Use cases

This page maps common product jobs to the Encrata lookup that solves them. Each use case lists the fields to check and a runnable recipe. All recipes authenticate with Authorization: Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.

Email

Validate signups, screen for fraud, clean lists, enrich contacts, check cold-email compliance, and personalize greetings.

Malware

Check links, files, QR codes, barcodes, and images before anyone trusts them.

Email

Email use cases run on the Email lookups. Pick the job, then call the lookup in the last column.

Job	Lookup	Check first
Validate an email at a decision point	Email Validity	`status`, `disposable`, `did_you_mean`
Screen signups for fraud	Email Validity + Email Breaches	`disposable`, `status`, `breached`
Clean a list in bulk	Email Validity (bulk job)	`status`
Enrich a signup into a profile	Email Identity	`person`
Check cold-email compliance before outreach	Email Compliance	`recommendation_code`, `confidence`, `checking`
Personalize a greeting by gender	Email Gender	`gender`, `probability`

Validate an email at a decision point

Block fake, mistyped, and disposable addresses the moment a user enters one. Every account, listing, or recovery address then starts out working.

Field	What it tells you
`status`	Whether the address can receive mail. Accept only `valid`.
`disposable`	`true` for throwaway inbox providers.
`did_you_mean`	A suggested fix for a likely typo, such as `gmial.com`.

import requests

HEADERS = {"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "Content-Type": "application/json"}

def check_email(email: str):
    r = requests.post(
        "https://developer.encrata.com/api/lookup/email/validity",
        headers=HEADERS, json={"email": email},
    ).json()

    if r.get("did_you_mean"):
        return "suggest", r["did_you_mean"]        # likely typo, e.g. gmial.com
    if r.get("disposable") or r.get("status") != "valid":
        return "reject", None
    return "accept", None

This one pattern powers signup validation, seller verification, recovery checks, and bounce reduction. Only the decision point changes. For bounce reduction, run it before you add an address to a send.

See Email Validity for every field.

Screen signups for fraud

Stop disposable and throwaway addresses before they reach your product. Add an Email Breaches check for a fuller risk picture.

Field	What it tells you
`disposable`	`true` for throwaway inbox providers. Block these.
`status`	`risky` addresses need a second look.
`breached`	Whether the address appears in known breaches. A real, long-lived address usually does.

import requests

HEADERS = {"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "Content-Type": "application/json"}

def signup_risk(email: str) -> str:
    v = requests.post(
        "https://developer.encrata.com/api/lookup/email/validity",
        headers=HEADERS, json={"email": email},
    ).json()

    if v.get("disposable") or v.get("status") == "risky":
        return "block"

    b = requests.post(
        "https://developer.encrata.com/api/lookup/email/breaches",
        headers=HEADERS, json={"email": email},
    ).json()

    # A brand-new address with zero breach history can signal a throwaway.
    return "review" if not b.get("breached") else "allow"

See Email Breaches for every field.

Clean a list in bulk

Remove invalid and dead addresses before an outbound campaign. Submit the whole list as one bulk job and keep the rows where status is valid.

curl -X POST "https://developer.encrata.com/api/jobs/bulk" \
  -H "Authorization: Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -F "type=validity" \
  -F "download_link=true" \
  -F "file=@list.csv"

When the job finishes, download only the deliverable rows:

curl -L "https://developer.encrata.com/api/jobs/exports/download?kind=validity&id=JOB_ID&format=csv&filter=valid" \
  -H "Authorization: Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" -o clean.csv

The same job powers list cleaning and ongoing CRM hygiene. Run it on your own schedule to keep records clean as your database grows. See Bulk operations for webhook delivery and downloads.

Turn a new user’s email into a full contact record: name, company, role, and social profiles. All fields live under person.

Field	What it tells you
`person.first_name`, `person.last_name`	The person’s name.
`person.company`, `person.job_role`	Where they work and what they do.
`person.socials`	Social profile links, such as `linkedin`.

import requests

HEADERS = {"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "Content-Type": "application/json"}

person = requests.post(
    "https://developer.encrata.com/api/lookup/email/identity",
    headers=HEADERS, json={"email": "jane@acme.com"},
).json()["person"]

crm.create_contact(
    name=f"{person.get('first_name', '')} {person.get('last_name', '')}".strip(),
    company=person.get("company"),
    title=person.get("job_role"),
    linkedin=person.get("socials", {}).get("linkedin"),
)

See Email Identity for every field.

