🚀 Experience the new and improved APIVoid! Check out what's new
A JSON API to parse and analyze EML email files. It extracts structured data such as headers, attachments (filename and md5 hash), message body, sender email, sender IP address, URLs in body and much more. Can be integrated in your workflow to automate EML analysis.
Consumes 2 credits per API call
# Example Curl request from the command line:
curl -X POST "https://api.apivoid.com/v2/eml-insights" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY_HERE" \
-d '{"eml_base64": "RW5jb2RlIGFuZCBkZWNv..."}'
# Example JSON output for a 200 HTTP status code:
{
"metadata": {
"message_id": "03302025091220980F708C98$443242D40E@hmlca.com",
"message_sha256_hash": "cd4e43afb13eef0e381d814ef1ac9d7d91086227131d69477d285d37d411e11b",
"date_time": "Thu, 04 Sep 2025 03:19:11 +0000 (UTC)",
"date_time_normalized": "2025-09-04T03:19:11Z"
},
"headers": {
"subject": "Attention: Access Re-activation \"receiver@gmail.com\": 03 September 2025",
"from_name": "Gmail Message Center",
"from_email": "rachelle@hmlca.com",
"return_path": "bounces+45627169-2aff-receiver=gmail.com@em8374.hmlca.com",
"reply_to": "",
"delivered_to": "receiver@gmail.com",
"to": [
"receiver@gmail.com"
],
"cc": [],
"bcc": [],
"content_type": "multipart/alternative",
"user_agent": "",
"x_mailer": "",
"x_library": "",
"list_unsubscribe": [],
"received_spf": "pass (google.com: domain of bounces+45627169-2aff-receiver=gmail.com@em8374.hmlca.com designates 50.31.49.42 as permitted sender) client-ip=50.31.49.42;",
"authentication_results": "mx.google.com; dkim=pass header.i=@hmlca.com header.s=s1 header.b=ZODWUU6W; dkim=pass header.i=@sendgrid.info header.s=smtpapi header.b=TObU1x+p; spf=pass (google.com: domain of bounces+45627169-2aff-receiver=gmail.com@em8374.hmlca.com designates 50.31.49.42 as permitted sender) smtp.mailfrom=\"bounces+45627169-2aff-receiver=gmail.com@em8374.hmlca.com\"",
"dkim_signatures": [
{
"signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=hmlca.com; h=from:subject:content-type:mime-version:date:to:cc:content-type:date: feedback-id:from:subject:to; s=s1; bh=HJ8h3pw+by1D2B7wJ1CO124/fwcuPkzoSMMdSbprGHM=; b=ZODWUU6WGZ+c6NCsyBNIceOX8FH62ZNR8yKgIPKq7O/Qm154ukSRXGy5FHkMeASDXN60 1LOg0VRKKBYXQmtgFTt1a1UFmr5KDE8dK9qLII5iRJ2lyQ7xhVy4qEF3csuCkHO63Uhv3M VEcP8kojPTtQDEC+3p3iIhS6aXOAz4YJ6rSPZga1KyJ/OF9rCBaq925JdAGZw2cnyORkhA ZlWoQIosQI7mIimf28Lj9idAPXXaCIJaf0CeG0/sAfTEexTHm7QrE3kUxZmoKTwyfUB824 QZV2a0YuIu4dKC9mLDkS7sRs+pcAk9dhsRMrUp33JUREhFKBvh9flfVDL4Rx+ocA==",
"selector": "s1",
"domain": "hmlca.com",
"algo": "rsa-sha256",
"key_type": "rsa",
"canon": "relaxed/relaxed",
"hash": "HJ8h3pw+by1D2B7wJ1CO124/fwcuPkzoSMMdSbprGHM=",
"key_bits": 2048,
"dnssec": false
},
{
"signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.info; h=from:subject:content-type:mime-version:date:to:cc:content-type:date: feedback-id:from:subject:to; s=smtpapi; bh=HJ8h3pw+by1D2B7wJ1CO124/fwcuPkzoSMMdSbprGHM=; b=TObU1x+puLv0hicu+Mpsh0MdJOZZ53xPGSytO8RVzZxUkCerEHT7xodzIiwjVTeDiFZ8 AU09HqWfE+Czdox4CpFTB0qBd0xENHcM0rS3P2SQbgWKWA2vaZ6dMm2MIAZVxOf49T20Zf vwSCIPHuPqV/dF2mTM7reRxF11XJP6428=",
"selector": "smtpapi",
"domain": "sendgrid.info",
"algo": "rsa-sha256",
"key_type": "rsa",
"canon": "relaxed/relaxed",
"hash": "HJ8h3pw+by1D2B7wJ1CO124/fwcuPkzoSMMdSbprGHM=",
"key_bits": 1024,
"dnssec": false
}
]
},
"body": {
"body_text": "Webmail\n\nDear User, receiver@gmail.com\n\nOur system indicates that your password has expired as part of our regular security maintenance. To continue accessing your webmail account without interruption, please take a moment to verify or update your password.\n\nKeep or Update Password https://u45627169.ct.sendgrid.net/ls/click?upn=u001.ilzQdWVrM538qTJ1Qrct2U7gPpD0uoiQECwlDuMspitwulZl7U-2FY3vakOIItSIS1XybaLMtdZ8kaccaNGzDgJl-2BToMxJ70rUoLmY-2BOC8PLL0c-2BbFqtEXLRZwr1fTYBGE4GK8_s0lTyPdoyuzn-2FJTE9fjR8gd4LnXMu4OKG3YpbxosU77i-2FfG4C2MUtEIoCJlrCv4kYhNLpFkGAbHAHEur7tKY3BDYlNZ-2BPfxo0M8IB5fyCQzRQA3YpmmqcpZY3xE1ZWT8ippFzgvcPAn1RCDWmrJUM-2B-2BMsAKXQT8fMw1snmBQJtoed9kNb8hvoZBHFaP3MV0uwsrhx-2FTGxvGGACZrGEwN6g-3D-3D\n\n© 2025 Gmail Webmail. All rights reserved.\n\nThis email was sent to you as a registered user for Gmail Webmail services."
