{"openapi":"3.1.0","info":{"title":"Email & Communication Security API","version":"1.0.0","description":"Analyze email headers, detect spoofing and phishing signals, surface BEC patterns, check brand-domain impersonation, analyze URL redirect chains, inspect attachment risk structures, and compare conversation copies—using caller-supplied EML/headers/attachments plus optional public DNS and SSRF-safe URL follows. Paid with x402 exact USDC on Base. No account is required.","contact":{"email":"support@brainiac.software"},"x-guidance":"BRAINIAC.software is a pay-per-call API for software agents. No account or API key is required.\nPayment uses the x402 protocol with exact USDC on Base (chain id 8453). Each POST operation has a fixed USD price.\nHow to call an operation:\n1. POST a JSON body matching the operation's requestBody schema to the operation path. Include an Idempotency-Key header (64 hex characters, 32 random bytes).\n2. If you have not paid, the server responds 402 with payment requirements in the body. Pay the exact amount to the payTo address on Base.\n3. Retry the identical request with the same Idempotency-Key and add a payment-signature header containing the x402 payment payload. On success (200) the operation result is returned.\n4. Reuse the same Idempotency-Key only for retries of the same operation and request body; it will not be charged twice.\nAll outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Verify time-sensitive or official data with the cited source before acting."},"servers":[{"url":"https://www.brainiac.software"}],"paths":{"/api/v1/email-security/header-forensics":{"post":{"operationId":"analyze_email_headers","summary":"Analyze email headers","description":"Analyze caller-supplied email headers for routing hops and suspicious inconsistencies (From/Return-Path/Reply-To, auth results, dates). Indicators only—not confirmed malice.","tags":["email-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":500000},"eml":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"emails":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"attachments":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"urls":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":2000}},"urlHops":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"url":{"type":"string","minLength":1,"maxLength":2000},"status":{"type":"number","minimum":0,"maximum":999},"location":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"required":["url"],"additionalProperties":false}},"brandDomains":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":253}},"companyNames":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":200}},"conversations":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"label":{"type":"string","maxLength":120},"emails":{"minItems":1,"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"required":["emails"],"additionalProperties":false}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"asOf":{"type":"string","maxLength":40},"publicDns":{"type":"boolean"},"followPublicUrls":{"type":"boolean"},"dkimSelectors":{"maxItems":6,"type":"array","items":{"type":"string","minLength":1,"maxLength":63}}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","emails":[{"id":"M1","headers":"From: Alice <alice@example.com>\nReturn-Path: <bounce@mailer.example.net>\nReply-To: help@totally-different.example\nReceived: from mail.example.net by mx.example.com; Tue, 4 Nov 2026 20:00:00 +0000\nAuthentication-Results: mx.example.com; spf=fail; dkim=fail; dmarc=fail\nMessage-ID: <m1@example.com>\nSubject: Invoice\nDate: Tue, 4 Nov 2026 20:00:00 +0000\n","source":"Caller-supplied headers"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"relatedIds":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"emailSent":{"type":"boolean"},"attachmentUploadedExternally":{"type":"boolean"},"confirmedMaliciousClaimed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"publicUrlsFollowed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"header-forensics-M1","detector":"header-forensics","title":"Suspicious email header inconsistencies","observedFacts":["1 Received hop(s) supplied.","From domain example.com differs from Return-Path domain mailer.example.net.","From domain example.com differs from Reply-To domain totally-different.example.","Authentication-Results report spf=fail, dkim=fail, dmarc=fail."],"inferredThreat":"Header inconsistencies can indicate spoofing, diversion, or forged routing metadata.","confidence":"high","reasons":["from_return_path_mismatch","from_reply_to_mismatch","auth_results_fail"],"evidence":[{"subject":"M1","fact":"Received chain length=1","confidence":"high"},{"subject":"M1","fact":"From=example.com; Return-Path=mailer.example.net","inference":"Envelope and header domains differ.","confidence":"medium"},{"subject":"M1","fact":"From=example.com; Reply-To=totally-different.example","inference":"Replies may be diverted.","confidence":"medium"},{"subject":"M1","fact":"spf=fail; dkim=fail; dmarc=fail","inference":"Failed auth results are spoofing indicators, not confirmed compromise.","confidence":"high"}],"relatedIds":["M1"],"source":"Caller-supplied headers","status":"signal","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"emailSent":false,"attachmentUploadedExternally":false,"confirmedMaliciousClaimed":false,"publicDnsQueried":false,"publicUrlsFollowed":false,"findings":[{"kind":"conflict","code":"header_inconsistency","subject":"M1","detail":"Header forensics found from_return_path_mismatch, from_reply_to_mismatch, auth_results_fail (confirmedMalicious=false)."