---
title: "Get spam-trap hits for a sending domain"
method: GET
path: "/v1/email/inbox-insights/spam-traps"
tags: ["email-inbox-insights"]
---

# Get spam-trap hits for a sending domain

`GET /v1/email/inbox-insights/spam-traps`

## Request

- Base URL: `https://us1.platform.bird.com`
- URL: `https://us1.platform.bird.com/v1/email/inbox-insights/spam-traps`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `bird_session`

Returns the spam-trap hits recorded against a sending domain over the
period: the total, a split by the kind of trap, a split by the trap
network that observed them, and the individual hits with the sending IP
and trap age behind each.

Spam traps are addresses that exist only to catch senders mailing lists
they should not be mailing, so the kind of trap says more than the count.
Hits on pristine traps, which never belonged to a real person, point at
harvested or guessed addresses; hits on recycled traps point at stale list
data. Zero hits is a measured zero and a good result, so the totals are
real figures rather than an empty state.

## Query parameters

- `sending_domain` string, required
- `from` string, date
- `to` string, date
- `compare` 'previous_period': Set to `previous_period` to include the immediately preceding window of equal length in the same response, so deltas need no second request.

## Headers

- `X-Workspace-Id` string
- `X-Organization-Id` string

## Response `200`

Spam-trap hits for the requested domain and period.

