Security & Threat Intelligence API

Monitor automated anomaly alerts, inspect abnormal delivery volume spikes, and review security telemetry across user email aliases.

Quick Reference

Anomaly Detection & Threat Heuristics

AliasFleet continuously inspects incoming delivery envelopes to protect account reputation and detect credential abuse or spam targeting. The security engine evaluates traffic patterns against dynamic behavioral heuristics:

flowchart TD
    A["Inbound Delivery Stream"] --> B{"Burst Heuristics"}
    B -- "Normal Flow" --> C["Deliver to Forwarding Destination"]
    B -- "Spike > Baseline Threshold" --> D["Create Security Alert"]
    D --> E["Capture Forensic Envelope Samples"]
    E --> F["Notify Account & Flag in Security API"]
    F --> G{"Remediation Flow"}
    G -- "Interactive Session" --> H["POST /v1/security/suspicious-activity (Dismiss)"]
    G -- "Automation" --> I["Automated Quarantine via Rules Engine"]

Anomaly Triggers

1. Volumetric Delivery Bursts: An alias receiving sudden, high-frequency inbound transmissions that significantly deviate from historical hourly baselines.
2. Brute-Force Sender Probing: Repetitive message attempts from rotating subdomains, ephemeral origin servers, or recognized spam distribution networks.
3. Repeated Denylist Collisions: Multiple consecutive delivery attempts from sender addresses or domains explicitly configured in your inbound firewall denylist.

List Active Security Alerts

GET /v1/security/suspicious-activity

Retrieves all active, unresolved security alerts generated for the authenticated user's aliases. Alerts remain active until explicitly dismissed.

Query Parameters

This endpoint accepts no query parameters. It returns all unresolved alerts for the authenticated tenant ordered by lastAttemptAt descending.

Request Headers

cURL Example

curl -X GET "https://api.aliasfleet.com/v1/security/suspicious-activity" \
  -H "Authorization: Bearer afp_live_9k3mF7qP2xL8vN5yR1wZ4tC6bJ0sD" \
  -H "Accept: application/json"

Response (200 OK)

{
  "alerts": [
    {
      "id": "alert_8a9b0c1d2e",
      "aliasId": "al_WTSGM57cIGy4oLUMoPQ2",
      "aliasEmail": "billing.alerts@mycompany.com",
      "attemptCount": 142,
      "sampleSenders": [
        "spammer@suspicious-relay.xyz",
        "crawler-bot@host-node-4.net"
      ],
      "sampleSubjects": [
        "Urgent invoice payment required",
        "Undelivered package notification"
      ],
      "firstAttemptAt": "2026-09-04T06:12:00.000Z",
      "lastAttemptAt": "2026-09-04T07:45:22.000Z",
      "alertSentAt": "2026-09-04T07:46:00.000Z"
    }
  ],
  "count": 1
}

Response Fields

Error Responses

Dismiss Security Alert

POST /v1/security/suspicious-activity

Acknowledges and dismisses an active security alert, removing it from the active alert queue and recording human-in-the-loop resolution metadata.

Request Headers

Request Body Schema

cURL Example

curl -X POST "https://api.aliasfleet.com/v1/security/suspicious-activity" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -H "Content-Type: application/json" \
  -d '{
    "alertId": "alert_8a9b0c1d2e",
    "action": "dismiss"
  }'

Response (200 OK)

{
  "success": true,
  "message": "Alert dismissed"
}

Error Responses

Threat Remediation Best Practices

When an alert indicates anomalous delivery activity on an alias, consider the following defense-in-depth remediation steps:

1. Inbound Firewall Rules

If the alert identifies persistent bad actor domains in sampleSenders, add an envelope denylist rule via the Sender Rules API:

curl -X POST "https://api.aliasfleet.com/v1/sender-rules/blacklist" \
  -H "Authorization: Bearer afp_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "sender": "*@suspicious-relay.xyz",
    "note": "Blocked following volumetric burst alert alert_8a9b0c1d2e"
  }'

2. Automated Quarantine via Rules Engine

Configure conditional rules in the Rules Engine API to inspect high-risk indicators (such as spam_score > 5.0 or missing SPF/DKIM verification) and route them to quarantine or silent drop:

{
  "name": "Quarantine High Spam Inbound",
  "priority": 10,
  "match_type": "ANY",
  "conditions": [
    {
      "field": "spam_score",
      "operator": "greater_than",
      "value": "5.0"
    }
  ],
  "actions": [
    {
      "type": "quarantine"
    }
  ],
  "stop_processing": true
}

3. Alias Deactivation or Rotation

If an alias has been exposed in a public leak or credential stuffing campaign, disable inbound forwarding immediately by moving it to the trash via the Aliases API:

curl -X POST "https://api.aliasfleet.com/v1/aliases/al_WTSGM57cIGy4oLUMoPQ2/trash" \
  -H "Authorization: Bearer afp_live_..."