}],"limitations":["Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.","No attachment or email content is uploaded to an external malware or sandbox scanning service.","Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.","Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.","Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/email-security/spoofing-detect":{"post":{"operationId":"detect_email_spoofing_indicators","summary":"Detect email spoofing indicators","description":"Detect sender spoofing indicators from supplied SPF/DKIM/DMARC authentication results and optional public DNS TXT evidence. Not a confirmed spoof verdict without multi-signal evidence.","tags":["email-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":500000},"eml":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"emails":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"attachments":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"urls":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":2000}},"urlHops":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"url":{"type":"string","minLength":1,"maxLength":2000},"status":{"type":"number","minimum":0,"maximum":999},"location":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"required":["url"],"additionalProperties":false}},"brandDomains":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":253}},"companyNames":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":200}},"conversations":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"label":{"type":"string","maxLength":120},"emails":{"minItems":1,"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"required":["emails"],"additionalProperties":false}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"asOf":{"type":"string","maxLength":40},"publicDns":{"type":"boolean"},"followPublicUrls":{"type":"boolean"},"dkimSelectors":{"maxItems":6,"type":"array","items":{"type":"string","minLength":1,"maxLength":63}}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","publicDns":false,"emails":[{"id":"M1","from":"ceo@acme.example","returnPath":"bounce@attacker.example","authenticationResults":{"spf":"fail","dkim":"fail","dmarc":"fail","source":"Caller-supplied Authentication-Results"},"source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"relatedIds":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"emailSent":{"type":"boolean"},"attachmentUploadedExternally":{"type":"boolean"},"confirmedMaliciousClaimed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"publicUrlsFollowed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"spoofing-M1","detector":"spoofing-detect","title":"Sender spoofing indicators","observedFacts":["Caller/header SPF result=fail.","Caller/header DKIM result=fail.","Caller/header DMARC result=fail.","From domain acme.example != Return-Path domain attacker.example."],"inferredThreat":"Authentication failures or missing domain auth records can indicate spoofing.","confidence":"high","reasons":["spf_fail","dkim_fail","dmarc_fail","envelope_from_mismatch"],"evidence":[{"subject":"M1","fact":"Caller/header SPF result=fail. Caller/header DKIM result=fail. Caller/header DMARC result=fail. From domain acme.example != Return-Path domain attacker.example.","inference":"Spoofing indicators only; not confirmed malicious.","confidence":"high"}],"relatedIds":["M1"],"source":"Caller-supplied","status":"signal","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"emailSent":false,"attachmentUploadedExternally":false,"confirmedMaliciousClaimed":false,"publicDnsQueried":false,"publicUrlsFollowed":false,"findings":[{"kind":"conflict","code":"spoofing_signal","subject":"M1","detail":"Spoofing indicators: spf_fail, dkim_fail, dmarc_fail, envelope_from_mismatch (confirmedMalicious=false)."}],"limitations":["Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.","No attachment or email content is uploaded to an external malware or sandbox scanning service.","Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.","Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.","Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/email-security/phishing-signal-detect":{"post":{"operationId":"detect_phishing_signals","summary":"Detect phishing signals","description":"Identify phishing indicators in caller-supplied email content and URLs (urgency phrases, lookalike hosts, IP URLs, password forms). Indicators are not confirmed malicious