EML Insights API Reference
Analyze an EML email file: extract and parse headers, sender and recipient details, SPF and DMARC authentication results, URLs, attachments and security signals.
Service details and pricing: EML Insights API
Request example
Query the endpoint via an HTTPS POST request (replace YOUR_API_KEY_HERE with your API key):
curl -X POST "https://api.apivoid.com/v2/eml-insights" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY_HERE" \
-d '{"eml_base64": "RW5jb2RlIGFuZCBkZWNv..."}'The same request in PHP:
$emlBase64 = 'RW5jb2RlIGFuZCBkZWNv...';
$apiKey = 'YOUR_API_KEY_HERE';
$curl = curl_init('https://api.apivoid.com/v2/eml-insights');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['eml_base64' => $emlBase64]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);
if ($httpCode === 200) {
$responseData = json_decode($response, true);
print_r($responseData);
} else {
print_r('An error occurred: '.$response);
}Request parameters
Required
Base64-encoded EML file content (max 5 MB).
Response example
A successful request returns HTTP 200 with a JSON body:
{
"metadata": {
"message_id": "03302025091220980F708C98$443242D40E@hmlca.com",
"message_sha256_hash": "cd4e43afb13eef0e381d814ef1ac9d7d91086227131d69477d285d37d411e11b",
"date_time": "Thu, 04 Sep 2025 03:19:11 +0000 (UTC)",
"date_time_normalized": "2025-09-04T03:19:11Z"
},
"headers": {
"subject": "Attention: Access Re-activation \"receiver@gmail.com\": 03 September 2025",
"from_name": "Gmail Message Center",
"from_email": "rachelle@hmlca.com",
"return_path": "bounces+45627169-2aff-receiver=gmail.com@em8374.hmlca.com",
"reply_to": "",
"delivered_to": "receiver@gmail.com",
"to": [
"receiver@gmail.com"
],
"cc": [],
"bcc": [],
"content_type": "multipart/alternative",
"user_agent": "",
"x_mailer": "",
"x_library": "",
"list_unsubscribe": [],
"received_spf": "pass (google.com: domain of bounces+45627169-2aff-receiver=gmail.com@em8374.hmlca.com designates 50.31.49.42 as permitted sender) client-ip=50.31.49.42;",
"authentication_results": "mx.google.com; dkim=pass header.i=@hmlca.com header.s=s1 header.b=ZODWUU6W; dkim=pass header.i=@sendgrid.info header.s=smtpapi header.b=TObU1x+p; spf=pass (google.com: domain of bounces+45627169-2aff-receiver=gmail.com@em8374.hmlca.com designates 50.31.49.42 as permitted sender) smtp.mailfrom=\"bounces+45627169-2aff-receiver=gmail.com@em8374.hmlca.com\"",
"dkim_signatures": [
{
"signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=hmlca.com; h=from:subject:content-type:mime-version:date:to:cc:content-type:date: feedback-id:from:subject:to; s=s1; bh=HJ8h3pw+by1D2B7wJ1CO124/fwcuPkzoSMMdSbprGHM=; b=ZODWUU6WGZ+c6NCsyBNIceOX8FH62ZNR8yKgIPKq7O/Qm154ukSRXGy5FHkMeASDXN60 1LOg0VRKKBYXQmtgFTt1a1UFmr5KDE8dK9qLII5iRJ2lyQ7xhVy4qEF3csuCkHO63Uhv3M VEcP8kojPTtQDEC+3p3iIhS6aXOAz4YJ6rSPZga1KyJ/OF9rCBaq925JdAGZw2cnyORkhA ZlWoQIosQI7mIimf28Lj9idAPXXaCIJaf0CeG0/sAfTEexTHm7QrE3kUxZmoKTwyfUB824 QZV2a0YuIu4dKC9mLDkS7sRs+pcAk9dhsRMrUp33JUREhFKBvh9flfVDL4Rx+ocA==",
"selector": "s1",
"domain": "hmlca.com",
"algo": "rsa-sha256",
"key_type": "rsa",
"canon": "relaxed/relaxed",
"hash": "HJ8h3pw+by1D2B7wJ1CO124/fwcuPkzoSMMdSbprGHM=",
"key_bits": 2048,
"dnssec": false
},
{
"signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.info; h=from:subject:content-type:mime-version:date:to:cc:content-type:date: feedback-id:from:subject:to; s=smtpapi; bh=HJ8h3pw+by1D2B7wJ1CO124/fwcuPkzoSMMdSbprGHM=; b=TObU1x+puLv0hicu+Mpsh0MdJOZZ53xPGSytO8RVzZxUkCerEHT7xodzIiwjVTeDiFZ8 AU09HqWfE+Czdox4CpFTB0qBd0xENHcM0rS3P2SQbgWKWA2vaZ6dMm2MIAZVxOf49T20Zf vwSCIPHuPqV/dF2mTM7reRxF11XJP6428=",
"selector": "smtpapi",
"domain": "sendgrid.info",
"algo": "rsa-sha256",
"key_type": "rsa",
"canon": "relaxed/relaxed",
"hash": "HJ8h3pw+by1D2B7wJ1CO124/fwcuPkzoSMMdSbprGHM=",
"key_bits": 1024,
"dnssec": false
}
]
},
"body": {
"body_text": "Webmail\n\nDear User, receiver@gmail.com\n\nOur system indicates that your password has expired as part of our regular security maintenance. To continue accessing your webmail account without interruption, please take a moment to verify or update your password.\n\nKeep or Update Password https://u45627169.ct.sendgrid.net/ls/click?upn=u001.ilzQdWVrM538qTJ1Qrct2U7gPpD0uoiQECwlDuMspitwulZl7U-2FY3vakOIItSIS1XybaLMtdZ8kaccaNGzDgJl-2BToMxJ70rUoLmY-2BOC8PLL0c-2BbFqtEXLRZwr1fTYBGE4GK8_s0lTyPdoyuzn-2FJTE9fjR8gd4LnXMu4OKG3YpbxosU77i-2FfG4C2MUtEIoCJlrCv4kYhNLpFkGAbHAHEur7tKY3BDYlNZ-2BPfxo0M8IB5fyCQzRQA3YpmmqcpZY3xE1ZWT8ippFzgvcPAn1RCDWmrJUM-2B-2BMsAKXQT8fMw1snmBQJtoed9kNb8hvoZBHFaP3MV0uwsrhx-2FTGxvGGACZrGEwN6g-3D-3D\n\n© 2025 Gmail Webmail. All rights reserved.\n\nThis email was sent to you as a registered user for Gmail Webmail services."
},
"attachments": {
"files": [
{
"name": "invoice.zip",
"extension": ".zip",
"is_risky_extension": false,
"content_type": "application/zip",
"size": 4042,
"md5_hash": "d7b44bedb42ca39681c32cda0678af11",
"is_inline": false,
"content_id": "",
"disposition": "attachment",
"cid_referenced": false,
"is_document": false,
"is_archive": true,
"is_archive_encrypted": false,
"extracted_files": [
{
"name": "Invoice_N10092025.bat",
"extension": ".bat",
"is_risky_extension": true,
"is_document": false,
"is_archive": false,
"is_archive_encrypted": false,
"last_modified_at": "2025-10-23T21:57:18Z",
"size": 10494,
"md5_hash": "10d47269e0872ef218701703722d67d9"
}
]
}
],
"file_extensions": [
".zip",
".bat"
],
"md5_hashes": [
"d7b44bedb42ca39681c32cda0678af11",
"10d47269e0872ef218701703722d67d9"
]
},
"ioc": {
"urls": {
"urls": [
"https://u45627169.ct.sendgrid.net/ls/click?upn=u001.ilzQdWVrM538qTJ1Qrct2U7gPpD0uoiQECwlDuMspitwulZl7U-2FY3vakOIItSIS1XybaLMtdZ8kaccaNGzDgJl-2BToMxJ70rUoLmY-2BOC8PLL0c-2BbFqtEXLRZwr1fTYBGE4GK8_s0lTyPdoyuzn-2FJTE9fjR8gd4LnXMu4OKG3YpbxosU77i-2FfG4C2MUtEIoCJlrCv4kYhNLpFkGAbHAHEur7tKY3BDYlNZ-2BPfxo0M8IB5fyCQzRQA3YpmmqcpZY3xE1ZWT8ippFzgvcPAn1RCDWmrJUM-2B-2BMsAKXQT8fMw1snmBQJtoed9kNb8hvoZBHFaP3MV0uwsrhx-2FTGxvGGACZrGEwN6g-3D-3D",
"https://u45627169.ct.sendgrid.net/ls/click?upn=u001.ilzQdWVrM538qTJ1Qrct2U7gPpD0uoiQECwlDuMspitwulZl7U-2FY3vakOIItSIS1XybaLMtdZ8kaccaNGzDgJl-2BToMxJ70rUoLmY-2BOC8PLL0c-2BbFqtEXLRZwr1fTYBGEss7q_s0lTyPdoyuzn-2FJTE9fjR8gd4LnXMu4OKG3YpbxosU77i-2FfG4C2MUtEIoCJlrCv4kYhNLpFkGAbHAHEur7tKY3F-2FD5IvO2YiTDo-2FzLySkdPDOf5vAvMnJ-2BOrn7sm3lqiymM-2FOaZ4HgVbc7zC0ofWQJS39zRgu577y715r7QFnLA7WRSM8BjNM9dxCWxewBaVs1C5v32uEs6TuG4yZ4VATsg-3D-3D",
