ScamAssassin API reference

Endpoints

Base URL: https://api.syndaq.com

Assess

Request body (POST)

{
  "type": "email",
  "value": "[email protected]"
}

You may also send a typed shorthand:

{ "email": "[email protected]" }

Query (GET)

GET /v1/scamassassin/assess?type=email&value=user%40example.com

Supported types

email, phone, ip, username, address, crypto, domain, url

Coverage depth varies by type and continues to expand over time. Unsupported depth for a type still returns a valid assessment with lower coverage rather than refusing the call.

Response shape

{
  "success": true,
  "request_id": "req_…",
  "cached": false,
  "identifier": {
    "type": "email",
    "masked": "u***@e***.com"
  },
  "assessment": {
    "risk_score": 78,
    "risk_level": "high",
    "confidence": 0.84,
    "coverage": {
      "sources_queried": 4,
      "sources_responded": 4,
      "independent_matches": 2
    },
    "recommendation": "manual_review"
  },
  "signals": [
    {
      "code": "EMAIL_ABUSE_HISTORY",
      "severity": "high",
      "confidence": 0.91,
      "last_seen": "2026-07-08T14:31:00+00:00"
    }
  ],
  "report_summary": {
    "total_reports": 2,
    "verified_reports": 0,
    "disputed_reports": 0,
    "categories": ["account_abuse"]
  },
  "limitations": [
    "The result represents identifier risk and does not establish the identity or criminal conduct of a person.",
    "No match should be treated as proof that an identifier is safe."
  ],
  "generated_at": "2026-07-15T21:10:00+00:00"
}

Risk levels

Recommendations

Caching

Recent assessments for the same normalized identifier are reused for a period of time. Cached responses set "cached": true and mint a fresh request_id.

Status

curl -sS https://api.syndaq.com/v1/scamassassin/status \
  -H "Authorization: Bearer sa_sec_YOUR_KEY"

Returns plan slug, rate limit, quota remaining, and supported_types.

Errors