Extract ZIP Files: Unzip Archives & Email Attachments

This Actor lets you extract ZIP files (and 7z, TAR and GZ archives, emails, PDFs and Office files) from file URLs and returns every file inside them. Each extracted file is saved to the run's key-value store and returned with a direct download URL, its name, its path inside the source, size, MIME type and SHA-256.

It is a file extractor utility for automations and AI agents: unzip a vendor's data feed, pull invoice PDFs out of emails, get the XML invoice out of a Factur-X/ZUGFeRD PDF, or collect all the images in a set of PDFs or Word files.

What can it extract

Source	What gets extracted
Archives: .zip, .7z, .tar, .tar.gz/.tgz, .tar.bz2, .tar.xz, .gz, .bz2, .xz	Every file, with its folder path
Email: .eml (MIME)	Attachments, inline images, attached emails. Plus one row with from, to, cc, date, subject and the text/HTML body
Outlook: .msg	Attachments and embedded messages, plus the same email row
PDF	Embedded file attachments (portfolios, Factur-X/ZUGFeRD XML, file-attachment annotations) and embedded images (PNG/JPG)
Office: .docx, .xlsx, .pptx, .odt, .ods, .odp	Embedded media (word/media, ppt/media, xl/media, Pictures/) and embedded objects (for example an Excel sheet inside a Word file)

Nested containers are opened too, to a depth you set (default 1, max 3): a zip inside a zip, emails inside a zip, an email attached to an email.

Safe by design

• Zip-bomb protection: a compression-ratio limit per entry and per archive, a byte cap on every decompression stream, a per-file size limit, a run-wide total size limit, an entry-count limit and a timeout per source. Limits are enforced on the bytes actually decompressed, not on what the archive's headers claim.
• Path traversal sanitized: ../, absolute paths, drive letters (C:) and control characters are removed from every inner path. Rows whose path was changed carry pathSanitized: true.
• Skipped, never followed: symlinks, hard links, devices and FIFOs. Encrypted entries and password-protected archives or PDFs are skipped with a reason.
• Nothing is executed. Files are never written to disk. The actor only reads bytes and stores them.
• One bad file never stops the run. Each source gets a summary row that lists what was skipped and why.

How to unzip files and extract email attachments (input example)

{
  "urls": [
    "https://example.com/feeds/vendor-export.zip",
    "https://example.com/mail/invoice.eml",
    "https://raw.githubusercontent.com/akretion/factur-x/master/tests/fixtures/pdf/invoice_EN16931.pdf"
  ],
  "includeExtensions": ["pdf", "xml", "csv", "png", "jpg"],
  "nestedDepth": 1,
  "maxFiles": 500,
  "emailInlineImages": false
}

Main options:

• includeExtensions / excludeExtensions: filter which files are delivered.
• maxFiles and maxTotalSizeMb: run-wide caps that also cap the cost.
• nestedDepth and keepNestedArchives: control nested archives.
• flattenPaths: makes path and fileName unique flat names across the run, so all files can go into one folder. The original folder path stays in originalPath.
• skipDuplicates: skips files with the same SHA-256 content.
• skipJunkFiles: skips __MACOSX, .DS_Store and similar.
• PDF image minimum size, and toggles for PDF attachments, PDF images and Office embedded files.
• Zip-bomb guards: maxCompressionRatio, maxEntriesPerSource, maxFileSizeMb, timeoutSecondsPerSource.
• keyValueStoreName: saves files to a named store that you keep.

