Developer product · Ṣọ Shield API
The email threat detection engine, as an API.
The technical product page for teams integrating email and link risk signals into an application. Explore the endpoints, responses, credit model, and operational limits before you write code.
3,000 free credits every month. No card required.
- endpoints, one API key
- 7
- free credits every month
- 3,000
- emails stored on our servers
- 0
One request, a full verdict.
Send raw email content to /v1/email/analyze. You get a single clean verdict, an overall risk score, a category breakdown across BEC, phishing, spam, and malware, and a list of specific findings your code can act on.
curl -X POST https://api-service.soone.soemailsecurity.com/v1/email/analyze \
-H "x-api-key: so_live_xxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{
"from": "billing@secure-paypa1-alerts.com",
"subject": "Action required: your account is on hold",
"body": "We noticed unusual activity. Restore access now: http://secure-paypa1-alerts.xyz/verify"
}'{
"status": "success",
"data": {
"verdict": "malicious",
"overall_score": 78,
"category_scores": {
"bec": 30,
"phishing": 60,
"spam": 0,
"malware": 0
},
"findings": [
{
"category": "phishing",
"type": "suspicious_urls",
"severity": "high",
"detail": "1 suspicious URL(s) found",
"urls": ["http://secure-paypa1-alerts.xyz/verify"]
}
],
"urls_found": 1,
"attachments_found": 0,
"analyzed_at": "2026-07-21T12:00:00.000Z"
},
"meta": {
"credits_charged": 5,
"processing_time_ms": 4
}
}Authenticate with an x-api-key header. Use so_test_ keys while you build, so_live_ keys in production.
Seven endpoints. Seven questions answered.
Every endpoint is a plain question about trust. All requests are POST, all responses are JSON, and each call costs a fixed number of credits.
- POST/v1/email/analyze
Is this email phishing, BEC, spam, or malware? A single verdict, an overall risk score, category scores, and a list of specific findings.
5 credits
- POST/v1/bec/score
How much does this message look like business email compromise? A 0 to 100 score and risk level from urgency, executive-impersonation, financial-request, and sender-domain signals.
2 credits
- POST/v1/url/analyze
Is this link risky? Flags raw-IP hosts, suspicious TLDs, URL shorteners, and credential-in-URL tricks, and returns a verdict with a 0 to 100 risk score.
1 credit
- POST/v1/domain/check
Is this domain likely impersonating a brand? Typosquat and reputation checks return a risk score and a reputation call.
1 credit
- POST/v1/headers/validate
What do this email's supplied authentication headers report? Reads claimed SPF, DKIM, and DMARC results and flags From and Return-Path mismatches; it does not perform independent DNS or cryptographic validation.
1 credit
- POST/v1/qr/scan
Is a decoded QR destination risky? Submit the extracted URL or text and run it through the same structural URL checks. Image decoding is not currently included.
2 credits
- POST/v1/doc/compare
Did important text change? Compares extracted plain text and flags changed banking details, amounts, and contact addresses. PDF parsing, OCR, and visual comparison are not currently included.
3 credits
Base URL: https://api-service.soone.soemailsecurity.com
Priced in credits, not seats.
Each call costs 1 to 5 credits depending on the endpoint. Start free, upgrade when your volume does. Pay yearly and save 17%.
Free
$0/mo
3,000 credits/mo
No card required
Starter
$29/mo
25,000 credits/mo
For first integrations
Growth
$99/mo
75,000 credits/mo
For production traffic
Pro
$199/mo
150,000 credits/mo
For high-volume pipelines
Enterprise
Custom
Contracted credit allowance
Volume terms, overages, and SLAs
A verdict on a full email costs 5 credits. A URL, domain, or header check costs 1. QR scans cost 2, BEC domain scores 2, document comparisons 3.
We analyze your data. We never keep it.
Submitted message and document content is processed for the requested analysis and is not deliberately stored as a message archive. We do retain limited account, usage, security, and billing metadata needed to operate the service.
Analysis happens in memory
Email content, URLs, and documents are analyzed at request time and discarded. Nothing you send is written to our servers.
Designed to reduce content retention
Submitted content is not deliberately retained after analysis. Account, usage, security, and billing metadata may still be processed as described in our privacy documents.
Google CASA verified
Our consumer application completed a Google Cloud Application Security Assessment. This does not represent a separate certification of every API endpoint.
Operational notes, honestly
Rate limits
Every plan has hourly and daily rate limits alongside its monthly credit pool. Limits scale with the plan, and the dashboard shows your live usage.
Sandbox keys
so_test_ keys let you build and run integration tests without touching production quotas. Swap to so_live_ when you ship.
Every response is structured JSON with the specific findings behind each verdict. We publish what the engine checks, so you can see exactly why a message scored the way it did.
Where teams put it to work.
SOC and SIEM enrichment
Pipe reported emails through /v1/email/analyze and /v1/headers/validate to turn user reports into triaged, severity-scored incidents.
Email client plugins
Add a trust verdict next to every message. One call per email, verdict plus link scan in a single response, nothing stored.
Fintech onboarding
Vet counterparty domains at signup with /v1/bec/score and /v1/domain/check before the first invoice ever arrives.
Marketplace fraud teams
Screen seller communications, payout-change requests, and uploaded invoices with /v1/doc/compare before money moves.
AI agent guardrails
Agents that read email can be prompt-injected by it. Scan every message before your agent acts on it.
How teams protect AI agents
Your first 3,000 verdicts are free.
Create a key, make a call, ship. No card, no sales call, no stored email data.
sales@soemailsecurity.com