Check cold-email compliance before outreach

Find out which country’s cold-email law applies to a prospect before you send. Sales tools and outbound platforms use this to hold sends that need consent and to show reps the rule behind the decision.

Field	What it tells you
`recommendation_code`	The machine-readable verdict, from `prohibited` and `consent_required` (strictest) to `safe_to_send`. Branch on this.
`confidence`	`confident`, `medium`, or `unknown`. With `unknown`, no country is set and the restrictive default applies.
`checking`	`true` while a deeper check runs. Send the same request again to get the settled verdict.
`main_laws`, `main_restrictions`	The laws and rules to show your team.

import requests

HEADERS = {"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "Content-Type": "application/json"}
HOLD = {"prohibited", "consent_required", "exception_required", "case_by_case"}

def can_cold_email(email: str):
    r = requests.post(
        "https://developer.encrata.com/api/lookup/email/compliance",
        headers=HEADERS, json={"email": email},
    ).json()["result"]

    if r.get("checking"):
        return "retry", r["recommendation"]        # provisional; repeats are free
    if r["recommendation_code"] in HOLD:
        return "hold", r["recommendation"]          # also covers confidence "unknown"
    return "send", r["recommendation"]

Treat confidence: unknown as an answer, not an error. The response is still 200 with a restrictive recommendation. Repeating a check for the same address within 6 months costs no credits, so polling a provisional verdict is free.

See Email Compliance for every field.

Personalize a greeting by gender

Pick a salutation or segment a list from the name in the address, such as jane.doe@. Use the prediction only when probability is high, and fall back to a neutral greeting otherwise.

Field	What it tells you
`gender`	`male`, `female`, or `unknown` when the name can’t be resolved.
`probability`	Confidence in the verdict, from `0` to `100`.
`name`	The name the prediction was made from.
`country`	The likely country for the name, as an ISO code. Can be `null` or the string `"NULL"`.

import requests

HEADERS = {"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "Content-Type": "application/json"}

def greeting(email: str, last_name: str) -> str:
    g = requests.post(
        "https://developer.encrata.com/api/lookup/email/gender",
        headers=HEADERS, json={"email": email},
    ).json()

    title = {"male": "Mr.", "female": "Ms."}.get(g["gender"])
    if title and g["probability"] >= 90:
        return f"Dear {title} {last_name},"
    return "Hi there,"                               # unknown or low confidence

Role addresses such as info@ return unknown and are still billed. To label a whole list, submit a bulk job with type=gender. See Bulk operations.

See Email Gender for every field.

Malware

Malware use cases run on one endpoint, POST /api/lookup/malware/scan. Set kind to choose what you scan. Every scan returns a verdict of clean, suspicious, malicious, or unknown.

Job	`kind`	Check first
Check a link before someone clicks it	`url`	`verdict`, `category`, `final_url`
Scan an uploaded file or attachment	`file`	`verdict`, `file_type`, `signals`
Find out where a QR code really leads	`qr`	`codes[].verdict`, `codes[].final_url`
Check a barcode before it enters your system	`bar`	`verdict`, `codes[].raw`
Catch phishing sent as a picture	`image`	`verdict`, `ocr_urls`, `url_scans`
Check a photo for location leaks and hidden data	`image`	`metadata.gps`, `appended_data`, `steganography`

Each scan costs 1 credit. Scanning the same kind and content again doesn’t charge you twice, so a link shared in several places costs 1 credit.

Check a link before someone clicks it

Scan every link in an inbound email, chat message, or support ticket before it reaches a person. Email gateways, chat bots, and browser extensions use this to quarantine phishing in seconds.

