An email verification API that only charges for real answers
One HTTP call checks syntax, the domain, disposable and role addresses, and asks the receiving mail server whether the mailbox exists. You get a decision, the reason behind it and a 0-100 risk score. Catch-all, unknown and error results are free.
- Live mailbox check on every call
- Batch, bulk and webhooks
- Catch-all and unknown are free
Your first call
Send the address with your key in the X-API-KEY header. Branch on quality: good is safe to send, bad should be dropped, risky deserves a second look.
curl -X POST "https://api.primeverifier.com/v1/verify/single" \
-H "X-API-KEY: pk_live_your_api_key" \
-H "Content-Type: application/json" \
-d '{ "email": "jane.doe@acme.com" }'{
"status": "success",
"data": {
"email": "jane.doe@acme.com",
"result": "ok",
"resultCode": 1,
"subResult": "ok",
"quality": "good",
"riskScore": 5,
"catchAll": false,
"disposable": false,
"role": false,
"free": false,
"didYouMean": null,
"provider": "google",
"creditsCharged": 1,
"creditsRemaining": 4999,
"executionMs": 540
},
"error": null
}The full reference, with a live console and the same call in eight languages, is at developers.primeverifier.com.
What one call checks
- Syntax and normalisation: the address is well formed, cleaned and compared in canonical form.
- Typo suggestion: common domain mistakes come back in
didYouMean. - Disposable domains: matched against 277,000+ throwaway domains, refreshed daily.
- Domain and MX: the domain exists and has mail servers.
- Free provider and role: flagged, so you decide what to do with info@ or a personal Gmail.
- Live mailbox check: a real SMTP conversation with the receiving server, stopping before anything is sent. When the server accepts the address, a made-up address is tested on the same server to tell a catch-all domain from a real mailbox.
- Risk score and quality: the signals are combined into the score and the good / risky / bad headline.
What you get back
| Field | Meaning |
|---|---|
| result / resultCode | The decision: ok (1), catch_all (2), unknown (3), error (4), disposable (5), invalid (6). |
| subResult | Why: ok, no_mailbox, invalid_syntax, dns_error, greylisted, mailbox_full, ip_blocked, timeout and more, mapped from what the mail server actually did. |
| quality | The headline to act on: good (send), risky (catch-all or unknown) or bad (invalid or disposable). |
| riskScore | 0-100, rule-based and banded so it never contradicts quality: 0-29 good, 30-69 risky, 70-100 bad. Typo, role, catch-all, security gateway and free-provider signals move it within its band. |
| catchAll, disposable, role, free | Flags you can filter on independently of the result. |
| didYouMean | A suggested correction for a likely typo, such as gmial.com to gmail.com. |
| provider, antiSpam | The mailbox provider, and the security gateway in front of it if there is one. |
| creditsCharged, creditsRemaining, executionMs | What the call cost, what is left, and how long it took. |
Built for production
Batch of 30
POST /v1/verify/batch checks up to 30 addresses in one request. Duplicates, including Gmail dot and +tag variants, are checked and charged once.
Bulk jobs
Upload a CSV to POST /v1/jobs, follow progress over Server-Sent Events, download the results with your original columns kept.
Safe retries
An Idempotency-Key header makes a retry replay the first response for 24 hours: no double charge, no second check.
Signed webhooks
Get a BulkJobCompleted call when a job finishes and CreditLow when your balance runs down, signed with HMAC-SHA256 in X-EV-Signature.
Headroom
9,600 requests per minute per key. A safety net against runaway loops, not a pricing tier.
No-code and AI agents
The same checks from our Zapier app, 13 native integrations, and an MCP server that lets Claude or Cursor verify addresses for you.
Verifying at signup
The most common integration is a signup or lead form. Call the API when the form is submitted and decide in your own code:
- bad (invalid or disposable): ask for a different address before the account is created.
- didYouMean present: offer the correction ("Did you mean jane@gmail.com?").
- risky (catch-all or unknown): accept it, but rely on your confirmation email before trusting it.
- good: carry on.
Keep the key on your server, never in browser code: it carries your credits.
Pricing
One credit per definite answer, from the same balance as everything else. Packs start at 5,000 credits for $15 and come down to $0.00055 per credit at volume. Credits never expire, and catch-all, unknown and error results are free. See the full price list.
Email verification API FAQ
Is there a free tier for the API?
Every new account gets 100 free credits, no card needed, and the API uses the same balance as the dashboard. After that you buy credits that never expire.
What does a call cost?
1 credit when the answer is definite: valid (ok), invalid or disposable. Catch-all, unknown and error results cost nothing, because none of them confirms anything about the mailbox.
What are the rate limits?
Up to 9,600 requests per minute per API key, measured over a sliding 60-second window. Over that you get 429 with a Retry-After header. For large lists, a bulk job is faster and kinder to your connection count than a tight loop.
Do you have SDKs?
There are no SDK packages to install: the API is plain JSON over HTTPS with one header, so any HTTP client works. The reference shows every endpoint in cURL, Node.js, Python, C#, Java, PHP, Go and Ruby.
What happens if my request times out and I retry?
Send an Idempotency-Key header. A retry with the same key within 24 hours replays the first response: no second charge and no second check.
How fast is a check?
Half of all live checks finish in under about 550 ms; a check that has to wait on a slow mail server takes a few seconds. Repeat lookups of the same address are answered from cache almost instantly.
Go further
Get your API key and verify your first address in a minute
Free credits on sign-up. No card. You only pay for definite answers.
Start free