Malwarebytes Email Protection API

openapi: 3.2.0
info:
  title: Malwarebytes Email Protection API
  version: 1.0.0
  description: 'Operations tagged Email Protection across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Email Protection
paths:
  /nebula/v1/email-protection/integrations/domains:
    servers:
    - url: https://api.threatdown.com
    put:
      description: Add email protection domains for an account
      summary: Add domains
      security:
      - client_credentials:
        - write
      - user_permissions:
        - emailSecurity.view
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              title: Email Protection Add Domains Request
              description: Request to add domains from the email protection service.
              type: object
              required:
              - domains
              properties:
                domains:
                  type: array
                  title: Domains
                  description: A list of domain names to add
                  items:
                    type: string
                    format: hostname
                    example: example.com
                  example:
                  - example.com
                  - test.org
      responses:
        '200':
          description: response schema
          content:
            application/json:
              schema:
                title: Email Protection Add Domains Response
                description: Response containing the result of adding domains to the email protection service.
                type: object
                required:
                - domains_added
                - current_domains
                properties:
                  domains_added:
                    type: array
                    title: Added Domains
                    description: List of domains that were successfully added.
                    items:
                      type: string
                      format: hostname
                      example: newdomain.com
                    example:
                    - newdomain.com
                    - anotherdomain.org
                  current_domains:
                    type: array
                    title: Current Domains
                    description: List of all domains currently associated with the account after addition.
                    items:
                      type: string
                      format: hostname
                      example: existingdomain.com
                    example:
                    - existingdomain.com
                    - newdomain.com
      tags:
      - Email Protection
      operationId: api.mailware.put.email-protection.integrations.domains
    delete:
      description: Delete email protection domais for an account
      summary: Delete domains
      security:
      - client_credentials:
        - write
      - user_permissions:
        - emailSecurity.delete
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              title: Email Protection Delete Domains Request
              description: Request to delete domains from the email protection service.
              type: object
              required:
              - domains
              properties:
                domains:
                  type: array
                  title: Domains
                  description: A list of domain names to delete
                  items:
                    type: string
                    format: hostname
                    example: example.com
                  example:
                  - example.com
                  - test.org
      responses:
        '200':
          description: Successful response
      tags:
      - Email Protection
      operationId: api.mailware.delete.email-protection.integrations.domains
    get:
      description: Get email protection domains for an account
      summary: Get domains
      security:
      - client_credentials:
        - read
      - user_permissions:
        - emailSecurity.view
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      responses:
        '200':
          description: response schema
          content:
            application/json:
              schema:
                title: Email Protection Domains
                description: Response containing the domains for the accont's email protection service.
                type: object
                required:
                - domains
                properties:
                  domains:
                    type: array
                    title: Domains
                    description: A list of domain names.
                    items:
                      type: string
                      format: hostname
                      example: example.com
                    example:
                    - example.com
                    - test.org
      tags:
      - Email Protection
      operationId: api.mailware.get.email-protection.integrations.domains
  /nebula/v1/email-protection/account/911-mailbox:
    servers:
    - url: https://api.threatdown.com
    delete:
      description: Delete email protection 911 mailbox
      summary: Delete 911 mailbox
      security:
      - client_credentials:
        - write
      - user_permissions:
        - emailSecurity.delete
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      responses:
        '200':
          description: Successful response
      tags:
      - Email Protection
      operationId: api.mailware.delete.email-protection.account.911-mailbox
    get:
      description: Get email protection 911 mailbox
      summary: Get 911 mailbox
      security:
      - client_credentials:
        - read
      - user_permissions:
        - emailSecurity.view
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      responses:
        '200':
          description: response schema
          content:
            application/json:
              schema:
                title: Get 911 Mailbox Response
                description: Response to retrieve the 911 mailbox details.
                type: object
                properties:
                  email:
                    type: string
                    title: Email
                    description: The email address of the 911 mailbox.
                    example: alerts@example.com
      tags:
      - Email Protection
      operationId: api.mailware.get.email-protection.account.911-mailbox
    put:
      description: Edit email protection 911 mailbox
      summary: Edit 911 mailbox
      security:
      - client_credentials:
        - write
      - user_permissions:
        - emailSecurity.view
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              title: Edit 911 Mailbox Request
              description: Request to edit the 911 mailbox settings.
