Email Threat Intelligence API

curl -X POST https://api.glance-co.com/api/v1/scan \
  -H "Content-Type: application/json" \
  -H "X-API-Key: glance_live_xxxxxxxxxxxxxxxx" \
  -d '{
    "from": "urgent-billing@paypa1-secure.com",
    "fromName": "PayPal Security",
    "subject": "Your account has been suspended — action required",
    "headers": {
      "Received": "from mx.paypa1-secure.com (203.0.113.42)",
      "Authentication-Results": "spf=fail; dkim=none; dmarc=fail"
    }
  }'

{
  "threatScore": 87,
  "verdict": "DANGEROUS",
  "signals": [
    "spf_fail",
    "dmarc_fail",
    "homoglyph_domain",
    "urgency_keywords",
    "domain_age_new"
  ],
  "confidence": 0.9312,
  "latencyMs": 34,
  "requestId": "f47ac10b-58cc-4372-a567-0e02b2c3d479"
}

"headers": {
  "Authentication-Results": "spf=fail smtp.mailfrom=example.com; dkim=none; dmarc=fail",
  "Received": "from mail.suspicious-host.net (198.51.100.7)",
  "Return-Path": "<bounce@suspicious-host.net>",
  "DKIM-Signature": "v=1; a=rsa-sha256; d=example.com; s=default; ..."
}

{
  "statusCode": 429,
  "message": "Daily scan quota exceeded",
  "resetAt": "2026-04-09T00:00:00.000Z"
}

{
  "statusCode": 400,
  "message": "Validation failed",
  "errors": [
    { "field": "from", "message": "from is required" }
  ]
}

curl -X POST https://api.glance-co.com/api/v1/scan \
  -H "Content-Type: application/json" \
  -H "X-API-Key: glance_live_xxxxxxxxxxxxxxxx" \
  -d '{
    "from": "no-reply@paypa1-secure.net",
    "fromName": "PayPal",
    "subject": "Confirm your identity to restore access",
    "headers": {
      "Authentication-Results": "spf=fail; dkim=none; dmarc=fail"
    }
  }'

const scanEmail = async ({ from, fromName, subject, headers }) => {
  const response = await fetch('https://api.glance-co.com/api/v1/scan', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-API-Key': process.env.GLANCE_API_KEY,
    },
    body: JSON.stringify({ from, fromName, subject, headers }),
  });

  if (!response.ok) {
    const error = await response.json();
    throw new Error(`Glance scan failed: ${error.message}`);
  }

  return response.json();
  // { threatScore, verdict, signals, confidence, latencyMs, requestId }
};

// Usage
const result = await scanEmail({
  from: 'sender@example.com',
  fromName: 'Example Sender',
  subject: 'Invoice #1042',
  headers: { 'Authentication-Results': 'spf=pass; dkim=pass; dmarc=pass' },
});

if (result.verdict === 'DANGEROUS') {
  await quarantineMessage(messageId);
}

import os
import requests

GLANCE_API_KEY = os.environ["GLANCE_API_KEY"]
GLANCE_API_URL = "https://api.glance-co.com/api/v1/scan"

def scan_email(from_addr, from_name=None, subject=None, headers=None):
    payload = {"from": from_addr}
    if from_name:
        payload["fromName"] = from_name
    if subject:
        payload["subject"] = subject
    if headers:
        payload["headers"] = headers

    resp = requests.post(
        GLANCE_API_URL,
        json=payload,
        headers={
            "Content-Type": "application/json",
            "X-API-Key": GLANCE_API_KEY,
        },
        timeout=5,
    )
    resp.raise_for_status()
    return resp.json()

# Usage
result = scan_email(
    from_addr="billing@paypa1-secure.com",
    from_name="PayPal Billing",
    subject="Your account has been limited",
    headers={"Authentication-Results": "spf=fail; dkim=none; dmarc=fail"},
)

print(f"Verdict: {result['verdict']}  Score: {result['threatScore']}")
print(f"Signals: {', '.join(result['signals'])}")

if result["verdict"] == "DANGEROUS":
    quarantine_message(message_id)