activity.","tags":["email-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":500000},"eml":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"emails":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"attachments":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"urls":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":2000}},"urlHops":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"url":{"type":"string","minLength":1,"maxLength":2000},"status":{"type":"number","minimum":0,"maximum":999},"location":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"required":["url"],"additionalProperties":false}},"brandDomains":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":253}},"companyNames":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":200}},"conversations":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"label":{"type":"string","maxLength":120},"emails":{"minItems":1,"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"required":["emails"],"additionalProperties":false}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"asOf":{"type":"string","maxLength":40},"publicDns":{"type":"boolean"},"followPublicUrls":{"type":"boolean"},"dkimSelectors":{"maxItems":6,"type":"array","items":{"type":"string","minLength":1,"maxLength":63}}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","brandDomains":["acme.example"],"companyNames":["Acme"],"emails":[{"id":"M1","from":"\"Acme Support\" <support@acme-secure.example>","subject":"Urgent action required","bodyText":"Verify your account immediately: http://203.0.113.50/login","urls":["http://203.0.113.50/login"],"source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"relatedIds":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"emailSent":{"type":"boolean"},"attachmentUploadedExternally":{"type":"boolean"},"confirmedMaliciousClaimed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"publicUrlsFollowed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"phishing-M1","detector":"phishing-signal-detect","title":"Phishing indicators in email content/URLs","observedFacts":["Content contains phrase \"verify your account\".","URL uses IP host 203.0.113.50."],"inferredThreat":"Content and URL patterns resemble phishing lures.","confidence":"medium","reasons":["phishing_phrase","ip_literal_url"],"evidence":[{"subject":"M1","fact":"Matched phrase: verify your account","inference":"Urgency/credential language is a phishing indicator.","confidence":"medium"},{"subject":"http://203.0.113.50/login","fact":"IP URL http://203.0.113.50/login","confidence":"medium"}],"relatedIds":["M1"],"source":"Caller-supplied","status":"signal","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"emailSent":false,"attachmentUploadedExternally":false,"confirmedMaliciousClaimed":false,"publicDnsQueried":false,"publicUrlsFollowed":false,"findings":[{"kind":"conflict","code":"phishing_signal","subject":"M1","detail":"Phishing indicators: phishing_phrase, ip_literal_url (confirmedMalicious=false)."}],"limitations":["Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.","No attachment or email content is uploaded to an external malware or sandbox scanning service.","Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.","Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.","Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/email-security/bec-pattern-detect":{"post":{"operationId":"detect_bec_patterns","summary":"Detect BEC patterns","description":"Detect Business Email Compromise patterns such as payment-change language, executive persona cues, external Reply-To, and lookalike sender domains from supplied mail.","tags":["email-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":500000},"eml":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"emails":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"attachments":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"urls":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":2000}},"urlHops":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"url":{"type":"string","minLength":1,"maxLength":2000},"status":{"type":"number","minimum":0,"maximum":999},"location":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"required":["url"],"additionalProperties":false}},"brandDomains":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":253}},"companyNames":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":200}},"conversations":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"label":{"type":"string","maxLength":120},"emails":{"minItems":1,"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"required":["emails"],"additionalProperties":false}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"asOf":{"type":"string","maxLength":40},"publicDns":{"type":"boolean"},"followPublicUrls":{"type":"boolean"},"dkimSelectors":{"maxItems":6,"type":"array","items":{"type":"string","minLength":1,"maxLength":63}}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","brandDomains":["acme.example"],"companyNames":["Acme"],"emails":[{"id":"M1","from":"\"Acme CFO\" <cfo@acme-examp1e.example>","replyTo":"payments@attacker.example","subject":"Urgent payment","bodyText":"Please process a wire transfer today and keep this confidential.","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"relatedIds":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"emailSent":{"type":"boolean"},"attachmentUploadedExternally":{"type":"boolean"},"confirmedMaliciousClaimed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"publicUrlsFollowed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"bec-M1","detector":"bec-pattern-detect","title":"Business