- EmailInboxInsightsSpamTraps: The meta every Inbox Insights resource carries, whatever it measures, so one client adapter serves them all.
  - `resource` string, required: Which resource this response is, echoed for self-description.
  - `domain` string, required: The sending domain the figures describe.
  - `measurement` EmailInboxInsightsMeasurement: How the figures in this response were measured, so a number is self-describing in a screenshot or a bug report.
    - `sources` string[], required: Identifiers of the measurement systems that contributed to these figures. The set grows as measurement coverage does, so treat the values as labels rather than a closed list.
    - `weighting` EmailInboxInsightsWeighting: How the placement figures in this response were weighted, so a number is self-describing wherever it is quoted or screenshotted. Placement rates are a weighted average of per-provider rates against an audience mix (the share of recipients expected at each mailbox provider) rather than a share of delivered volume.
      - `weight_set_id` string, required: The measurement's own identifier for the audience mix, carried through so a client can tell two weightings apart without comparing `basis` strings. No operation accepts it.
      - `source` 'account' | 'global', required: Where the audience mix behind the placement weighting came from: `account` when it was configured for this account, `global` when a general default was used instead.
      - `basis` string, nullable, required: The weighting method behind the rates, as the measurement names it. A slug rather than a sentence, so render it as a label and do not expect it to read as English. Null when the measurement did not state one, which pairs with `source`: both describe the method, so neither can claim to know it when the measurement was silent.
  - `generated_at` string, date-time, required: When these figures were computed. The measurement service's own stamp where it publishes one; on the resources Bird derives from daily rates it has none to publish, and this is when Bird computed them.
  - `freshness` EmailInboxInsightsFreshness, required: How current the figures are. Freshness differs per resource (authentication data can lag a day or more while blocklist lookups are near real time), so any "as of" label binds from this field, never from a fixed string.
    - `as_of` string, date, nullable, required: The most recent UTC day the figures include, or null for a live lookup that has no measurement window.
    - `lag_hint` string, nullable, required: How far behind real time this resource usually runs. A lowercase identifier rather than a display label, so pick your own wording for it, and treat the set as open: the measurement names a hint per resource and can add one without notice. Null when the measurement reports no hint, which several resources do: show the figures without an age rather than inventing one.
  - `cached_at` string, date-time: Present when the response was served from a short-lived copy rather than fetched for this request: when that copy was fetched.
  - `window` EmailInboxInsightsWindow, required: The period every figure in the response covers: whole UTC calendar days, inclusive on both ends. The same window convention the email statistics endpoints use, so figures from the two sources describe the same days and can be combined without adjustment.
    - `start` string, date, required: First UTC day of the period, inclusive.
    - `end` string, date, required: Last UTC day of the period, inclusive.
    - `group_by` 'day' | 'week' | 'month': The bucket size a series is grouped by. Day suits the product's charts; wider grains suit long ranges.
  - `compared_to` EmailInboxInsightsComparedTo: The prior equal-length period the delta figures compare against. Present only when the request asked for a comparison.
    - `start` string, date, required: First UTC day of the prior period, inclusive.
    - `end` string, date, required: Last UTC day of the prior period, inclusive.
  - `total` integer, required: Trap hits observed over the period, across every trap network. The authoritative count: `hit_rows` holds a sample of the rows behind it.
  - `delta` integer: How the hit count moved against the prior period, as a change in the number of hits rather than in percentage points. Negative is an improvement. Present only when the request asked for a comparison and the prior period had data; absence is not zero change.
  - `by_type` EmailInboxInsightsSpamTrapTypeCount[], required: Hits split by kind, one entry per kind the trap network reported. Read counts from here rather than assuming a fixed set of kinds: the set can grow, and an entry that is absent was not reported rather than being a measured zero. These sum to `total`.
    - `type` string, required: What kind of spam trap was hit. `pristine` addresses were never used by a real person and never subscribed to anything, so a hit means the address was harvested or guessed rather than collected. `recycled` addresses belonged to a real person once and were retired, so hits point at stale list data. `typo` addresses catch misspellings of real domains, `parked` addresses sit on domains that are registered but not used for real mail, and `mixed` covers hits the trap network reports without a single kind. The trap network decides this set and can add to it, so treat an unrecognised value as a label to show rather than a case to exhaust. A hit whose kind is new is still a hit worth acting on.
    - `hits` integer, required: Hits of this kind over the period. A zero is a measured zero, not missing data: no pristine hits is a genuinely good result rather than an empty state.
  - `by_source` EmailInboxInsightsSpamTrapSourceCount[], required: Hits split by the trap network that observed them.
    - `source` string, required: The trap network that observed a hit. The set grows as coverage does, so treat the values as labels rather than a closed list.
    - `hits` integer, required: Hits this network observed over the period.
  - `hit_rows` EmailInboxInsightsSpamTrapHits, required: The individual trap hits behind the totals. A sample rather than a guaranteed complete list, and its rows do not count hits: one row is one trap address, carrying a `hit_count` for how many times that address was reached. Neither the number of rows nor the sum of `hit_count` reconstructs `total`, because that field is absent wherever the trap network does not break the figure out. Read `truncated_types` for what the measurement capped rather than inferring completeness by comparing counts.
    - `items` EmailInboxInsightsSpamTrapHit[], required: One entry per trap reached, newest first.
      - `first_seen` string, date-time, required: When the trap network first observed mail from this domain at this trap.
      - `last_seen` string, date-time, nullable, required: The most recent sighting, or null when the trap was seen only once. On a row with several hits this is the far end of the period they span.
      - `ip_address` string, required: The sending IP the message came from.
      - `source` string, required: The trap network that observed a hit. The set grows as coverage does, so treat the values as labels rather than a closed list.
      - `type` string, required: What kind of spam trap was hit. `pristine` addresses were never used by a real person and never subscribed to anything, so a hit means the address was harvested or guessed rather than collected. `recycled` addresses belonged to a real person once and were retired, so hits point at stale list data. `typo` addresses catch misspellings of real domains, `parked` addresses sit on domains that are registered but not used for real mail, and `mixed` covers hits the trap network reports without a single kind. The trap network decides this set and can add to it, so treat an unrecognised value as a label to show rather than a case to exhaust. A hit whose kind is new is still a hit worth acting on.
      - `hit_count` integer: How many times this trap was hit over the period, so rows do not sum to `total` on their own: one repeatedly hit trap is one row. Absent when the trap network does not break the count out, which is not the same as one hit. A row exists because the trap was reached at least once either way.
      - `trap_age_days` integer, nullable, required: How long the trap address has been a trap, in days, or null when the network does not say. A high age on a recycled trap suggests the address has been dead in the list for a long time.
    - `truncated_types` EmailInboxInsightsTrapType[], required: Trap kinds whose hits the measurement capped, so the rows shown for them are incomplete by design rather than by chance. Typo-trap hits, for instance, only ever cover the last seven days. An empty array means nothing was capped.
    - `status` 'ok' | 'no_data' | 'not_configured' | 'unavailable' | 'not_applicable', required: Whether a section of the response carries figures, and when it does not, why. `ok` means the section is populated. `no_data` means the measurement ran and observed nothing to report for this domain in the period. `not_configured` means the section needs a setup step that has not been completed yet, such as connecting Google Postmaster Tools; treat it as an invitation to finish setup rather than a fault. `unavailable` means the figures could not be retrieved this time and the same request may well succeed on a retry; the rest of the response is unaffected. `not_applicable` means the section is meaningless for this domain in this period, so there is nothing to show or fix. A successful response never implies every section is populated; read each section's status rather than assuming figures are present.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Insufficient permissions
- `404`: Resource not found
- `412`: Precondition failed
- `422`: The request has invalid field values, violates a business rule, or carries a query parameter the endpoint does not declare. Field validation errors use `type: validation_error` and include the affected fields in `details`. Business-rule errors identify the failed rule in `type`.
- `429`: Rate limit exceeded
- `500`: Internal server error
- `503`: The service is temporarily unavailable. If `Retry-After` is present, wait for that delay before retrying; otherwise, retry with exponential backoff. Reuse the same idempotency key and request when retrying a mutation.

---

[API](https://skmtc.dev/messagebird/apis/bird-api.md) · [All operations](https://skmtc.dev/messagebird/apis/bird-api/llms.txt) · [OpenAPI document](https://skmtc.dev/messagebird/apis/bird-api/revisions/3e2a50466454?raw)