              type: object
              required:
              - email
              properties:
                email:
                  type: string
                  format: email
                  title: Email
                  description: The 911 mailbox mail address.
                  example: alerts@example.com
      responses:
        '200':
          description: response schema
          content:
            application/json:
              schema:
                title: Edit 911 Mailbox Response
                description: Response to edit the 911 mailbox details.
                type: object
                required:
                - email
                - is_enabled
                - message
                properties:
                  email:
                    type: string
                    format: email
                    title: Email
                    description: The email address of the 911 mailbox.
                    example: alerts@example.com
                  is_enabled:
                    type: boolean
                    title: Is Enabled
                    description: Indicates whether the 911 mailbox is enabled.
                    example: true
                  message:
                    type: string
                    title: Message
                    description: Status or informational message related to the update operation.
                    example: 911 mailbox updated successfully.
      tags:
      - Email Protection
      operationId: api.mailware.put.email-protection.account.911-mailbox
  /nebula/v1/email-protection/account/disable:
    servers:
    - url: https://api.threatdown.com
    delete:
      description: Delete email protection account
      summary: Delete account
      security:
      - client_credentials:
        - write
      - user_permissions:
        - emailSecurity.delete
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      responses:
        '200':
          description: Successful response
      tags:
      - Email Protection
      operationId: api.mailware.delete.account
  /nebula/v1/email-protection/account/auto-sync:
    servers:
    - url: https://api.threatdown.com
    delete:
      description: Disable email protection account auto-sync
      summary: Disable auto-sync
      security:
      - client_credentials:
        - read
      - user_permissions:
        - emailSecurity.delete
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      responses:
        '200':
          description: Successful response
      tags:
      - Email Protection
      operationId: api.mailware.delete.email-proteciton.account.auto-sync
    get:
      description: Get email protection account auto-sync status
      summary: Get auto-sync status
      security:
      - client_credentials:
        - read
      - user_permissions:
        - emailSecurity.view
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      responses:
        '200':
          description: response schema
          content:
            application/json:
              schema:
                title: Auto Sync Status
                description: Status of the auto synchronization for email protection.
                type: object
                required:
                - in_progress
                - mailboxes_total_count
                - protected_mailboxes_count
                - enabled_mailboxes_count
                - failed_mailboxes_count
                - last_synced_at
                properties:
                  in_progress:
                    type: boolean
                    title: Sync In Progress
                    example: true
                  mailboxes_total_count:
                    type: integer
                    title: Total Mailboxes
                    example: 150
                  protected_mailboxes_count:
                    type: integer
                    title: Protected Mailboxes
                    example: 120
                  enabled_mailboxes_count:
                    type: integer
                    title: Enabled Mailboxes
                    example: 130
                  failed_mailboxes_count:
                    type: integer
                    title: Failed Mailboxes
                    example: 5
                  last_synced_at:
                    type: string
                    format: date-time
                    title: Last Synced Timestamp
                    example: '2025-05-14T12:34:56Z'
      tags:
      - Email Protection
      operationId: api.mailware.get.email-protection.account.auto-sync
    post:
      description: Enable email protection account auto-sync
      summary: Enable auto-sync
      security:
      - client_credentials:
        - write
      - user_permissions:
        - emailSecurity.view
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              title: Activate Auto Sync Request
              description: Request to activate auto synchronization for email protection.
              type: object
              properties:
                sync_shared_mailboxes:
                  type: boolean
                  title: Sync Shared Mailboxes
                  example: true
                trigger_now:
                  type: boolean
                  title: Trigger Synchronization Immediately
                  example: false
                groups:
                  type: array
                  title: Groups to Include in Sync
                  items:
                    type: object
                    additionalProperties:
                      type: string
                    example:
                      group_id: '123'
                      group_name: Engineering
                  example:
                  - group_id: '123'
                    group_name: Engineering
                  - group_id: '456'
                    group_name: Marketing
      responses:
        '200':
          description: Successful response
      tags:
      - Email Protection
      operationId: api.mailware.post.email-protection.account.auto-sync
  /nebula/v1/email-protection/configurations/allow-list:
    servers:
    - url: https://api.threatdown.com
    delete:
      description: Delete an email protection configurations allow list entry for an account
      summary: Delete allow list entry
      security:
      - client_credentials:
        - write
      - user_permissions:
        - emailSecurity.delete
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              title: Delete allow list entries request
              type: object
              properties:
                ids:
                  type: array
                  description: List of allow list entry IDs to delete.
