executable.",
        "Extension .exe is commonly abused.",
        "Double extension pattern detected (pdf.exe).",
        "Bytes begin with MZ (PE executable)."
      ],
      "inferredThreat": "Attachment format/metadata features are associated with malware delivery.",
      "confidence": "high",
      "reasons": [
        "risky_extension",
        "double_extension",
        "pe_magic"
      ],
      "evidence": [
        {
          "subject": "A1",
          "fact": "filename=invoice.pdf.exe; magic=pe_executable; mediaType=application/octet-stream",
          "inference": "Local structural indicators only; not a sandbox detonation result.",
          "confidence": "medium"
        }
      ],
      "relatedIds": [
        "A1"
      ],
      "source": "Caller-supplied attachment",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "emailSent": false,
  "attachmentUploadedExternally": false,
  "confirmedMaliciousClaimed": false,
  "publicDnsQueried": false,
  "publicUrlsFollowed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "attachment_risk",
      "subject": "A1",
      "detail": "Attachment indicators: risky_extension, double_extension, pe_magic (confirmedMalicious=false)."
    }
  ],
  "limitations": [
    "Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.",
    "No attachment or email content is uploaded to an external malware or sandbox scanning service.",
    "Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.",
    "Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.",
    "Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/email-security/attachment-risk-analyze" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "attachments": [
    {
      "id": "A1",
      "filename": "invoice.pdf.exe",
      "mediaType": "application/octet-stream",
      "contentBase64": "TVoAAGZha2UtcGU=",
      "source": "Caller-supplied attachment"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/email-security/conversation-tamper-detect$0.05 USDC

Detect conversation tampering

Identify inconsistencies between supplied email conversation copies (missing messages, body hash mismatches, header field divergence). Export artifacts are distinguished from confirmed tampering.

Body

Field	Required	Notes
`text`	No	string
`eml`	No	string
`headers`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`emails`	No	array; Array
`attachments`	No	array; Array
`urls`	No	array; Array
`urlHops`	No	array; Array
`brandDomains`	No	array; Array
`companyNames`	No	array; Array
`conversations`	No	array; Array
`authenticationResults`	No	object; Object
`asOf`	No	string
`publicDns`	No	boolean
`followPublicUrls`	No	boolean
`dkimSelectors`	No	array; Array

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "conversations": [
    {
      "id": "C1",
      "label": "Mailbox export A",
      "emails": [
        {
          "id": "M1",
          "messageId": "<1@example.com>",
          "from": "a@example.com",
          "subject": "Thread",
          "bodyText": "Please pay invoice 100",
          "date": "2026-11-04T18:00:00.000Z",
          "source": "Copy A"
        }
      ],
      "source": "Caller-supplied"
    },
    {
      "id": "C2",
      "label": "Mailbox export B",
      "emails": [
        {
          "id": "M1b",
          "messageId": "<1@example.com>",
          "from": "a@example.com",
          "subject": "Thread",
          "bodyText": "Please pay invoice 100 to new account",
          "date": "2026-11-04T18:00:00.000Z",
          "source": "Copy B"
        }
      ],
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "comparedCopies": [
    "C1",
    "C2"
  ],
  "items": [
    {
      "id": "tamper-1ef775c7f759",
      "detector": "conversation-tamper-detect",
      "title": "Conversation copy inconsistency",
      "observedFacts": [
        "Subject/body hash differs between copies."
      ],
      "inferredThreat": "Divergent conversation copies can indicate tampering, selective deletion, or export artifacts.",
      "confidence": "high",
      "reasons": [
        "body_hash_mismatch"
      ],
      "evidence": [
        {
          "subject": "<1@example.com>",
          "fact": "hashA=f2e3c4361d40; hashB=33d4f56a17eb",
          "inference": "Content divergence can indicate tampering or divergent exports.",
          "confidence": "high"
        }
      ],
      "relatedIds": [
        "C1",
        "C2"
      ],
      "source": "Caller-supplied vs Caller-supplied",
      "status": "signal",
      "confirmedMalicious": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "externalScannerUsed": false,
  "emailSent": false,
  "attachmentUploadedExternally": false,
  "confirmedMaliciousClaimed": false,
  "publicDnsQueried": false,
  "publicUrlsFollowed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "conversation_tamper",
      "subject": "<1@example.com>",
      "detail": "Conversation inconsistency: body_hash_mismatch (confirmedMalicious=false)."
    }
  ],
  "limitations": [
    "Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.",
    "No attachment or email content is uploaded to an external malware or sandbox scanning service.",
    "Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.",
    "Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.",
    "Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/email-security/conversation-tamper-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "conversations": [
    {
      "id": "C1",
      "label": "Mailbox export A",
      "emails": [
        {
          "id": "M1",
          "messageId": "<1@example.com>",
          "from": "a@example.com",
          "subject": "Thread",
          "bodyText": "Please pay invoice 100",
          "date": "2026-11-04T18:00:00.000Z",
          "source": "Copy A"
        }
      ],
      "source": "Caller-supplied"
    },
    {
      "id": "C2",
      "label": "Mailbox export B",
      "emails": [
        {
          "id": "M1b",
          "messageId": "<1@example.com>",
          "from": "a@example.com",
          "subject": "Thread",
          "bodyText": "Please pay invoice 100 to new account",
          "date": "2026-11-04T18:00:00.000Z",
          "source": "Copy B"
        }
      ],
      "source": "Caller-supplied"
    }
  ]
}
JSON