Email Compromise patterns","observedFacts":["Content contains BEC-related phrase \"wire transfer\".","Sender presentation suggests an executive/finance persona (\"acme cfo\"\").","Reply-To domain attacker.example differs from From domain acme-examp1e.example.","Display/company name does not align with supplied brand domains."],"inferredThreat":"Payment-change / executive-fraud patterns resemble BEC activity.","confidence":"high","reasons":["bec_phrase","executive_persona","reply_to_external","company_name_untrusted_domain"],"evidence":[{"subject":"M1","fact":"Matched BEC phrase: wire transfer","confidence":"medium"},{"subject":"M1","fact":"From=acme-examp1e.example; Reply-To=attacker.example","inference":"External Reply-To is common in BEC threads.","confidence":"medium"}],"relatedIds":["M1"],"source":"Caller-supplied","status":"signal","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"emailSent":false,"attachmentUploadedExternally":false,"confirmedMaliciousClaimed":false,"publicDnsQueried":false,"publicUrlsFollowed":false,"findings":[{"kind":"conflict","code":"bec_signal","subject":"M1","detail":"BEC indicators: bec_phrase, executive_persona, reply_to_external, company_name_untrusted_domain (confirmedMalicious=false)."}],"limitations":["Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.","No attachment or email content is uploaded to an external malware or sandbox scanning service.","Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.","Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.","Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/email-security/domain-impersonation-check":{"post":{"operationId":"check_domain_impersonation","summary":"Check domain impersonation","description":"Identify domains resembling supplied company or brand domains using edit distance, hyphen variants, homoglyph folding, and brand-token embedding. Resemblance is not proof of abuse.","tags":["email-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":500000},"eml":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"emails":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"attachments":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"urls":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":2000}},"urlHops":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"url":{"type":"string","minLength":1,"maxLength":2000},"status":{"type":"number","minimum":0,"maximum":999},"location":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"required":["url"],"additionalProperties":false}},"brandDomains":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":253}},"companyNames":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":200}},"conversations":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"label":{"type":"string","maxLength":120},"emails":{"minItems":1,"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"required":["emails"],"additionalProperties":false}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"asOf":{"type":"string","maxLength":40},"publicDns":{"type":"boolean"},"followPublicUrls":{"type":"boolean"},"dkimSelectors":{"maxItems":6,"type":"array","items":{"type":"string","minLength":1,"maxLength":63}}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","brandDomains":["acme.example"],"emails":[{"id":"M1","from":"billing@acme-example.example","urls":["https://acrne.example/login"],"source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"relatedIds":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"emailSent":{"type":"boolean"},"attachmentUploadedExternally":{"type":"boolean"},"confirmedMaliciousClaimed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"publicUrlsFollowed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":2,"items":[{"id":"impersonation-acme-example.example-acme.example","detector":"domain-impersonation-check","title":"Domain resemblance to brand","observedFacts":["Candidate acme-example.example embeds brand token from acme.example."],"inferredThreat":"Domain resemblance can indicate impersonation or typosquatting.","confidence":"medium","reasons":["brand_token_embedded"],"evidence":[{"subject":"acme-example.example","fact":"Compared to brand acme.example","inference":"Resemblance only; ownership/malice not confirmed.","confidence":"medium"}],"relatedIds":["acme-example.example","acme.example"],"source":"Caller-supplied domains/URLs; local resemblance rules","status":"signal","confirmedMalicious":false},{"id":"impersonation-acrne.example-acme.example","detector":"domain-impersonation-check","title":"Domain resemblance to brand","observedFacts":["Registrable form acrne.example is edit distance 2 from acme.example."],"inferredThreat":"Domain resemblance can indicate impersonation or typosquatting.","confidence":"medium","reasons":["edit_distance"],"evidence":[{"subject":"acrne.example","fact":"Compared to brand acme.example","inference":"Resemblance only; ownership/malice not confirmed.","confidence":"medium"}],"relatedIds":["acrne.example","acme.example"],"source":"Caller-supplied domains/URLs; local resemblance rules","status":"signal","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"emailSent":false,"attachmentUploadedExternally":false,"confirmedMaliciousClaimed":false,"publicDnsQueried":false,"publicUrlsFollowed":false,"findings":[{"kind":"conflict","code":"domain_impersonation","subject":"acme-example.example","detail":"Resembles acme.example via brand_token_embedded (confirmedMalicious=false)."