# Get spam-trap hits for a sending domain

`GET /v1/email/inbox-insights/spam-traps`

Returns the spam-trap hits recorded against a sending domain over the
period: the total, a split by the kind of trap, a split by the trap
network that observed them, and the individual hits with the sending IP
and trap age behind each.

Spam traps are addresses that exist only to catch senders mailing lists
they should not be mailing, so the kind of trap says more than the count.
Hits on pristine traps, which never belonged to a real person, point at
harvested or guessed addresses; hits on recycled traps point at stale list
data. Zero hits is a measured zero and a good result, so the totals are
real figures rather than an empty state.

API-key calls require Insights preview access for your organization.

## Code samples

### TypeScript

```ts
// Requires Insights preview access for the organization.
let sendingDomain: string | undefined;
for await (const domain of bird.email.inboxInsights.domains.list({ search: "mail.example.com" })) {
  if (domain.domain === "mail.example.com") { sendingDomain = domain.domain; break; }
}
if (!sendingDomain) throw new Error("Verify mail.example.com in this workspace first");
const report = await bird.email.inboxInsights.spamTraps({ sending_domain: sendingDomain });
console.log(report);
```

### Python

```py
# Requires Insights preview access for the organization.
sending_domain = None
for domain in client.email.inbox_insights.domains.list(search="mail.example.com"):
    if domain.domain == "mail.example.com":
        sending_domain = domain.domain
        break
if sending_domain is None:
    raise ValueError("Verify mail.example.com in this workspace first")
report = client.email.inbox_insights.spam_traps(sending_domain=sending_domain)
print(report.model_dump_json())
```

### Go

```go
// Requires Insights preview access for the organization.
client, err := bird.NewClient(option.WithAPIKey(os.Getenv("BIRD_API_KEY")))
if err != nil {
	log.Fatal(err)
}
ctx := context.Background()
sendingDomain := ""
for domain, err := range client.Email.InboxInsights.Domains.List(ctx, bird.EmailInboxInsightsDomainsListParams{Search: "mail.example.com"}) {
	if err != nil {
		log.Fatal(err)
	}
	if domain.Domain != nil && *domain.Domain == "mail.example.com" {
		sendingDomain = *domain.Domain
		break
	}
}
if sendingDomain == "" {
	log.Fatal("Verify mail.example.com in this workspace first")
}
report, err := client.Email.InboxInsights.SpamTraps(ctx, bird.EmailInboxInsightsSpamTrapsParams{SendingDomain: sendingDomain})
if err != nil {
	log.Fatal(err)
}
encoded, err := json.MarshalIndent(report, "", "  ")
if err != nil {
	log.Fatal(err)
}
fmt.Println(string(encoded))
```

### PHP

```php
// Requires Insights preview access for the organization.
$sendingDomain = null;
foreach ($bird->email->inboxInsights->domains->list(['search' => 'mail.example.com']) as $domain) {
    if ($domain->getDomain() === 'mail.example.com') {
        $sendingDomain = $domain->getDomain();
        break;
    }
}
if ($sendingDomain === null) {
    throw new \RuntimeException('Verify mail.example.com in this workspace first');
}
$report = $bird->email->inboxInsights->spamTraps(['sending_domain' => $sendingDomain]);
var_dump($report);
```

### CLI

```sh
bird email inbox-insights spam-traps <sending-domain>
```

### cURL

```sh
curl -X GET "https://us1.platform.bird.com/v1/email/inbox-insights/spam-traps" \
  -H "Authorization: Bearer $TOKEN" \
  --url-query "sending_domain=mail.acme.com"
```

## Example response `200`

```json
{
  "resource": "placement",
  "domain": "mail.acme.com",
  "measurement": {
    "sources": [
      "panel",
      "intelliseed_public"
    ],
    "weighting": {
      "weight_set_id": "12",
      "source": "account",
      "basis": "weighted-mean-of-per-isp-rates"
    }
  },
  "generated_at": "2026-08-18T09:34:00Z",
  "freshness": {
    "as_of": "2026-08-17",
    "lag_hint": "daily"
  },
  "cached_at": "2026-08-18T09:40:02Z",
  "window": {
    "start": "2026-08-12",
    "end": "2026-08-18",
    "group_by": "day"
  },
  "compared_to": {
    "start": "2026-06-19",
    "end": "2026-07-18"
  },
  "total": 3,
  "delta": -2,
  "by_type": [
    {
      "type": "recycled",
      "hits": 3
    }
  ],
  "by_source": [
    {
      "source": "cloudmark",
      "hits": 2
    }
  ],
  "hit_rows": {
    "items": [
      {
        "first_seen": "2026-08-14T06:21:00Z",
        "last_seen": "2026-08-16T11:04:00Z",
        "ip_address": "147.253.40.16",
        "source": "cloudmark",
        "type": "recycled",
        "hit_count": 2,
        "trap_age_days": 430
      }
    ],
    "truncated_types": [
      "recycled"
    ],
    "status": "ok"
  }
}
```

## Query parameters

- `sending_domain` (string): The sending domain to report on: one of the workspace's verified sending domains, exactly as it appears there. A domain that is not verified in this workspace answers not-found.
- `from` (string)

  First UTC day of the period, inclusive, in YYYY-MM-DD: the same window
  convention as the email statistics endpoints. Defaults to 30 days
  before `to`.

