EmailRep · Schema

EmailReputation

Reputation verdict, suspicious flag, references count, and detailed intelligence signal block returned for an email-address query.

SecurityEmailEmail ReputationThreat IntelligencePhishingFraud PreventionAnti-AbuseDeliverabilityRisk ScoringPublic APIs

Properties

Name Type Description
email string The queried email address, echoed back.
reputation string Overall reputation verdict for the address.
suspicious boolean Whether the email should be treated as suspicious or risky.
references integer Total number of positive and negative reputation sources observed for the address or its associated domain. Not all references are direct mentions of the address.
summary string Human-readable summary of the reputation verdict. Returned only when the caller passes `summary=true`.
details object Detailed intelligence signals about the email address and its domain.
View JSON Schema on GitHub

JSON Schema

api-email-reputation-schema.json Raw ↑
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/emailrep/refs/heads/main/json-schema/api-email-reputation-schema.json",
  "title": "EmailReputation",
  "description": "Reputation verdict, suspicious flag, references count, and detailed intelligence signal block returned for an email-address query.",
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email",
      "description": "The queried email address, echoed back.",
      "example": "[email protected]"
    },
    "reputation": {
      "type": "string",
      "description": "Overall reputation verdict for the address.",
      "enum": [
        "high",
        "medium",
        "low",
        "none"
      ],
      "example": "high"
    },
    "suspicious": {
      "type": "boolean",
      "description": "Whether the email should be treated as suspicious or risky.",
      "example": false
    },
    "references": {
      "type": "integer",
      "description": "Total number of positive and negative reputation sources observed for the address or its associated domain. Not all references are direct mentions of the address.",
      "example": 79
    },
    "summary": {
      "type": "string",
      "description": "Human-readable summary of the reputation verdict. Returned only when the caller passes `summary=true`.",
      "example": "high reputation, seen on 8 profiles, found in 1 data breach"
    },
    "details": {
      "type": "object",
      "title": "EmailReputationDetails",
      "description": "Detailed intelligence signals about the email address and its domain.",
      "properties": {
        "blacklisted": {
          "type": "boolean",
          "description": "The email is believed to be malicious or spammy.",
          "example": false
        },
        "malicious_activity": {
          "type": "boolean",
          "description": "The email has exhibited malicious behavior (e.g. phishing or fraud).",
          "example": false
        },
        "malicious_activity_recent": {
          "type": "boolean",
          "description": "Malicious behavior observed within the last 90 days.",
          "example": false
        },
        "credentials_leaked": {
          "type": "boolean",
          "description": "Credentials for the email were leaked at some point (data breach, paste, dark web, etc.).",
          "example": true
        },
        "credentials_leaked_recent": {
          "type": "boolean",
          "description": "Credentials were leaked within the last 90 days.",
          "example": false
        },
        "data_breach": {
          "type": "boolean",
          "description": "The email appeared in a known data breach.",
          "example": true
        },
        "first_seen": {
          "type": "string",
          "description": "First date the email was observed in a breach, credential leak, or exhibiting malicious or spammy behavior. `never` if never seen.",
          "example": "07/01/2008"
        },
        "last_seen": {
          "type": "string",
          "description": "Last date the email was observed in a breach, credential leak, or exhibiting malicious or spammy behavior. `never` if never seen.",
          "example": "05/24/2019"
        },
        "domain_exists": {
          "type": "boolean",
          "description": "Whether the email's domain is a valid, resolvable domain.",
          "example": true
        },
        "domain_reputation": {
          "type": "string",
          "description": "Reputation verdict for the email's domain. `n/a` when the domain is a free provider, disposable, or does not exist.",
          "enum": [
            "high",
            "medium",
            "low",
            "n/a"
          ],
          "example": "high"
        },
        "new_domain": {
          "type": "boolean",
          "description": "The domain was registered within the last year.",
          "example": false
        },
        "days_since_domain_creation": {
          "type": "integer",
          "description": "Days since the domain was created.",
          "example": 10341
        },
        "suspicious_tld": {
          "type": "boolean",
          "description": "The domain uses a top-level domain associated with abuse.",
          "example": false
        },
        "spam": {
          "type": "boolean",
          "description": "The email has exhibited spammy behavior (e.g. spam traps, login form abuse).",
          "example": false
        },
        "free_provider": {
          "type": "boolean",
          "description": "The email uses a free email provider (e.g. Gmail, Yahoo, Outlook).",
          "example": false
        },
        "disposable": {
          "type": "boolean",
          "description": "The email uses a temporary or disposable provider.",
          "example": false
        },
        "deliverable": {
          "type": "boolean",
          "description": "The address is deliverable based on SMTP probes and MX checks.",
          "example": true
        },
        "accept_all": {
          "type": "boolean",
          "description": "The mail server has a default accept-all policy.",
          "example": true
        },
        "valid_mx": {
          "type": "boolean",
          "description": "The domain has a valid MX record.",
          "example": true
        },
        "spoofable": {
          "type": "boolean",
          "description": "The email address can be spoofed (e.g. SPF is not strict or DMARC is not enforced).",
          "example": false
        },
        "spf_strict": {
          "type": "boolean",
          "description": "SPF record is sufficiently strict to prevent spoofing.",
          "example": true
        },
        "dmarc_enforced": {
          "type": "boolean",
          "description": "DMARC is configured correctly and enforced.",
          "example": true
        },
        "profiles": {
          "type": "array",
          "description": "Online profiles where the email has been observed.",
          "items": {
            "type": "string"
          },
          "example": [
            "myspace",
            "spotify",
            "twitter",
            "pinterest",
            "flickr",
            "linkedin",
            "vimeo",
            "angellist"
          ]
        }
      }
    }
  },
  "required": [
    "email",
    "reputation",
    "suspicious",
    "references",
    "details"
  ]
}