DMARC Examiner Forensic Reports API

openapi: 3.2.0
info:
  title: Dmarc Examiner Com Forensic Reports API
  version: 1.0.0
  contact:
    email: support@dmarc-examiner.com
    url: https://dmarc-examiner.com
  license:
    name: Proprietary
  description: 'Operations tagged Forensic Reports across 2 of this provider''s published API definitions: dmarc-examiner-com-openapi.yaml, openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.dmarc-examiner.com
  description: Production
security:
- ApiKeyAuth: []
tags:
- name: Forensic Reports
  description: Access DMARC RUF (forensic) reports — Pro plan and above
paths:
  /api/v1/forensic-reports:
    get:
      operationId: listForensicReports
      summary: List forensic reports
      description: 'Returns DMARC RUF (forensic) reports with optional filtering and pagination.


        Returns `403 Forbidden` if the organization''s plan does not include forensic reports.'
      tags:
      - Forensic Reports
      parameters:
      - name: domain_id
        in: query
        required: false
        schema:
          type: string
          format: uuid
      - name: date_from
        in: query
        description: Filter by `arrival_date >= this value` (ISO 8601 / `YYYY-MM-DD HH:MM:SS`).
        required: false
        schema:
          type: string
      - name: date_to
        in: query
        required: false
        schema:
          type: string
      - name: source_ip
        in: query
        required: false
        schema:
          type: string
      - name: auth_failure
        in: query
        required: false
        schema:
          type: string
          enum:
          - dmarc
          - spf
          - dkim
      - name: page
        in: query
        required: false
        schema:
          type: integer
          default: 1
          minimum: 1
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          default: 20
          minimum: 1
          maximum: 100
      responses:
        '200':
          description: Paginated list of forensic reports
          content:
            application/json:
              schema:
                type: object
                required:
                - data
                - pagination
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ForensicReport'
                  pagination:
                    $ref: '#/components/schemas/Pagination'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/FeatureNotAvailable'
        '429':
          $ref: '#/components/responses/RateLimited'
        '500':
          $ref: '#/components/responses/ServerError'
    servers:
    - url: https://api.dmarc-examiner.com
      description: Production
  /api/v1/forensic-reports/summary:
    get:
      operationId: getForensicReportsSummary
      summary: Forensic reports summary (last 7 days)
      tags:
      - Forensic Reports
      responses:
        '200':
          description: Summary
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForensicSummary'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/FeatureNotAvailable'
        '429':
          $ref: '#/components/responses/RateLimited'
    servers:
    - url: https://api.dmarc-examiner.com
      description: Production
  /api/v1/forensic-reports/statistics:
    get:
      operationId: getForensicReportsStatistics
      summary: Forensic reports aggregated statistics
      description: Returns counters grouped by auth failure type, delivery result, source IP (with geolocation) and reported domain.
      tags:
      - Forensic Reports
      responses:
        '200':
          description: Aggregated statistics
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForensicStatistics'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/FeatureNotAvailable'
        '429':
          $ref: '#/components/responses/RateLimited'
    servers:
    - url: https://api.dmarc-examiner.com
      description: Production
  /api/v1/forensic-reports/{id}:
    get:
      operationId: getForensicReport
      summary: Get forensic report detail
      tags:
      - Forensic Reports
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Forensic report with original headers
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForensicReportDetail'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/FeatureNotAvailable'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/RateLimited'
    servers:
    - url: https://api.dmarc-examiner.com
      description: Production
components:
  responses:
    NotFound:
      description: Resource not found.
      content:
        application/json:
          schema:
            type: object
            required:
            - message
            properties:
              message:
                type: string
                example: Report not found
    Unauthorized:
      description: 'Authentication failed. Two shapes are possible depending on cause:

        - **Invalid or revoked key** — body is `{"message": "..."}` only.

        - **Missing `X-API-Key` header** — body adds an `error: "unauthorized"` machine-readable code.

        Clients should treat both as the same outcome and read `message` for display.

        '
      content:
        application/json:
          schema:
            type: object
            required:
            - message
            properties:
              error:
                type: string
                description: Present only when the request had no `X-API-Key` header at all.
                enum:
                - unauthorized
              message:
                type: string
                example: Invalid API key
    RateLimited:
      description: Rate limit exceeded.
      content:
        application/json:
          schema:
            type: object
            required:
            - message
            properties:
              message:
                type: string
                example: Rate limit exceeded. Maximum 100 requests per minute.
    FeatureNotAvailable:
      description: 'The organization''s current plan does not include the feature required by this endpoint

        (e.g. `apiAccess`, `forensicReports`, `advancedAlerts`). Distinct from `PlanLimitExceeded`

        (HTTP 402), which signals a *quota* exhausted on a feature the plan does include.


