Ṣọ Shield API
The email threat detection engine, as an API.
The same zero-retention engine behind Ṣọ Email Security. Seven endpoints for phishing, BEC, URLs, domains, headers, QR codes, and documents. Self-serve keys in minutes.
3,000 free credits every month. No card required.
- endpoints, one API key
- 7
- free credits every month
- 3,000
- emails stored on our servers
- 0
One request, a full verdict.
Send raw email content to /v1/email/analyze. You get a single clean verdict, an overall risk score, a category breakdown across BEC, phishing, spam, and malware, and a list of specific findings your code can act on.
curl -X POST https://api-service.soone.soemailsecurity.com/v1/email/analyze \
-H "x-api-key: so_live_xxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{
"from": "billing@secure-paypa1-alerts.com",
"subject": "Action required: your account is on hold",
"body": "We noticed unusual activity. Restore access now: http://secure-paypa1-alerts.xyz/verify"
}'{
"status": "success",
"data": {
"verdict": "malicious",
"overall_score": 78,
"category_scores": {
"bec": 30,
"phishing": 60,
"spam": 0,
"malware": 0
},
"findings": [
{
"category": "phishing",
"type": "suspicious_urls",
"severity": "high",
"detail": "1 suspicious URL(s) found",
"urls": ["http://secure-paypa1-alerts.xyz/verify"]
}
],
"urls_found": 1,
"attachments_found": 0,
"analyzed_at": "2026-07-21T12:00:00.000Z"
},
"meta": {
"credits_charged": 5,
"processing_time_ms": 4
}
}Authenticate with an x-api-key header. Use so_test_ keys while you build, so_live_ keys in production.
Seven endpoints. Seven questions answered.
Every endpoint is a plain question about trust. All requests are POST, all responses are JSON, and each call costs a fixed number of credits.
- POST/v1/email/analyze
Is this email phishing, BEC, spam, or malware? A single verdict, an overall risk score, category scores, and a list of specific findings.
5 credits
- POST/v1/bec/score
How much does this message look like business email compromise? A 0 to 100 score and risk level from urgency, executive-impersonation, financial-request, and sender-domain signals.
2 credits
- POST/v1/url/analyze
Is this link risky? Flags raw-IP hosts, suspicious TLDs, URL shorteners, and credential-in-URL tricks, and returns a safe call with a 0 to 100 risk score.
1 credit
- POST/v1/domain/check
Is this domain likely impersonating a brand? Typosquat and reputation checks return a risk score and a reputation call.
1 credit
- POST/v1/headers/validate
What do this email's own auth results say? Reads SPF, DKIM, and DMARC results from the headers and flags From and Return-Path mismatches.
1 credit
- POST/v1/qr/scan
Where does this QR code's link lead? Runs the decoded destination through the same URL risk checks.
2 credits
- POST/v1/doc/compare
Was this document altered? Compares two versions and flags changed banking details, amounts, and new contact addresses.
3 credits
Base URL: https://api-service.soone.soemailsecurity.com
Priced in credits, not seats.
Each call costs 1 to 5 credits depending on the endpoint. Start free, upgrade when your volume does. Pay yearly and save 17%.
Free
$0/mo
3,000 credits/mo
No card required
Starter
$29/mo
25,000 credits/mo
For first integrations
Growth
$99/mo
75,000 credits/mo
For production traffic
Pro
$199/mo
150,000 credits/mo
For high-volume pipelines
Enterprise
Custom
Unlimited credits
Volume terms and SLAs
A verdict on a full email costs 5 credits. A URL, domain, or header check costs 1. QR scans cost 2, BEC domain scores 2, document comparisons 3.
We analyze your data. We never keep it.
Most email security vendors store the messages they scan. IRONSCALES, Barracuda, and Abnormal all retain email data. Ṣọ Shield does not, so the emails your users forward to your product never become our liability, or yours.
Analysis happens in memory
Email content, URLs, and documents are analyzed at request time and discarded. Nothing you send is written to our servers.
GDPR-compliant by design
Zero retention means there is no stored email data to breach, subpoena, or leak. Compliance reviews get much shorter.
Google CASA verified
The same engine passed Google's Cloud Application Security Assessment for its consumer products.
Operational notes, honestly
Rate limits
Every plan has hourly and daily rate limits alongside its monthly credit pool. Limits scale with the plan, and the dashboard shows your live usage.
Sandbox keys
so_test_ keys let you build and run integration tests without touching production quotas. Swap to so_live_ when you ship.
Every response is structured JSON with the specific findings behind each verdict. We publish what the engine checks, so you can see exactly why a message scored the way it did.
Where teams put it to work.
SOC and SIEM enrichment
Pipe reported emails through /v1/email/analyze and /v1/headers/validate to turn user reports into triaged, severity-scored incidents.
Email client plugins
Add a trust verdict next to every message. One call per email, verdict plus link scan in a single response, nothing stored.
Fintech onboarding
Vet counterparty domains at signup with /v1/bec/score and /v1/domain/check before the first invoice ever arrives.
Marketplace fraud teams
Screen seller communications, payout-change requests, and uploaded invoices with /v1/doc/compare before money moves.
AI agent guardrails
Agents that read email can be prompt-injected by it. Scan every message before your agent acts on it.
How teams protect AI agents
Your first 3,000 verdicts are free.
Create a key, make a call, ship. No card, no sales call, no stored email data.
sales@soemailsecurity.com