"https://u45627169.ct.sendgrid.net/wf/open?upn=u001.XFGmjoWdSYLGbF2-2B-2B1O-2F8nE80NrNtyU8ZMdTu2BP-2FZRTyD4PEuraAR9MERxO5qS-2FDx2o-2BBEM7SMpl99PzpPvLgvkmWCq7tYo8dnfKyMkLo-2Bhe8sfZ34j-2BF6DXfFpV8wMX6JIvbuqLpoS8iahL-2FvGO7bSCoH37gpRuT1HchqBaZKb3tBsuZKMPEr4fLjwpt7USWnFswkKA8yfCAOlSCsitDkvS411Nmxy1dzGYibBxNY-3D"
],
"redirects": [
"https://vvtrt.b-cdn.net/cubggg%20(2)%20-%20Copy.html"
],
"direct_downloads": [],
"with_ip_host": [],
"domains": [
"u45627169.ct.sendgrid.net",
"vvtrt.b-cdn.net"
],
"root_domains": [
"sendgrid.net",
"b-cdn.net"
],
"tlds": [
"net"
]
},
"emails": {
"emails": [
"receiver@gmail.com",
"rachelle@hmlca.com"
],
"domains": [
"gmail.com",
"hmlca.com"
],
"root_domains": [
"gmail.com",
"hmlca.com"
],
"tlds": [
"com"
]
},
"received_from": {
"domains": [
"s.pnkfpknx.outbound-mail.sendgrid.net",
"mx.google.com",
"whm002.searchcontrol.com"
],
"root_domains": [
"sendgrid.net",
"google.com",
"searchcontrol.com"
],
"tlds": [
"net",
"com"
]
},
"dkim_domains": {
"domains": [
"hmlca.com",
"sendgrid.info"
],
"root_domains": [
"hmlca.com",
"sendgrid.info"
],
"tlds": [
"com",
"info"
]
},
"bitcoin_addresses": [],
"phone_numbers": []
},
"sender_details": {
"email": "rachelle@hmlca.com",
"domain": "hmlca.com",
"root_domain": "hmlca.com",
"tld": "com",
"ip_address": "50.31.49.42",
"hostname": "s.pnkfpknx.outbound-mail.sendgrid.net",
"hostname_root_domain": "sendgrid.net",
"hostname_tld": "net",
"helo": "",
"helo_root_domain": "",
"helo_tld": ""
},
"security_details": {
"spf_status": "pass",
"dkim_status": "pass",
"dmarc_status": "",
"compauth_status": "",
"dara_status": "",
"tls_status": "",
"dmarc_policy": "",
"dmarc_subdomain_policy": "",
"dmarc_disposition": "",
"total_to_emails": 1,
"total_cc_emails": 0,
"total_bcc_emails": 0,
"is_mime_html_only": false,
"has_undisclosed_recipients": false,
"is_detected_by_server_antispam": false,
"sender_is_recipient": false,
"sender_and_reply_to_different_domain": false,
"sender_and_reply_to_different_email": false,
"sender_and_message_id_mismatch": false,
"sender_rdns_empty": false,
"reply_to_free_email": false,
"has_unsubscribe_link": false,
"high_value_money_found": false,
"has_urls_with_ip_host": false,
"is_body_text_empty": false,
"sent_outside_business_hours": true,
"sent_on_night_hours": true,
"sent_at_time": "3:19 AM",
"total_attachments": 1,
"has_risky_file_extensions": true,
"has_document_files": false,
"has_archive_files": true,
"has_encrypted_archive_files": false,
"urgency": "high"
},
"elapsed_ms": 551
}Response fields
The fields returned in the JSON response:
metadata → message_idstring
Message-ID header of the email.
metadata → message_sha256_hashstring
SHA-256 hash of the email message.
metadata → date_timestring
Date header of the email as found in the message.
metadata → date_time_normalizedstring
Date of the email normalized to ISO 8601 UTC format.
headers → subjectstring
Subject of the email.
headers → from_namestring
Display name of the sender.
headers → from_emailstring
Email address of the sender.
headers → return_pathstring
Return-Path header of the email.
headers → reply_tostring
Reply-To header of the email.
headers → delivered_tostring
Delivered-To header of the email.
headers → toarray
List of recipient email addresses in the To header.
