POST /mail/scan

The whole message as UTF-8 text. Use emlBase64 for 8-bit or binary parts.

The whole message, RFC 5322 (.eml), base64. Up to 10 MiB decoded. Send exactly one of emlBase64, eml and message.

One sentence a ticket or a chat message can carry.

quarantine | review | warn | deliver. deliver means no objection from this scan; it never releases a message another engine held.

0-100. 90 and above only for malicious.

malicious | suspicious | clean | inconclusive. clean is a positive claim: it needs your own system's DMARC pass, a sender domain the dataset knows as established (among the 100 000 most visited, and not a free mailbox) and every attachment and link vouched for or read. A message with nothing against it and no such evidence is inconclusive: a DMARC pass shows who sent a message, not that they can be trusted.