},
"attachments": {
"files": [
{
"name": "invoice.zip",
"extension": ".zip",
"is_risky_extension": false,
"content_type": "application/zip",
"size": 4042,
"md5_hash": "d7b44bedb42ca39681c32cda0678af11",
"is_inline": false,
"content_id": "",
"disposition": "attachment",
"cid_referenced": false,
"is_document": false,
"is_archive": true,
"is_archive_encrypted": false,
"extracted_files": [
{
"name": "Invoice_N10092025.bat",
"extension": ".bat",
"is_risky_extension": true,
"is_document": false,
"is_archive": false,
"is_archive_encrypted": false,
"last_modified_at": "2025-10-23T21:57:18Z",
"size": 10494,
"md5_hash": "10d47269e0872ef218701703722d67d9"
}
]
}
],
"file_extensions": [
".zip",
".bat"
],
"md5_hashes": [
"d7b44bedb42ca39681c32cda0678af11",
"10d47269e0872ef218701703722d67d9"
]
},
"ioc": {
"urls": {
"urls": [
"https://u45627169.ct.sendgrid.net/ls/click?upn=u001.ilzQdWVrM538qTJ1Qrct2U7gPpD0uoiQECwlDuMspitwulZl7U-2FY3vakOIItSIS1XybaLMtdZ8kaccaNGzDgJl-2BToMxJ70rUoLmY-2BOC8PLL0c-2BbFqtEXLRZwr1fTYBGE4GK8_s0lTyPdoyuzn-2FJTE9fjR8gd4LnXMu4OKG3YpbxosU77i-2FfG4C2MUtEIoCJlrCv4kYhNLpFkGAbHAHEur7tKY3BDYlNZ-2BPfxo0M8IB5fyCQzRQA3YpmmqcpZY3xE1ZWT8ippFzgvcPAn1RCDWmrJUM-2B-2BMsAKXQT8fMw1snmBQJtoed9kNb8hvoZBHFaP3MV0uwsrhx-2FTGxvGGACZrGEwN6g-3D-3D",
"https://u45627169.ct.sendgrid.net/ls/click?upn=u001.ilzQdWVrM538qTJ1Qrct2U7gPpD0uoiQECwlDuMspitwulZl7U-2FY3vakOIItSIS1XybaLMtdZ8kaccaNGzDgJl-2BToMxJ70rUoLmY-2BOC8PLL0c-2BbFqtEXLRZwr1fTYBGEss7q_s0lTyPdoyuzn-2FJTE9fjR8gd4LnXMu4OKG3YpbxosU77i-2FfG4C2MUtEIoCJlrCv4kYhNLpFkGAbHAHEur7tKY3F-2FD5IvO2YiTDo-2FzLySkdPDOf5vAvMnJ-2BOrn7sm3lqiymM-2FOaZ4HgVbc7zC0ofWQJS39zRgu577y715r7QFnLA7WRSM8BjNM9dxCWxewBaVs1C5v32uEs6TuG4yZ4VATsg-3D-3D",
"https://u45627169.ct.sendgrid.net/wf/open?upn=u001.XFGmjoWdSYLGbF2-2B-2B1O-2F8nE80NrNtyU8ZMdTu2BP-2FZRTyD4PEuraAR9MERxO5qS-2FDx2o-2BBEM7SMpl99PzpPvLgvkmWCq7tYo8dnfKyMkLo-2Bhe8sfZ34j-2BF6DXfFpV8wMX6JIvbuqLpoS8iahL-2FvGO7bSCoH37gpRuT1HchqBaZKb3tBsuZKMPEr4fLjwpt7USWnFswkKA8yfCAOlSCsitDkvS411Nmxy1dzGYibBxNY-3D"
],
"redirects": [
"https://vvtrt.b-cdn.net/cubggg%20(2)%20-%20Copy.html"
],
"direct_downloads": [],
"with_ip_host": [],
"domains": [
"u45627169.ct.sendgrid.net",
"vvtrt.b-cdn.net"
],
"root_domains": [
"sendgrid.net",
"b-cdn.net"
],
"tlds": [
"net"
]
},
"emails": {
"emails": [
"receiver@gmail.com",
"rachelle@hmlca.com"
],
"domains": [
"gmail.com",
"hmlca.com"
],
"root_domains": [
"gmail.com",
"hmlca.com"
],
"tlds": [
"com"
]
},
"received_from": {
"domains": [
"s.pnkfpknx.outbound-mail.sendgrid.net",
"mx.google.com",
"whm002.searchcontrol.com"
],
"root_domains": [
"sendgrid.net",
"google.com",
"searchcontrol.com"
],
"tlds": [
"net",
"com"
]
},
"dkim_domains": {
"domains": [
"hmlca.com",
"sendgrid.info"
],
"root_domains": [
"hmlca.com",
"sendgrid.info"
],
"tlds": [
"com",
"info"
]
},
"bitcoin_addresses": [],
"phone_numbers": []
},
"sender_details": {
"email": "rachelle@hmlca.com",
"domain": "hmlca.com",
"root_domain": "hmlca.com",
"tld": "com",
"ip_address": "50.31.49.42",
"hostname": "s.pnkfpknx.outbound-mail.sendgrid.net",
