---
title: "Score a phishing email an agent has already parsed"
method: POST
path: "/v1/email-check"
tags: ["Free checks (no API key)"]
---

# Score a phishing email an agent has already parsed

`POST /v1/email-check`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/email-check`
- Auth: none required

Keyless and free. The same scoring model as checkemail@relayshield.net, for a caller that has already parsed a message -- an agent reading a mailbox through the Gmail or Graph API -- rather than a raw RFC822 blob. Scores SPF/DKIM/DMARC, brand impersonation in the display name, ask-plus-pressure phrasing, links to public file-hosting services, and attachment names by extension. Links are checked through the same keyless path as `/v1/link-check`, never `/v1/scan-url`, so this endpoint has no per-call vendor cost.

This does not parse raw email. Extract from_address, from_name, subject, body_text, links and attachment_names yourself before calling.

**Billing.** Free. This endpoint is not metered.

**Note.** No API key required. checkemail@relayshield.net runs the same model over raw forwarded mail; this is a second door for a caller that has already parsed one.

## Request body

- object
  - `from_address` string: The claimed sender's address.
  - `from_name` string: The claimed sender's display name.
  - `reply_to` string: Reply-To address, if present and different from from_address.
  - `return_path` string: Envelope sender, if available. Informational only.
  - `subject` string: Message subject.
  - `body_text` string: Plain-text body, used for ask/deadline/threat phrasing.
  - `links` string[]: Links found in the body, up to 25.
  - `attachment_names` string[]: Attachment filenames, checked by extension only. Nothing is opened, decoded or stored.
  - `auth_results` object: Structured SPF/DKIM/DMARC verdict, if the caller already has it.
    - `spf` string: pass, fail, softfail or neutral.
    - `dkim` string: pass or fail.
    - `dmarc` string: pass or fail.
  - `authentication_results` string: Raw Authentication-Results header text. Parsed only when auth_results is absent.
  - `forwarded` boolean: True when this is an inline forward. Forwarding strips the original SPF/DKIM/DMARC and re-signs the message as the forwarder's own provider, so auth signals are not scored when this is true -- they would describe the forwarder, not the message being asked about.
  - `source` string: Optional integration identifier.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `risk` 'high' | 'medium' | 'low': Overall verdict.
    - `score` integer: The weighted score behind `risk`.
    - `claimed_sender` string: from_address as sent, or null.
    - `flags` object[]: Findings that raised the score.
      - `weight` integer: Points this flag added.
      - `text` string: Plain-language explanation.
    - `notes` string[]: Observations stated but not scored.
    - `auth` object: The authentication verdict as scored.
      - `present` boolean: An auth result was supplied.
      - `spf` string: pass, fail, softfail, neutral or null.
      - `dkim` string: pass, fail or null.
      - `dmarc` string: pass, fail or null.
      - `about_original` boolean: False when forwarded is true -- the auth fields describe the forwarder, not the original sender, and were not scored.
    - `links` object[]: Per-link verdicts, same shape as /v1/link-check's batch results.
    - `attachments` object: Attachment names as received.
      - `names` string[]: Filenames.
    - `note` string: Standing caveat on what a heuristic verdict does and does not mean.

## Other responses

- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)