Field	What it tells you
`verdict`, `category`	The outcome, such as `malicious` and `phishing`.
`final_url`, `redirect_hops`	Where the link really lands after every redirect.
`domain.age_days`, `domain.risky_tld`	How new the domain is. A days-old domain on a risky TLD is a strong phishing signal.
`page`	What the landing page contains, including forms and password fields.
`threat_intel`, `iocs`	Reputation results and indicators to send to your security team.

import requests

HEADERS = {"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "Content-Type": "application/json"}

def check_link(url: str) -> str:
    r = requests.post(
        "https://developer.encrata.com/api/lookup/malware/scan",
        headers=HEADERS, json={"kind": "url", "url": url},
    ).json()["result"]

    if r["verdict"] == "malicious":
        return "quarantine"    # attach r["iocs"] to the security ticket
    if r["verdict"] in ("suspicious", "unknown"):
        return "review"
    return "allow"

Page analysis is static. Encrata doesn’t run the page’s scripts, so content that appears only after JavaScript runs isn’t analyzed. Private and internal addresses are never fetched and return unknown.

See URL Scan for every field.

Scan an uploaded file or attachment

Scan every file a user uploads before a person opens it: chat attachments, email attachments, CVs, claim documents, and identity documents. A rejected file never reaches your team.

Field	What it tells you
`verdict`	Accept only `clean`.
`file_type`	What the file really is. A `refund_invoice.pdf` that is a Windows executable is a red flag.
`signals`	Antivirus and rule matches behind the verdict.
`sha256`	The file hash. Add it to your block list to reject re-uploads.

import base64
import os
import requests

HEADERS = {"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "Content-Type": "application/json"}

def scan_upload(path: str) -> str:
    with open(path, "rb") as f:
        content = base64.b64encode(f.read()).decode()

    r = requests.post(
        "https://developer.encrata.com/api/lookup/malware/scan",
        headers=HEADERS,
        json={"kind": "file", "content_base64": content, "filename": os.path.basename(path)},
    ).json()["result"]

    if r["verdict"] == "clean":
        return "accept"
    if r["verdict"] == "malicious":
        blocklist.add(r["sha256"])
    return "reject"

For files already in storage, send a short-lived download link in source_url instead of base64. Files can be up to 100 MiB.

curl -X POST "https://developer.encrata.com/api/lookup/malware/scan" \
  -H "Authorization: Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"kind":"file","source_url":"https://files.example.com/signed/invoice.pdf","filename":"invoice.pdf"}'

See File Scan for every field.

Find out where a QR code really leads

Scan a photo of a QR code to see its real destination before anyone pays or logs in. Use it to catch fake stickers placed over real codes on parking meters, posters, menus, and payment terminals. One photo can hold several codes. Each code gets its own verdict, so a real code and a fake sticker next to it are reported separately.

Field	What it tells you
`codes[].verdict`	The verdict for each code in the photo.
`codes[].raw`, `codes[].final_url`	What the code contains and where it lands after redirects.
`codes[].payload_type`	What kind of content the code holds, such as `url`, `wifi`, or `text`.
`codes[].position`	Where the code sits in the photo, in pixels. Use it to locate a fake sticker.

import base64
import requests

HEADERS = {"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "Content-Type": "application/json"}

def check_qr_photo(path: str) -> str:
    with open(path, "rb") as f:
        content = base64.b64encode(f.read()).decode()

    r = requests.post(
        "https://developer.encrata.com/api/lookup/malware/scan",
        headers=HEADERS,
        json={"kind": "qr", "content_base64": content, "filename": "photo.jpg"},
    ).json()["result"]

    if "codes" not in r:
        return "retake"        # verdict is unknown: no code could be read

    flagged = [c for c in r["codes"] if c["verdict"] != "clean"]
    for c in flagged:
        print(c["raw"], c.get("final_url"), c["position"])
    return "flag" if flagged else "ok"

Send raw base64. A data:image/png;base64, prefix returns 400. The scan also reads Data Matrix and Aztec codes, and redacts secrets such as Wi-Fi passwords as REDACTED.

See QR Code Scan for every field.

Check a barcode before it enters your system

Scan a photo of a shipping label, product code, or ticket before its value reaches your database. Many barcode readers type the decoded value straight into the connected system. A crafted barcode can carry control characters, SQL injection, or script payloads.

Field	What it tells you
`verdict`	Write the value to your system only when this is `clean`.
`codes[].raw`	The decoded value.
`codes[].format`	The barcode type, such as `code_128` or `ean_13`.
`codes[].signals`	Why a value was flagged.

import base64
import requests

HEADERS = {"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "Content-Type": "application/json"}

def read_label(path: str):
    with open(path, "rb") as f:
        content = base64.b64encode(f.read()).decode()

    r = requests.post(
        "https://developer.encrata.com/api/lookup/malware/scan",
        headers=HEADERS,
        json={"kind": "bar", "content_base64": content, "filename": "label.png"},
    ).json()["result"]

    if r["verdict"] != "clean" or "codes" not in r:
        return None            # hold the item, don't write the value
    return r["codes"][0]["raw"]

Barcode Scan takes an image of the barcode, not an already-decoded value. It reads Code 128/39/93, Codabar, ITF, EAN-8/13, and UPC-A/E.

