---
title: "Investigate a matter: what the registry and the links say"
method: GET
path: "/api/assistant/work-items/{id}/investigate"
tags: ["Mailzero Assistant"]
---

# Investigate a matter: what the registry and the links say

`GET /api/assistant/work-items/{id}/investigate`

## Request

- Base URL: `https://domani.run`
- URL: `https://domani.run/api/assistant/work-items/{id}/investigate`
- Auth: HTTP bearer

Reads, at that instant, the facts public infrastructure holds about the sender's domain (its registration date and registrar, its SPF and DMARC posture, whether it receives mail), where every link of the source message really goes (the redirects followed one hop at a time, the final host and its domain's facts), and what each attachment really is (its first bytes against the name and the declared type). Answers the dossier with the signals the facts add (a domain registered days ago, a link that lands elsewhere, a sender's domain that protects nothing, a program named as a document). No vendor, no account, nothing stored; a lookup that fails is a fact of its own.

## Path parameters

- `id` string, required

## Response `200`

The dossier

- AssistantTrustDossier
  - `work_item_id` string
  - `source` 'message' | 'sender_only': Whether the source message was read, or only the sender's address.
  - `checked_at` string
  - `sender` object
    - `address` string
    - `domain` string, nullable
    - `facts` AssistantDomainFacts: What public infrastructure holds about a domain: the registry's date and registrar, the resolver's SPF, DMARC and MX.
      - `domain` string
      - `registered_at` string, nullable
      - `age_days` integer, nullable
      - `registrar` string, nullable
      - `spf` 'present' | 'absent' | 'unknown'
      - `dmarc` 'reject' | 'quarantine' | 'none' | 'absent' | 'unknown'
      - `mx` 'present' | 'absent' | 'unknown'
      - `notes` string[]
  - `links` object[]
    - `href` string
    - `host` string, nullable
    - `final_url` string, nullable
    - `hops` integer
    - `final_host` string, nullable
    - `domain` AssistantDomainFacts: What public infrastructure holds about a domain: the registry's date and registrar, the resolver's SPF, DMARC and MX.
      - `domain` string
      - `registered_at` string, nullable
      - `age_days` integer, nullable
      - `registrar` string, nullable
      - `spf` 'present' | 'absent' | 'unknown'
      - `dmarc` 'reject' | 'quarantine' | 'none' | 'absent' | 'unknown'
      - `mx` 'present' | 'absent' | 'unknown'
      - `notes` string[]
  - `attachments` object[]: What each attachment really is, read from its first bytes against what its name and declared type promise.
    - `filename` string
    - `declared` string, nullable: The file family the name and the declared type promise.
    - `actual` string, nullable: The file family the bytes reveal, for a person.
    - `lies` boolean: True when the bytes contradict the name, or reveal a program.
  - `signals` object[]: What the facts add to the assessment, one sentence each.
    - `code` string
    - `weight` integer
    - `reason` string

## Other responses

- `401`: Missing or invalid API key
- `404`: Work item not found
- `429`: Rate limit exceeded - wait and retry

---

[API](https://skmtc.dev/domani/apis/domani-run-api.md) · [All operations](https://skmtc.dev/domani/apis/domani-run-api/llms.txt) · [OpenAPI document](https://skmtc.dev/domani/apis/domani-run-api/revisions/7679f8159533?raw)