  It may be at most 30 days before `to`, which is also the default, so a
  request naming neither date is already at the limit. Asking for more
  answers `422`: the page pairs these figures with Bird's own per-provider
  sending statistics, and those are kept for 30 days, so a longer period
  could only describe two different spans side by side.
- `to` (string): Last UTC day of the period, inclusive, in YYYY-MM-DD. Defaults to today.
- `compare` (string)

  Include the prior equal-length period, populating `compared_to` and `delta`.

  Possible values: `previous_period`

## Response body

- `resource` (string, required): Which resource this response is, echoed for self-description.
- `domain` (string, required): The sending domain the figures describe.
- `measurement` (object): How the figures were measured. Present only where a figure was weighted or drawn from a named set of sources, which today means placement and the industry benchmark. Absent on the reputation resources and on a live lookup, neither of which weights anything.
- `measurement.sources` (array of string, required): Identifiers of the measurement systems that contributed to these figures. The set grows as measurement coverage does, so treat the values as labels rather than a closed list.
- `measurement.weighting` (object): How the figures were weighted. Present on figures weighted against an audience mix, which is placement's method; measurements that weight nothing carry no weighting block.
- `measurement.weighting.weight_set_id` (string, required): The measurement's own identifier for the audience mix, carried through so a client can tell two weightings apart without comparing `basis` strings. No operation accepts it.
- `measurement.weighting.source` (nullable string, required): Which audience mix the weighting used. Null when the measurement weighted these figures by a method this API does not model: the enum is closed so that a client can branch on it exhaustively, which means an unfamiliar method has to answer "not one of these" rather than be passed through. `basis` usually still describes the method in words when that happens.
- `measurement.weighting.basis` (nullable string, required): The weighting method behind the rates, as the measurement names it. A slug rather than a sentence, so render it as a label and do not expect it to read as English. Null when the measurement did not state one, which pairs with `source`: both describe the method, so neither can claim to know it when the measurement was silent.
- `generated_at` (string, required): When the measurement service computed these figures.
- `freshness` (object, required): How current the figures are. Freshness differs per resource (authentication data can lag a day or more while blocklist lookups are near real time), so any "as of" label binds from this field, never from a fixed string.
- `freshness.as_of` (nullable string, required): The most recent UTC day the figures include, or null for a live lookup that has no measurement window.
- `freshness.lag_hint` (nullable string, required)

  How far behind real time this resource usually runs. A lowercase
  identifier rather than a display label, so pick your own wording for it,
  and treat the set as open: the measurement names a hint per resource and
  can add one without notice.

  Null when the measurement reports no hint, which several resources do:
  show the figures without an age rather than inventing one.

  Possible values (may grow over time): `daily`, `nightly`, `near_real_time`
- `cached_at` (string): Present when the response was served from a short-lived copy rather than fetched for this request: when that copy was fetched.
- `window` (object, required)

  The period every figure in the response covers: whole UTC calendar days,
  inclusive on both ends. The same window convention the email statistics
  endpoints use, so figures from the two sources describe the same days and
  can be combined without adjustment.
- `window.start` (string, required): First UTC day of the period, inclusive.
- `window.end` (string, required): Last UTC day of the period, inclusive.
- `window.group_by` (string)

  The bucket size any series in this response is grouped by. Absent on resources with no series.

  Possible values: `day`, `week`, `month`
- `compared_to` (object): The prior equal-length period the delta figures compare against. Present only when the request asked for a comparison.
- `compared_to.start` (string, required): First UTC day of the prior period, inclusive.
- `compared_to.end` (string, required): Last UTC day of the prior period, inclusive.
- `total` (integer, required): Trap hits observed over the period, across every trap network. The authoritative count: `hit_rows` holds a sample of the rows behind it.
- `delta` (integer): How the hit count moved against the prior period, as a change in the number of hits rather than in percentage points. Negative is an improvement. Present only when the request asked for a comparison and the prior period had data; absence is not zero change.
- `by_type` (array of object, required): Hits split by kind, one entry per kind the trap network reported. Read counts from here rather than assuming a fixed set of kinds: the set can grow, and an entry that is absent was not reported rather than being a measured zero. These sum to `total`.
- `by_type.type` (string, required)

  What kind of spam trap was hit. `pristine` addresses were never used by a real person and never subscribed to anything, so a hit means the address was harvested or guessed rather than collected. `recycled` addresses belonged to a real person once and were retired, so hits point at stale list data. `typo` addresses catch misspellings of real domains, `parked` addresses sit on domains that are registered but not used for real mail, and `mixed` covers hits the trap network reports without a single kind. The trap network decides this set and can add to it, so treat an unrecognised value as a label to show rather than a case to exhaust. A hit whose kind is new is still a hit worth acting on.