        If a customer downgrades to Free, all `/api/v1/*` requests will start returning this response.

        '
      content:
        application/json:
          schema:
            type: object
            required:
            - error
            - message
            - feature
            - current_plan
            properties:
              error:
                type: string
                enum:
                - feature_not_available
              message:
                type: string
                example: 'Feature "apiAccess" is not available in your current plan: Free. Please upgrade.'
              feature:
                type: string
                example: apiAccess
              current_plan:
                type: string
                example: free
    BadRequest:
      description: "Request payload, body field, or query parameter is missing, malformed,\noutside documented bounds, or fails type/enum validation.\n\nTwo body shapes can occur:\n- **Body validation errors** (e.g. missing `name`, wrong type) come from\n  the controller and have the form `{\"message\": \"...\"}`.\n- **Query parameter errors** (e.g. `limit` out of range, `auth_failure`\n  off-enum, `domain_id` not a UUID) flow through the API exception\n  subscriber and add an `error: \"bad_request\"` machine-readable code:\n  `{\"error\": \"bad_request\", \"message\": \"Query parameter \\\"limit\\\" must be between 1 and 100, got 999\"}`.\n"
      content:
        application/json:
          schema:
            type: object
            required:
            - message
            properties:
              error:
                type: string
                description: Present on query-parameter validation errors. Absent on body validation errors.
                enum:
                - bad_request
              message:
                type: string
                example: Domain name is required
    ServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            type: object
            required:
            - message
            properties:
              message:
                type: string
  schemas:
    ForensicReport:
      type: object
      required:
      - id
      - source_ip
      - reported_domain
      - auth_failure
      - arrival_date
      - created_at
      properties:
        id:
          type: string
          format: uuid
        domain:
          type: object
          required:
          - id
          - name
          properties:
            id:
              type: string
              format: uuid
            name:
              type: string
        source_ip:
          type: string
          example: 198.51.100.42
        original_mail_from:
          type:
          - string
          - 'null'
        reported_domain:
          type: string
          example: example.com
        auth_failure:
          type: string
          enum:
          - dmarc
          - spf
          - dkim
        delivery_result:
          type:
          - string
          - 'null'
          example: delivered
        dkim_result:
          type:
          - string
          - 'null'
        spf_result:
          type:
          - string
          - 'null'
        arrival_date:
          type: string
          format: date-time
        created_at:
          type: string
          format: date-time
    ForensicReportDetail:
      allOf:
      - $ref: '#/components/schemas/ForensicReport'
      - type: object
        properties:
          original_rcpt_to:
            type:
            - string
            - 'null'
          dmarc_result:
            type:
            - string
            - 'null'
          authentication_results:
            type:
            - string
            - 'null'
          subject:
            type:
            - string
            - 'null'
          reporter_name:
            type:
            - string
            - 'null'
          original_headers:
            type:
            - string
            - 'null'
            description: Decoded original message headers (when available).
          geo:
            type:
            - object
            - 'null'
            description: Geolocation lookup of `source_ip` (provider-shaped object; may be null if lookup failed).
    Pagination:
      type: object
      required:
      - total
      - page
      - limit
      - total_pages
      properties:
        total:
          type: integer
          description: Total number of results.
        page:
          type: integer
          description: Current page number.
        limit:
          type: integer
          description: Results per page.
        total_pages:
          type: integer
          description: Total number of pages.
    ForensicSummary:
      type: object
      required:
      - total_7d
      - by_auth_failure
      - top_source_ips
      properties:
        total_7d:
          type: integer
          description: Number of forensic reports received in the last 7 days.
        by_auth_failure:
          type: object
          additionalProperties:
            type: integer
          example:
            dmarc: 12
            spf: 3
            dkim: 1
        top_source_ips:
          type: array
          items:
            type: object
            required:
            - ip
            - count
            properties:
              ip:
                type: string
              count:
                type: integer
    ForensicStatistics:
      type: object
      required:
      - total
      - by_auth_failure
      - by_delivery_result
      - by_source_ip
      - by_domain
      properties:
        total:
          type: integer
        by_auth_failure:
          type: object
          additionalProperties:
            type: integer
        by_delivery_result:
          type: object
          additionalProperties:
            type: integer
        by_source_ip:
          type: array
          items:
            type: object
            required:
            - ip
            - count
            properties:
              ip:
                type: string
              count:
                type: integer
              geo:
                type:
                - object
                - 'null'
        by_domain:
          type: object
          additionalProperties:
            type: integer
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: API key in format `dex_` followed by 32 hex characters. Create keys in Settings > API Keys.
x-refined-from:
- dmarc-examiner-com-openapi.yaml
- openapi.yaml