Documentation

REST API reference

Programmatic access to quarantine, threat intelligence, and gateway policies. Base URL: api.orangeburgradiology.com/v1

Authentication

All API requests require a Bearer token in the Authorization header. Generate keys from the admin console or via the API.

Production keys use the prefix px_live_. Sandbox keys use px_test_ and operate against isolated test data — no real mail is affected.

# Example request
curl -H "Authorization: Bearer px_live_a1b2c3d4e5f6..." \
     https://api.orangeburgradiology.com/v1/domains
# Sandbox key (safe for development)
Authorization: Bearer px_test_x9y8z7w6v5u4...

Rate limit: 600 requests per minute per key. Exceeded limits return HTTP 429 with a Retry-After header.

Quarantine

Search, list, release, and delete quarantined messages. Messages are retained according to your plan (30–365 days).

GET/v1/quarantine

List quarantined messages. Supports query params: domain, recipient, threat_type, since, limit (max 100).

# List quarantined phishing messages
GET /v1/quarantine?threat_type=phishing&limit=50

// Response
{ "data": [{ "id": "qmsg_8f3a...", "recipient": "user@orangeburgradiology.com", "subject": "Urgent wire transfer", "threat_type": "bec", "score": 98, "held_at": "2026-07-01T14:22:00Z" }], "has_more": false }
POST/v1/quarantine/{id}/release

Release a quarantined message for delivery. Requires admin scope. Audit log entry is created automatically.

DELETE/v1/quarantine/{id}

Permanently delete a quarantined message. Cannot be undone.

Threats

Query the threat intelligence feed and retrieve details on blocked campaigns affecting your domains.

GET/v1/threats

Returns paginated threat events blocked by the gateway in the last 30 days. Filter by severity (low, medium, high, critical) and type (spam, phishing, malware, bec).

GET /v1/threats?severity=critical&type=phishing

{ "data": [{ "id": "thr_2c91...", "type": "phishing", "severity": "critical", "sender": "billing-verify@paypa1-secure.com", "blocked_count": 847, "first_seen": "2026-06-28T09:00:00Z" }] }
GET/v1/threats/{id}

Full forensic detail: headers, attachment hashes, URL analysis, and related campaign IDs.

Webhooks

Subscribe to real-time events. Webhooks are signed with HMAC-SHA256 using your webhook secret. Verify the X-Orangeburg-Signature header on every payload.

Available events:

threat.detected      // A new threat was blocked
quarantine.created   // Message held in quarantine
quarantine.released  // Admin released a message
dmarc.fail           // Inbound message failed DMARC
policy.violation    // Custom policy rule triggered
POST/v1/webhooks

Register a webhook endpoint. Body: {"url": "https://your-app.com/hooks/orangeburg", "events": ["threat.detected", "quarantine.created"]}

# Verify signature (Python example)
import hmac, hashlib
sig = hmac.new(secret.encode(), payload_bytes, hashlib.sha256).hexdigest()
assert sig == request.headers["X-Orangeburg-Signature"]