},{"kind":"conflict","code":"domain_impersonation","subject":"acrne.example","detail":"Resembles acme.example via edit_distance (confirmedMalicious=false)."}],"limitations":["Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.","No attachment or email content is uploaded to an external malware or sandbox scanning service.","Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.","Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.","Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.03"},"protocols":[{"x402":{}}]}}},"/api/v1/email-security/url-chain-analyze":{"post":{"operationId":"analyze_email_url_redirect_chains","summary":"Analyze email URL redirect chains","description":"Analyze caller-supplied redirect hops or optionally follow public URLs with strict SSRF protections. Never sends email content to external scanners.","tags":["email-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":500000},"eml":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"emails":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"attachments":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"urls":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":2000}},"urlHops":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"url":{"type":"string","minLength":1,"maxLength":2000},"status":{"type":"number","minimum":0,"maximum":999},"location":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"required":["url"],"additionalProperties":false}},"brandDomains":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":253}},"companyNames":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":200}},"conversations":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"label":{"type":"string","maxLength":120},"emails":{"minItems":1,"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"required":["emails"],"additionalProperties":false}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"asOf":{"type":"string","maxLength":40},"publicDns":{"type":"boolean"},"followPublicUrls":{"type":"boolean"},"dkimSelectors":{"maxItems":6,"type":"array","items":{"type":"string","minLength":1,"maxLength":63}}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","followPublicUrls":false,"urlHops":[{"url":"https://track.example/click","status":302,"location":"https://bounce.example/r","source":"Caller-supplied"},{"url":"https://bounce.example/r","status":302,"location":"http://203.0.113.77/final","source":"Caller-supplied"},{"url":"http://203.0.113.77/final","status":200,"source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"chainCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"relatedIds":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"chains":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"startUrl":{"type":"string"},"hopCount":{"type":"number"},"hops":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string"},"status":{"type":"number"},"location":{"type":"string"},"detail":{"type":"string"},"blocked":{"type":"boolean"}},"additionalProperties":true}},"source":{"type":"string"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"emailSent":{"type":"boolean"},"attachmentUploadedExternally":{"type":"boolean"},"confirmedMaliciousClaimed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"publicUrlsFollowed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","chainCount":1,"items":[{"id":"url-chain-CHAIN-supplied","detector":"url-chain-analyze","title":"Suspicious URL redirect chain","status":"signal","observedFacts":["Chain has 3 hop(s) starting at https://track.example/click.","Hosts traversed: track.example -> bounce.example -> 203.0.113.77."],"inferredThreat":"Redirect features can hide the final landing site.","confidence":"high","reasons":["cross_domain_redirect","ip_literal_hop","plaintext_http_hop"],"evidence":[{"subject":"https://track.example/click","fact":"HTTP 302","confidence":"medium"},{"subject":"https://bounce.example/r","fact":"HTTP 302","confidence":"medium"},{"subject":"http://203.0.113.77/final","fact":"HTTP 200","confidence":"medium"}],"relatedIds":["https://track.example/click","https://bounce.example/r","http://203.0.113.77/final"],"source":"Caller-supplied redirect hops","confirmedMalicious":false}],"chains":[{"id":"CHAIN-supplied","startUrl":"https://track.example/click","hopCount":3,"hops":[{"url":"https://track.example/click","status":302,"location":"https://bounce.example/r","detail":"","blocked":false},{"url":"https://bounce.example/r","status":302,"location":"http://203.0.113.77/final","detail":"","blocked":false},{"url":"http://203.0.113.77/final","status":200,"location":"","detail":"","blocked":false}],"source":"Caller-supplied redirect hops"}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"emailSent":false,"attachmentUploadedExternally":false,"confirmedMaliciousClaimed":false,"publicDnsQueried":false,"publicUrlsFollowed":false,"findings":[{"kind":"conflict","code":"url_chain","subject":"CHAIN-supplied","detail":"URL chain indicators: cross_domain_redirect, ip_literal_hop, plaintext_http_hop (confirmedMalicious=false)."