See Barcode Scan for every field.

Catch phishing sent as a picture

Scan image attachments that carry no clickable link, such as a screenshot of a fake invoice that says “Scan to view your document.” Link scanners miss these. Image Scan reads the text with OCR, finds URLs in the text and in any embedded QR code, and scans up to three of those links.

Field	What it tells you
`verdict`	The worst outcome across the image and the links found in it.
`ocr_text`, `ocr_urls`	The text read from the image and the URLs in it.
`url_scans`	A full URL Scan result for each discovered link.

import base64
import requests

HEADERS = {"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "Content-Type": "application/json"}

def scan_image_attachment(path: str) -> str:
    with open(path, "rb") as f:
        content = base64.b64encode(f.read()).decode()

    r = requests.post(
        "https://developer.encrata.com/api/lookup/malware/scan",
        headers=HEADERS,
        json={"kind": "image", "content_base64": content, "filename": "attachment.png"},
    ).json()["result"]

    for link in r.get("url_scans", []):
        print(link["submitted_url"], link["verdict"])
    return "quarantine" if r["verdict"] in ("malicious", "suspicious") else "deliver"

See Image Scan for every field.

Check a photo for location leaks and hidden data

Scan photos before you publish them or accept them from users. A phone photo can carry the exact GPS location where it was taken and the camera owner’s name. An image can also hide a file appended after its end, or data hidden in its pixels.

Field	What it tells you
`metadata.gps`	`latitude` and `longitude` where the photo was taken.
`metadata.owner`, `metadata.camera_model`	Who owns the camera and which device took the photo.
`appended_data`	A file stored after the image ends, with its `type`, such as `zip`, and `size_bytes`.
`steganography.suspected`	`true` when data is likely hidden inside the image.
`hashes.dhash`	A perceptual hash to find near-duplicate images.

import base64
import requests

HEADERS = {"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "Content-Type": "application/json"}

def check_photo(path: str) -> list[str]:
    with open(path, "rb") as f:
        content = base64.b64encode(f.read()).decode()

    r = requests.post(
        "https://developer.encrata.com/api/lookup/malware/scan",
        headers=HEADERS,
        json={"kind": "image", "content_base64": content, "filename": "photo.jpg"},
    ).json()["result"]

    issues = []
    gps = r.get("metadata", {}).get("gps")
    if gps:
        issues.append(f"location: {gps['latitude']}, {gps['longitude']}")   # strip before publishing
    if r.get("appended_data"):
        issues.append(f"appended {r['appended_data']['type']} file")
    if r.get("steganography", {}).get("suspected"):
        issues.append("hidden data suspected")
    return issues

See Malware Scan for every image field.

Next steps

Examples

A recipe for every individual lookup.

Bulk operations

Run a lookup over a list of up to 1,000,000 rows.

All lookups

Every lookup, its input, and its cost.

Account & team

Run your integration

Integrations

AI tools

auth.md

Use cases

Email

Malware

Email

Validate an email at a decision point

Screen signups for fraud

Clean a list in bulk

Check cold-email compliance before outreach

Personalize a greeting by gender

Malware

Check a link before someone clicks it

Scan an uploaded file or attachment

Find out where a QR code really leads

Check a barcode before it enters your system

Catch phishing sent as a picture

Check a photo for location leaks and hidden data

Next steps

Examples

Bulk operations

All lookups

Email

Malware

Email

Validate an email at a decision point

Screen signups for fraud

Clean a list in bulk

Enrich a signup into a profile

Check cold-email compliance before outreach

Personalize a greeting by gender

Malware

Check a link before someone clicks it

Scan an uploaded file or attachment

Find out where a QR code really leads

Check a barcode before it enters your system

Catch phishing sent as a picture

Check a photo for location leaks and hidden data

Next steps

Examples

Bulk operations

All lookups