                  minItems: 1
                  items:
                    type: integer
                  example:
                  - 101
                  - 102
                  - 103
              required:
              - ids
              example:
                ids:
                - 101
                - 102
                - 103
      responses:
        '200':
          description: Successful response
      tags:
      - Email Protection
      operationId: api.mailware.delete.email-protection.configurations.allow-list
    post:
      description: Create a new email protection configurations allow list entry for an account
      summary: Create allow list entry
      security:
      - client_credentials:
        - write
      - user_permissions:
        - emailSecurity.view
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              title: Create Allow List Entry
              type: object
              properties:
                type:
                  type: integer
                  enum:
                  - 1
                  - 2
                  - 3
                  - 4
                  description: 'Type of whitelist entry: 1=IP Network (for IP addresses or CIDR notation), 2=Domain (for domain names), 3=Sender Address (for email addresses), 4=Unscanned Domain Link (for domain names in links)'
                scope:
                  type: integer
                  enum:
                  - 1
                  - 2
                  - 3
                  - 4
                  - 6
                  description: 'Scope of allow list entry (optional): 1=Skip All Inspections, 2=Bypass Impersonation Banners, 3=Bypass link clicking by IRONSCALES, 4=Spam Filter, 6=Bypass all scanning for links'
                value:
                  type: string
                  description: The value to allow (required).
                comment:
                  type: string
                  description: Optional comment.
                external_campaigns:
                  type: boolean
                  description: Whether entry applies to external campaigns.
                ignore_auth:
                  type: boolean
                  description: Whether authentication should be ignored.
              required:
              - type
              - value
      responses:
        '200':
          description: Successful response
      tags:
      - Email Protection
      operationId: api.mailware.post.email-protection.configurations.allow-list
    put:
      description: Update email protection configurations allow list for an account
      summary: Update allow list
      security:
      - client_credentials:
        - write
      - user_permissions:
        - emailSecurity.view
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      requestBody:
        content:
          application/json:
            schema:
              title: Update Allow List Entry
              type: object
              properties:
                type:
                  type: integer
                  enum:
                  - 1
                  - 2
                  - 3
                  - 4
                  description: 'Type of whitelist entry: 1=IP Network (for IP addresses or CIDR notation), 2=Domain (for domain names), 3=Sender Address (for email addresses), 4=Unscanned Domain Link (for domain names in links).'
                  example: 2
                scope:
                  type: integer
                  enum:
                  - 1
                  - 2
                  - 3
                  - 4
                  - 6
                  description: 'Scope of allow list entry (optional): 1=Skip All Inspections, 2=Bypass Impersonation Banners, 3=Bypass link clicking by IRONSCALES, 4=Spam Filter, 6=Bypass all scanning for links.'
                  example: 1
                value:
                  type: string
                  description: The value to allow (required).
                  example: example.com
                comment:
                  type: string
                  description: Optional comment.
                  example: Updated entry to expand scope
                external_campaigns:
                  type: boolean
                  description: Whether entry applies to external campaigns.
                  example: true
                ignore_auth:
                  type: boolean
                  description: Whether authentication should be ignored.
                  example: false
                id:
                  type: integer
                  description: The unique identifier for the allow list entry.
