{"openapi":"3.0.0","info":{"description":"Email address reputation and risk intelligence from social media, breach corpora, phishing kits and deliverability signals; report malicious emails (Sublime Security)","version":[]},"servers":[{"description":"Email address reputation and risk intelligence from social media, breach corpora, phishing kits and deliverability signals; report malicious emails (Sublime Security)","url":"https://api.apirails.com/emailrep"}],"paths":{"/{email}":{"get":{"tags":["Email Reputation"],"parameters":[{"name":"email","in":"path","description":"The email address to look up, e.g. 'bill@microsoft.com'.","required":true,"schema":{"type":"string","example":""}}],"responses":{"401":{"description":"Bearer token required (Authorization header)","content":{"application/json":{}}}},"externalDocs":{"api_ref":"https://docs.emailrep.io/","api_endpoint":"https://emailrep.io/{email}"},"summary":"Query Email Reputation","description":"Query the reputation and risk profile of an email address: social media presence, breach/credential-leak exposure, phishing signals, domain age, deliverability, and a suspicious/blacklisted verdict. The unauthenticated API is disabled — an API key is required.","security":[{"bearerAuth":[]}]}},"/report":{"post":{"tags":["Email Reputation"],"parameters":[],"responses":{"401":{"description":"Bearer token required (Authorization header)","content":{"application/json":{}}}},"externalDocs":{"api_ref":"https://docs.emailrep.io/","api_endpoint":"https://emailrep.io/report"},"summary":"Report Malicious Email","description":"Report an email address as malicious. Tags classify the activity (account_takeover, bec, brand_impersonation, browser_exploit, credential_phishing, generic_phishing, malware, scam, spam, spoofed, task_request, threat_actor).","security":[{"bearerAuth":[]}],"requestBody":{"description":"","required":true,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"description":{"type":"string","description":"Additional information and context.","required":true},"email":{"type":"string","description":"Email address being reported.","required":true},"expires":{"type":"number","description":"Hours the email should stay flagged risky (suspicious+blacklisted). Defaults to none; 14 days when tag is account_takeover."},"tags":{"type":"array","description":"Tags applied to the report.","required":true,"enum":["account_takeover","bec","brand_impersonation","browser_exploit","credential_phishing","generic_phishing","malware","scam","spam","spoofed","task_request","threat_actor"],"items":{"type":"string"}},"timestamp":{"type":"number","description":"UTC unix timestamp when the activity occurred. Defaults to now."}}},"example":{"description":"Credential phishing landing page link","email":"attacker@evil.example","expires":336,"tags":["credential_phishing"],"timestamp":1768000000}}}}}}},"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}}},"security":[{"bearerAuth":[]}]}