headers → ccarray
List of recipient email addresses in the Cc header.
headers → bccarray
List of recipient email addresses in the Bcc header.
headers → content_typestring
Content-Type of the email, e.g. multipart/alternative.
headers → user_agentstring
User-Agent header of the email client, if present.
headers → x_mailerstring
X-Mailer header of the email client, if present.
headers → x_librarystring
X-Library header identifying the sending library, if present.
headers → list_unsubscribearray
List-Unsubscribe URLs or email addresses, if present.
headers → received_spfstring
Received-SPF header with the SPF evaluation result.
headers → authentication_resultsstring
Authentication-Results header with SPF, DKIM and DMARC results.
headers → dkim_signaturesarray
DKIM signatures found in the email headers.
headers → dkim_signatures[n] → signaturestring
Raw DKIM-Signature header value.
headers → dkim_signatures[n] → selectorstring
DKIM selector used by the signature (s= tag).
headers → dkim_signatures[n] → domainstring
Domain that signed the email (d= tag).
headers → dkim_signatures[n] → algostring
Signing algorithm, e.g. rsa-sha256.
headers → dkim_signatures[n] → key_typestring
Key type of the signature, e.g. rsa.
headers → dkim_signatures[n] → canonstring
Canonicalization method, e.g. relaxed/relaxed.
headers → dkim_signatures[n] → hashstring
Body hash of the signature (bh= tag).
headers → dkim_signatures[n] → key_bitsinteger
Size of the signing key in bits.
headers → dkim_signatures[n] → dnssecboolean
Returns true if the DKIM DNS record is protected by DNSSEC.
body → body_textstring
Plain text content of the email body.
attachments → filesarray
List of files attached to the email.
attachments → files[n] → namestring
File name of the attachment.
attachments → files[n] → extensionstring
File extension of the attachment.
attachments → files[n] → is_risky_extensionboolean
Returns true if the file extension is considered risky.
attachments → files[n] → content_typestring
MIME content type of the attachment.
attachments → files[n] → sizeinteger
File size of the attachment in bytes.
attachments → files[n] → md5_hashstring
MD5 hash of the attachment.
attachments → files[n] → is_inlineboolean
Returns true if the attachment is inline (e.g. embedded image).
attachments → files[n] → content_idstring
Content-ID of the attachment, if present.
attachments → files[n] → dispositionstring
Content disposition of the attachment, e.g. attachment, inline.
attachments → files[n] → cid_referencedboolean
Returns true if the attachment Content-ID is referenced in the email body.
attachments → files[n] → is_documentboolean
Returns true if the attachment is a document file.
attachments → files[n] → is_archiveboolean
Returns true if the attachment is an archive file.
attachments → files[n] → is_archive_encryptedboolean
Returns true if the attachment is a password-protected archive.
attachments → files[n] → extracted_filesarray
Files extracted from the archive, with name, extension, size, md5_hash and risk flags.
attachments → files[n] → extracted_files[n] → namestring
File name of the file extracted from the archive.
attachments → files[n] → extracted_files[n] → extensionstring
File extension of the extracted file, e.g. .bat.
attachments → files[n] → extracted_files[n] → is_risky_extensionboolean
Returns true if the extracted file has a commonly abused extension (e.g. .bat, .exe, .js).
attachments → files[n] → extracted_files[n] → is_documentboolean
Returns true if the extracted file is a document (e.g. PDF or Office file).
attachments → files[n] → extracted_files[n] → is_archiveboolean
Returns true if the extracted file is itself an archive.
attachments → files[n] → extracted_files[n] → is_archive_encryptedboolean
Returns true if the extracted archive is password-protected.
attachments → files[n] → extracted_files[n] → last_modified_atstring
Last modified timestamp of the extracted file (UTC).
attachments → files[n] → extracted_files[n] → sizeinteger
Size of the extracted file, in bytes.
attachments → files[n] → extracted_files[n] → md5_hashstring
MD5 hash of the extracted file.
attachments → file_extensionsarray
List of unique file extensions found in the attachments.
attachments → md5_hashesarray
List of MD5 hashes of the attachments.
ioc → urls → urlsarray
URLs found in the email body.
ioc → urls → redirectsarray
URLs identified as redirects.
ioc → urls → direct_downloadsarray
URLs identified as direct file downloads.
ioc → urls → with_ip_hostarray
URLs that use an IP address as host.
ioc → urls → domainsarray
Domains extracted from the URLs found.
ioc → urls → root_domainsarray
Root domains extracted from the URLs found.
ioc → urls → tldsarray
TLDs extracted from the URLs found.
ioc → emails → emailsarray
Email addresses found in the email.