}],"limitations":["Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.","No attachment or email content is uploaded to an external malware or sandbox scanning service.","Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.","Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.","Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/email-security/attachment-risk-analyze":{"post":{"operationId":"analyze_email_attachment_risk","summary":"Analyze email attachment risk","description":"Inspect caller-supplied attachment filenames, metadata, and local magic-byte structures for suspicious patterns. No external sandbox or scanner is used.","tags":["email-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":500000},"eml":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"emails":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"attachments":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"urls":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":2000}},"urlHops":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"url":{"type":"string","minLength":1,"maxLength":2000},"status":{"type":"number","minimum":0,"maximum":999},"location":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"required":["url"],"additionalProperties":false}},"brandDomains":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":253}},"companyNames":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":200}},"conversations":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"label":{"type":"string","maxLength":120},"emails":{"minItems":1,"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"required":["emails"],"additionalProperties":false}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"asOf":{"type":"string","maxLength":40},"publicDns":{"type":"boolean"},"followPublicUrls":{"type":"boolean"},"dkimSelectors":{"maxItems":6,"type":"array","items":{"type":"string","minLength":1,"maxLength":63}}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","attachments":[{"id":"A1","filename":"invoice.pdf.exe","mediaType":"application/octet-stream","contentBase64":"TVoAAGZha2UtcGU=","source":"Caller-supplied attachment"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"relatedIds":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"emailSent":{"type":"boolean"},"attachmentUploadedExternally":{"type":"boolean"},"confirmedMaliciousClaimed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"publicUrlsFollowed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"attachment-A1","detector":"attachment-risk-analyze","title":"Suspicious attachment structure","status":"signal","observedFacts":["Filename=invoice.pdf.exe","SizeBytes=11.","SHA-256=44ff1cf56b6a4fed47a545653985f22d7c4b37cb01b403e51036738a363cae70.","Local magic kind=pe_executable.","Extension .exe is commonly abused.","Double extension pattern detected (pdf.exe).","Bytes begin with MZ (PE executable)."],"inferredThreat":"Attachment format/metadata features are associated with malware delivery.","confidence":"high","reasons":["risky_extension","double_extension","pe_magic"],"evidence":[{"subject":"A1","fact":"filename=invoice.pdf.exe; magic=pe_executable; mediaType=application/octet-stream","inference":"Local structural indicators only; not a sandbox detonation result.","confidence":"medium"}],"relatedIds":["A1"],"source":"Caller-supplied attachment","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"emailSent":false,"attachmentUploadedExternally":false,"confirmedMaliciousClaimed":false,"publicDnsQueried":false,"publicUrlsFollowed":false,"findings":[{"kind":"conflict","code":"attachment_risk","subject":"A1","detail":"Attachment indicators: risky_extension, double_extension, pe_magic (confirmedMalicious=false)."}],"limitations":["Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.","No attachment or email content is uploaded to an external malware or sandbox scanning service.","Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.","Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.","Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/email-security/conversation-tamper-detect":{"post":{"operationId":"detect_conversation_tampering","summary":"Detect conversation tampering","description":"Identify inconsistencies between supplied email conversation copies (missing messages, body hash mismatches, header field divergence). Export artifacts are distinguished from confirmed