"hostname_root_domain": "sendgrid.net",
"hostname_tld": "net",
"helo": "",
"helo_root_domain": "",
"helo_tld": ""
},
"security_details": {
"spf_status": "pass",
"dkim_status": "pass",
"dmarc_status": "",
"compauth_status": "",
"dara_status": "",
"tls_status": "",
"dmarc_policy": "",
"dmarc_subdomain_policy": "",
"dmarc_disposition": "",
"total_to_emails": 1,
"total_cc_emails": 0,
"total_bcc_emails": 0,
"is_mime_html_only": false,
"has_undisclosed_recipients": false,
"is_detected_by_server_antispam": false,
"sender_is_recipient": false,
"sender_and_reply_to_different_domain": false,
"sender_and_reply_to_different_email": false,
"sender_rdns_empty": false,
"reply_to_free_email": false,
"has_unsubscribe_link": false,
"high_value_money_found": false,
"has_urls_with_ip_host": false,
"is_body_text_empty": false,
"sent_outside_business_hours": true,
"sent_on_night_hours": true,
"sent_at_time": "3:19 AM",
"total_attachments": 1,
"has_risky_file_extensions": true,
"has_document_files": false,
"has_archive_files": true,
"has_encrypted_archive_files": false,
"urgency": "high"
},
"elapsed_ms": 551
}
Key Features
Businesses and startups use this EML Insights API to parse and inspect email contents, analyze headers and attachments, extract IoCs, retrieve sender details, and gain valuable security insights.
Get important headers like subject, to, cc, bcc, reply-to, delivered-to, body text (without HTML).
The API can extract attachments, calculate md5 file hash, get filenames and extensions, extract ZIP archives.
Find valuable IoCs like URLs in body, final URLs (follow redirects), email domains, sender IP address.
Check if SPF, DKIM, DMARC and CompAuth status, get DKIM signature details, DMARC policy and SMTP info.
Common Use Cases
Our API can be used in many ways, from cybersecurity tasks to workflow automations. Here we showcase the most popular use cases according to our customers usage:
Get important details about EML content, parse all important fields and get a detailed security report.
Check email body and extract URLs, domains, emails, telephone numbers, bitcoin addresses.
Extract all attachments and get filenames, file extensions, md5 hashes and ZIP archives details.
Easily integrate this API in your cybsersecurity workflow to effectively parse and analyze EML files.
USAGE EXAMPLE
All it takes is a HTTPS POST request with JSON payload to our endpoint, and you’ll receive the response within seconds, usually within 1-3 seconds. Here are a few code examples to use the API:
$eml_base64 = 'RW5jb2RlIGFuZCBkZWNv...';
$apiUrl = 'https://api.apivoid.com/v2/eml-insights';
$apiKey = 'your_api_key_here';
$ch = curl_init($apiUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(['eml_base64' => $eml_base64]));
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($httpCode === 200) {
$responseData = json_decode($response, true);
print_r($responseData);
}Create your account, pick a subscription plan, and make your first API call instantly with your API key—simple as that!
Get started now