                  example: 101
              required:
              - type
              - value
              - id
              example:
                type: 2
                scope: 1
                value: example.com
                comment: Updated entry to expand scope
                external_campaigns: true
                ignore_auth: false
                id: 101
      responses:
        '200':
          description: Successful response
      tags:
      - Email Protection
      operationId: api.mailware.put.email-protection.configurations.allow-list
  /nebula/v1/email-protection/integrations/disable:
    servers:
    - url: https://api.threatdown.com
    delete:
      description: Disable integration with Google Workspace or O365
      summary: Disable Integration
      security:
      - client_credentials:
        - read
      - user_permissions:
        - emailSecurity.delete
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      responses:
        '200':
          description: Successful response
      tags:
      - Email Protection
      operationId: api.mailware.post.integrations.disable
  /nebula/v1/email-protection/account/details:
    servers:
    - url: https://api.threatdown.com
    get:
      description: Get email protection account details
      summary: Get account details
      security:
      - client_credentials:
        - read
      - user_permissions:
        - emailSecurity.view
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      responses:
        '200':
          description: response schema
          content:
            application/json:
              schema:
                title: Get Account Details Response
                type: object
                properties:
                  name:
                    type: string
                    example: Acme Corp
                  domain:
                    type: string
                    example: acme.com
                  owner_email:
                    type: string
                    format: email
                    example: owner@acme.com
                  owner_name:
                    type: string
                    example: Jane Doe
                  country:
                    type: string
                    example: US
                  registration_date:
                    type: string
                    format: date-time
                    example: '2025-04-11T09:04:45Z'
                  test_mode:
                    type: boolean
                    example: false
                  is_msp:
                    type: boolean
                    example: true
                  last_mailbox_sync_date:
                    type: string
                    format: date-time
                    example: '2025-04-11T09:04:45Z'
                  license:
                    type: object
                    properties:
                      trial_expiration:
                        type: string
                        format: date-time
                        example: '2025-06-01T00:00:00Z'
                      planExpiration:
                        type: string
                        format: date-time
                        example: '2025-12-31T23:59:59Z'
                      mailbox_limit:
                        type: integer
                        example: 500
                      active_mailboxes:
                        type: integer
                        example: 320
                      protected_mailboxes:
                        type: integer
                        example: 290
                    required:
                    - trial_expiration
                    - planExpiration
                    - mailbox_limit
                    - active_mailboxes
                    - protected_mailboxes
                required:
                - name
                - domain
                - owner_email
                - owner_name
                - country
                - registration_date
                - test_mode
                - is_msp
                - last_mailbox_sync_date
                - license
      tags:
      - Email Protection
      operationId: api.mailware.get.account.details
  /nebula/v1/email-protection/account/settings:
    servers:
    - url: https://api.threatdown.com
    get:
      description: Get email protection account settings
      summary: Get account settings
      security:
      - client_credentials:
        - read
      - user_permissions:
        - emailSecurity.view
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        description: Authorization token
        schema:
          type: string
      - name: accountid
        required: true
        in: header
        description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
        schema:
          type: string
          pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
      responses:
        '200':
          description: response schema
          content:
            application/json:
              schema:
                title: Email Protection Get Account Settings Response
                description: Response containing the account settings for email protection services.
                type: object
                properties:
                  silent_mode:
                    type: boolean
                  silent_mode_msg:
                    type: boolean
                  ato:
                    type: boolean
                  service_management:
                    type: boolean
                  awareness_training:
                    type: boolean
                  api:
                    type: boolean
                  advisor:
                    type: boolean
                  attachments_scan:
                    type: boolean
                  links_scan:
                    type: boolean
                  st_bundle:
                    type: boolean
                  st_plus_bundle:
                    type: boolean
                  ai_empower_bundle:
                    type: boolean
                  autopilot_enabled:
                    type: boolean
                required:
                - silent_mode
                - silent_mode_msg
                - ato
                - service_management
                - awareness_training
                - api
                - advisor
                - attachments_scan
                - links_scan
                - st_bundle
                - st_plus_bundle
                - ai_empower_bundle
                - autopilot_enabled
      tags:
      - Email Protection
      operationId: api.mailware.get.email-protection.account.settings
    put:
      description: Edit email protection account settings
      summary: Edit account settings
      security:
      - client_credentials:
        - write
      - user_permissions:
        - emailSecurity.view
      status:
        outage:
        - auth
      parameters:
      - name: authorization
        required: true
        in: header
        

# --- truncated at 32 KB (407 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-email-protection-api-openapi.yml