ioc → emails → domainsarray
Domains extracted from the email addresses found.
ioc → emails → root_domainsarray
Root domains extracted from the email addresses found.
ioc → emails → tldsarray
TLDs extracted from the email addresses found.
ioc → received_from → domainsarray
Domains found in the Received headers.
ioc → received_from → root_domainsarray
Root domains found in the Received headers.
ioc → received_from → tldsarray
TLDs found in the Received headers.
ioc → dkim_domains → domainsarray
Domains found in the DKIM signatures.
ioc → dkim_domains → root_domainsarray
Root domains found in the DKIM signatures.
ioc → dkim_domains → tldsarray
TLDs found in the DKIM signatures.
ioc → bitcoin_addressesarray
Bitcoin addresses found in the email.
ioc → phone_numbersarray
Phone numbers found in the email.
sender_details → emailstring
Email address of the sender.
sender_details → domainstring
Domain of the sender email address.
sender_details → root_domainstring
Root domain of the sender email address.
sender_details → tldstring
TLD of the sender email address.
sender_details → ip_addressstring
IP address of the sending mail server.
sender_details → hostnamestring
Hostname (reverse DNS) of the sending mail server.
sender_details → hostname_root_domainstring
Root domain of the sending mail server hostname.
sender_details → hostname_tldstring
TLD of the sending mail server hostname.
sender_details → helostring
HELO/EHLO identity used by the sending mail server.
sender_details → helo_root_domainstring
Root domain of the HELO identity.
sender_details → helo_tldstring
TLD of the HELO identity.
security_details → spf_statusstring
SPF evaluation result, e.g. pass, fail, softfail, none.
security_details → dkim_statusstring
DKIM evaluation result, e.g. pass, fail, none.
security_details → dmarc_statusstring
DMARC evaluation result, e.g. pass, fail, none.
security_details → compauth_statusstring
Microsoft composite authentication result, if present.
security_details → dara_statusstring
DARA evaluation result, if present.
security_details → tls_statusstring
TLS status of the delivery, if reported by the receiving server.
security_details → dmarc_policystring
DMARC policy of the sender domain, e.g. none, quarantine, reject.
security_details → dmarc_subdomain_policystring
DMARC subdomain policy of the sender domain.
security_details → dmarc_dispositionstring
DMARC disposition applied to the message.
security_details → total_to_emailsinteger
Number of recipients in the To header.
security_details → total_cc_emailsinteger
Number of recipients in the Cc header.
security_details → total_bcc_emailsinteger
Number of recipients in the Bcc header.
security_details → is_mime_html_onlyboolean
Returns true if the email body is HTML only, without a plain text part.
security_details → has_undisclosed_recipientsboolean
Returns true if recipients are undisclosed.
security_details → is_detected_by_server_antispamboolean
Returns true if the receiving server anti-spam flagged the email.
security_details → sender_is_recipientboolean
Returns true if the sender is also a recipient of the email.
security_details → sender_and_reply_to_different_domainboolean
Returns true if sender and Reply-To use different domains.
security_details → sender_and_reply_to_different_emailboolean
Returns true if sender and Reply-To use different email addresses.
security_details → sender_and_message_id_mismatchboolean
Returns true if the sender domain does not match the Message-ID domain.
security_details → sender_rdns_emptyboolean
Returns true if the sending mail server has no reverse DNS.
security_details → reply_to_free_emailboolean
Returns true if the Reply-To address uses a free email provider.
security_details → has_unsubscribe_linkboolean
Returns true if the email contains an unsubscribe link.
security_details → high_value_money_foundboolean
Returns true if high-value money amounts are mentioned in the email.
security_details → has_urls_with_ip_hostboolean
Returns true if the email contains URLs with an IP address as host.
security_details → is_body_text_emptyboolean
Returns true if the email body text is empty.
security_details → sent_outside_business_hoursboolean
Returns true if the email was sent outside typical business hours.
security_details → sent_on_night_hoursboolean
Returns true if the email was sent during night hours.
security_details → sent_at_timestring
Time of day the email was sent, e.g. morning, afternoon, night.
security_details → total_attachmentsinteger
Number of attachments found in the email.
security_details → has_risky_file_extensionsboolean
Returns true if attachments with risky file extensions are found.
security_details → has_document_filesboolean
Returns true if document attachments are found.
security_details → has_archive_filesboolean
Returns true if archive attachments are found.
security_details → has_encrypted_archive_filesboolean
Returns true if password-protected archive attachments are found.
security_details → urgencystring
Urgency level detected from the email content, e.g. low, medium, high.
elapsed_msinteger
Time taken to process the request, in milliseconds.