What data can you extract (output)

There is one row per extracted file (rowType: "file"):

{
  "rowType": "file",
  "sourceUrl": "https://raw.githubusercontent.com/akretion/factur-x/master/tests/fixtures/pdf/invoice_EN16931.pdf",
  "sourceName": "invoice_EN16931.pdf",
  "path": "factur-x.xml",
  "originalPath": "factur-x.xml",
  "fileName": "factur-x.xml",
  "extension": "xml",
  "sizeBytes": 41914,
  "mimeType": "text/xml",
  "sha256": "9f0c...e1",
  "downloadUrl": "https://api.apify.com/v2/key-value-stores/AbC123/records/s001-00002-factur-x.xml",
  "kvKey": "s001-00002-factur-x.xml",
  "container": "pdf-attachment",
  "depth": 0,
  "pathSanitized": false,
  "modifiedAt": null, "page": null, "width": null, "height": null, "contentId": null, "inline": null
}

• container is one of zip, 7z, tar, tar+gzip, gzip, email, msg, pdf-attachment, pdf-image or office-media.
• page, width and height are filled in for PDF images.
• contentId and inline are filled in for email parts.
• modifiedAt is filled in for archive entries.

There is one row per email (rowType: "email"). It is free and has these fields: from, to, cc, bcc, replyTo, date (ISO), subject, messageId, inReplyTo, bodyText, bodyHtml, attachmentCount and attachments.

There is one summary row per source (rowType: "summary"). It has these fields: status (ok / partial / failed), sourceType, filesExtracted, bytesExtracted, emailsParsed, skippedCount, skippedByReason (for example {"excluded-by-filter": 12, "symlink": 1}), skipped (the first 100 skipped entries with path and reason), error and notes. Sources that failed are also listed in the FAILED key-value record.

Limits (honest)

• Download URLs expire. By default files go to the run's default key-value store, which Apify deletes after your plan's data retention period. To keep them, set keyValueStoreName.
• Each source must be a direct file URL (http/https) of at most maxDownloadSizeMb (default 200 MB, max 1000 MB). Pages that need a login are not supported.
• Not supported: RAR, ISO, CAB, password-protected archives, PDFs or entries, winmail.dat (TNEF) contents (delivered as the .dat file), and inline images drawn directly in PDF content streams (rare; image XObjects are extracted). Office documents and PDFs found inside archives are delivered as files, not opened.
• PDF images use their native encoding where possible (JPEG stays JPEG). Unusual encodings are converted to PNG. Images that cannot be decoded (some JBIG2/CCITT) are listed as skipped.
• A solid 7z archive that contains a bomb is refused as a whole, because extracting any one file would mean decompressing the bomb.
• The per-source timeout is checked between reads. A single very large PDF image decode cannot be interrupted midway.

How much does it cost

Pay per event: one extracted-file event per file delivered. Email rows, summary rows and skipped files are free. maxFiles caps what a run can cost.

FAQ

How do I extract a ZIP file from a URL?

Put the direct link to the .zip file in urls and run. Every file inside is saved to the run's key-value store and comes back as a row with a download link, its path, size, MIME type and SHA-256. Use includeExtensions to keep only the types you need.

Is it safe to extract ZIP files from unknown sources?

The Actor never writes files to disk and never runs them. It limits the compression ratio, the bytes decompressed, the entry count and the time per source, cleans ../ and absolute paths, and skips symlinks. That protects against zip bombs and path traversal.

Can it extract attachments from .eml and .msg emails?

Yes. You get the attachments and inline images as files, and one extra free row per email with the sender, recipients, date, subject and body text.

Can it extract images or files from a PDF?

Yes. It extracts embedded file attachments (including Factur-X and ZUGFeRD invoice XML) and embedded images. Embedded media in Word, Excel and PowerPoint files can be extracted too.

Does it open RAR files or password-protected ZIPs?

No. RAR, ISO, CAB and password-protected archives are not supported, and they are reported as skipped with a reason.

How long do the download links last?

Files stay in the run's default key-value store until your Apify data retention deletes them. Set keyValueStoreName to keep them in a named store.

Related tools

• PDF to Text & Markdown Converter with Automatic OCR reads the text of the PDFs and Office files you extract.
• File Converter API: PDF, Office, Images, Audio & Video converts the extracted files to the format you need.
• Send Data to Slack, Discord, Email, Notion & Postgres sends the list of extracted files to your team.