tampering.","tags":["email-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":500000},"eml":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","message/rfc822","text/csv","application/json","application/octet-stream","application/pdf","application/zip"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"emails":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"attachments":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"urls":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":2000}},"urlHops":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"url":{"type":"string","minLength":1,"maxLength":2000},"status":{"type":"number","minimum":0,"maximum":999},"location":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"required":["url"],"additionalProperties":false}},"brandDomains":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":253}},"companyNames":{"maxItems":50,"type":"array","items":{"type":"string","maxLength":200}},"conversations":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"label":{"type":"string","maxLength":120},"emails":{"minItems":1,"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"raw":{"type":"string","maxLength":500000},"headers":{"type":"string","maxLength":200000},"from":{"type":"string","maxLength":500},"to":{"type":"string","maxLength":2000},"cc":{"type":"string","maxLength":2000},"replyTo":{"type":"string","maxLength":500},"returnPath":{"type":"string","maxLength":500},"subject":{"type":"string","maxLength":998},"date":{"type":"string","maxLength":80},"messageId":{"type":"string","maxLength":300},"inReplyTo":{"type":"string","maxLength":300},"references":{"type":"string","maxLength":4000},"bodyText":{"type":"string","maxLength":200000},"bodyHtml":{"type":"string","maxLength":200000},"urls":{"maxItems":200,"type":"array","items":{"type":"string","maxLength":2000}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"attachments":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","maxLength":260},"mediaType":{"type":"string","maxLength":120},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"contentBase64":{"type":"string","maxLength":12000000},"sha256":{"type":"string","maxLength":128},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"source":{"type":"string","maxLength":200}},"required":["emails"],"additionalProperties":false}},"authenticationResults":{"type":"object","properties":{"spf":{"type":"string","enum":["pass","fail","softfail","neutral","none","temperror","permerror","unknown"]},"dkim":{"type":"string","enum":["pass","fail","neutral","none","temperror","permerror","unknown"]},"dmarc":{"type":"string","enum":["pass","fail","none","temperror","permerror","unknown"]},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"asOf":{"type":"string","maxLength":40},"publicDns":{"type":"boolean"},"followPublicUrls":{"type":"boolean"},"dkimSelectors":{"maxItems":6,"type":"array","items":{"type":"string","minLength":1,"maxLength":63}}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","conversations":[{"id":"C1","label":"Mailbox export A","emails":[{"id":"M1","messageId":"<1@example.com>","from":"a@example.com","subject":"Thread","bodyText":"Please pay invoice 100","date":"2026-11-04T18:00:00.000Z","source":"Copy A"}],"source":"Caller-supplied"},{"id":"C2","label":"Mailbox export B","emails":[{"id":"M1b","messageId":"<1@example.com>","from":"a@example.com","subject":"Thread","bodyText":"Please pay invoice 100 to new account","date":"2026-11-04T18:00:00.000Z","source":"Copy B"}],"source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"comparedCopies":{"type":"array","items":{"type":"string"}},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"relatedIds":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"emailSent":{"type":"boolean"},"attachmentUploadedExternally":{"type":"boolean"},"confirmedMaliciousClaimed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"publicUrlsFollowed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"comparedCopies":["C1","C2"],"items":[{"id":"tamper-1ef775c7f759","detector":"conversation-tamper-detect","title":"Conversation copy inconsistency","observedFacts":["Subject/body hash differs between copies."],"inferredThreat":"Divergent conversation copies can indicate tampering, selective deletion, or export artifacts.","confidence":"high","reasons":["body_hash_mismatch"],"evidence":[{"subject":"<1@example.com>","fact":"hashA=f2e3c4361d40; hashB=33d4f56a17eb","inference":"Content divergence can indicate tampering or divergent exports.","confidence":"high"}],"relatedIds":["C1","C2"],"source":"Caller-supplied vs Caller-supplied","status":"signal","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"emailSent":false,"attachmentUploadedExternally":false,"confirmedMaliciousClaimed":false,"publicDnsQueried":false,"publicUrlsFollowed":false,"findings":[{"kind":"conflict","code":"conversation_tamper","subject":"<1@example.com>","detail":"Conversation inconsistency: body_hash_mismatch (confirmedMalicious=false)."}],"limitations":["Raw email, EML, headers, attachments, URLs, and conversation copies are copied only from caller-supplied fields. Mailboxes are never logged into and messages are never sent.","No attachment or email content is uploaded to an external malware or sandbox scanning service.","Observed facts are separated from inferred threat hypotheses. Indicators are not labeled confirmed malicious without sufficient multi-signal evidence.","Optional public DNS reads SPF/DKIM/DMARC TXT for public names only. Optional URL inspection follows redirects with SSRF protections and never targets private addresses.","Local parsing uses explainable header/content/attachment rules. Missing authentication or DNS evidence is reported as missing, not invented."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}}},"components":{"schemas":{"ApiError":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"details":{}}}}}}}}