  Possible values (may grow over time): `pristine`, `recycled`, `typo`, `parked`, `mixed`
- `by_type.hits` (integer, required): Hits of this kind over the period. A zero is a measured zero, not missing data: no pristine hits is a genuinely good result rather than an empty state.
- `by_source` (array of object, required): Hits split by the trap network that observed them.
- `by_source.source` (string, required)

  The trap network that observed a hit. The set grows as coverage does, so treat the values as labels rather than a closed list.

  Possible values (may grow over time): `cloudmark`, `abusix`
- `by_source.hits` (integer, required): Hits this network observed over the period.
- `hit_rows` (object, required): The individual trap hits behind the totals. A sample rather than a guaranteed complete list, and its rows do not count hits: one row is one trap address, carrying a `hit_count` for how many times that address was reached. Neither the number of rows nor the sum of `hit_count` reconstructs `total`, because that field is absent wherever the trap network does not break the figure out. Read `truncated_types` for what the measurement capped rather than inferring completeness by comparing counts.
- `hit_rows.items` (array of object, required): One entry per trap reached, newest first.
- `hit_rows.items.first_seen` (string, required): When the trap network first observed mail from this domain at this trap.
- `hit_rows.items.last_seen` (nullable string, required): The most recent sighting, or null when the trap was seen only once. On a row with several hits this is the far end of the period they span.
- `hit_rows.items.ip_address` (string, required): The sending IP the message came from.
- `hit_rows.items.source` (string, required)

  The trap network that observed a hit. The set grows as coverage does, so treat the values as labels rather than a closed list.

  Possible values (may grow over time): `cloudmark`, `abusix`
- `hit_rows.items.type` (string, required)

  What kind of spam trap was hit. `pristine` addresses were never used by a real person and never subscribed to anything, so a hit means the address was harvested or guessed rather than collected. `recycled` addresses belonged to a real person once and were retired, so hits point at stale list data. `typo` addresses catch misspellings of real domains, `parked` addresses sit on domains that are registered but not used for real mail, and `mixed` covers hits the trap network reports without a single kind. The trap network decides this set and can add to it, so treat an unrecognised value as a label to show rather than a case to exhaust. A hit whose kind is new is still a hit worth acting on.

  Possible values (may grow over time): `pristine`, `recycled`, `typo`, `parked`, `mixed`
- `hit_rows.items.hit_count` (integer): How many times this trap was hit over the period, so rows do not sum to `total` on their own: one repeatedly hit trap is one row. Absent when the trap network does not break the count out, which is not the same as one hit. A row exists because the trap was reached at least once either way.
- `hit_rows.items.trap_age_days` (nullable integer, required): How long the trap address has been a trap, in days, or null when the network does not say. A high age on a recycled trap suggests the address has been dead in the list for a long time.
- `hit_rows.truncated_types` (array of string, required): Trap kinds whose hits the measurement capped, so the rows shown for them are incomplete by design rather than by chance. Typo-trap hits, for instance, only ever cover the last seven days. An empty array means nothing was capped.
- `hit_rows.status` (string, required)

  Whether a section of the response carries figures, and when it does not, why.

  `ok` means the section is populated. `no_data` means the measurement ran and
  observed nothing to report for this domain in the period. `not_configured`
  means the section needs a setup step that has not been completed yet, such as
  connecting Google Postmaster Tools; treat it as an invitation to finish
  setup rather than a fault. `unavailable` means the figures could not be retrieved this time and
  the same request may well succeed on a retry; the rest of the response is
  unaffected. `not_applicable` means the section is meaningless for this domain
  in this period, so there is nothing to show or fix.

  A successful response never implies every section is populated; read each
  section's status rather than assuming figures are present.

  Possible values: `ok`, `no_data`, `not_configured`, `unavailable`, `not_applicable`

## Related resources

- [Should I use a Bird SDK or call the API directly?](/explained/platform/should-i-use-an-sdk-or-call-the-api-directly) (answer)
- [Build your first integration](/learn/paths/integration) (course)
- [Send your first email](/docs/get-started/send-your-first-email) (docs)

[Get an implementation brief](/learn/workspace?topic=api-basics)