---
title: "Screen an email for phishing"
method: POST
path: "/v1/ai/fraud/email-phishing"
tags: ["fraud:email-phishing"]
---

# Screen an email for phishing

`POST /v1/ai/fraud/email-phishing`

## Request

- Base URL: `https://api.intura.co` (the document declares no server; this is the origin it was published from)
- URL: `https://api.intura.co/v1/ai/fraud/email-phishing`
- Auth: none declared

## Request body

- ModulesV1AiFraudEmailPhishingSchemasDetectRequest: One email to screen. `body` is required; every header raises recall.
  - `body` string, required: The message body, plain text or HTML. HTML is worth sending as-is: an anchor whose text and href name different domains is one of the strongest signals available, and flattening to text destroys it. Bounded by the module's MAX_CHARS.
  - `subject` string, nullable: The subject line. Scored together with the body, because phishing subjects carry much of the urgency.
  - `sender` string, nullable: The `From` header, with or without a display name. Compared against `reply_to` and against the brand the message claims to be.
  - `reply_to` string, nullable: The `Reply-To` header. A registrable domain that disagrees with `sender` is evidence an attacker cannot remove by rewriting copy.
  - `display_name` string, nullable: The sender's display name, if you have it separately from `sender`. Sending it inside `sender` works just as well.
  - `thresholds` object, nullable: Move the cuts for this one call: `block` (default 0.75) and `review` (default 0.45). Either alone is fine; the other keeps Intura's default.

## Response `200`

Successful Response

- ModulesV1AiFraudEmailPhishingSchemasDetectResponse
  - `status` string: Always `success` on a 2xx
  - `code` integer: Mirrors the HTTP status code
  - `data` ModulesV1AiFraudEmailPhishingSchemasDetectResponseData, required: `data` for POST /v1/ai/fraud/email-phishing.
    - `label` string, required: `phishing` — block or quarantine it. `suspicious` — warn the recipient and strip links. `benign` — nothing found.
    - `score` number, required: The number this endpoint measured and decided on, 0..1, rounded to 4 dp — P(injection), P(scam), how strongly the frame reads as the card. Compare it against `thresholds` and you have `label`. This is the only number to threshold on; what it means on a given route is documented there.
    - `thresholds` object: The cuts this answer was decided by, after your saved settings and anything sent in `thresholds` on the request. Published on every response so a verdict can be compared with an older one: a score means nothing without the bar it was held to. Empty on an endpoint with nothing to tune.
    - `result` ModulesV1AiFraudEmailPhishingSchemasDetectResultData: `result` for a detection call: what to do about the score.
      - `phishing` boolean, required: True when the score crossed your block cut. The single boolean a caller needs if they do not want to reason about bands.
      - `action` string, required: `block` (score >= `thresholds.block`), `review` (>= `thresholds.review`), or `allow`. `review` means quarantine or warn rather than delete — the band exists so a check that fires on a real invoice does not get switched off.
      - `fields_screened` string[]: Which of `subject`, `body`, `sender`, `reply_to` and `display_name` were present. The header checks cannot fire on what was not sent, so this is how you tell a body-only verdict from a full one.
      - `languages` string[], required: The languages this input was screened in. Every supported language when none could be identified.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/intura/apis/intura-ai-api.md) - [All operations](https://skmtc.dev/intura/apis/intura-ai-api/llms.txt) - [OpenAPI document](https://skmtc.dev/intura/apis/intura-ai-api/revisions/7cb6af4c6390?raw)