Checks · Email

Email check

Score an email address: deliverability, disposable / catch-all / spam-trap flags, domain trust and age. The extended tier adds identity, company and breach intelligence.

POST /api/v1/check/email

Body parameters

Field	Type	Required	Description
`email`	string	required	Email address. Invalid input → `400 invalid_target`.
`extended_check`	boolean	optional	Run the extended tier (identity / breaches). Default `false`.
`use_storage`	boolean	optional	Reuse your own prior result of equal-or-higher tier for free. Default `false`.
`external_id`	string	optional	Your own correlation id; stored with the check, echoed back in the response, and searchable in the mini-app history. Max 128 chars.

cURL

curl -X POST https://antifrauder.app/api/v1/check/email \
  -H "X-API-Key: $ANTIFRAUDER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]", "extended_check": true }'

Response

The standard envelope with a phone-style checkId / externalId / charged / extended / fromStorage / balance, plus an email result:

200 — JSON

{
  "checkId": "665f1a9c8e4b2a0012ab34cd",
  "externalId": "order-12345",
  "charged": 17,
  "extended": true,
  "fromStorage": false,
  "balance": 4781,
  "result": {
    "extended": true,
    "intel": {
      "address": { "email": "[email protected]", "domain": "gmail.com", "freeProvider": true },
      "valid": true,
      "deliverability": { "status": "deliverable", "catchAll": false, "spamtrap": false, "disposable": false },
      "domainInfo": { "ageDays": 9863, "mxValid": true, "trust": "trusted" },
      "reputation": { "leaked": true, "scoreCluster": "high" },
      "identity": { "firstName": "John", "lastName": "Doe",
                    "avatar": "https://antifrauder.s3.us-west-004.backblazeb2.com/photos/email/ab12cd" },
      "company": { "name": "Acme Inc", "industry": "Software", "employees": 320,
                   "country": "US", "jobTitle": "Engineer", "founded": 2011 },
      "social": { "linkedin": true, "amazon": true, "instagram": true, "twitter": false, "office365": false },
      "breaches": { "count": 2, "first": "2016-05-01", "last": "2021-04-01", "list": ["LinkedIn", "Canva"] },
      "meta": { "extended": true, "sources": { "ok": 2, "total": 2 } }
    },
    "fraud": {
      "score": 0,
      "level": "low",
      "negative": [
        { "code": "EM-R-07", "key": "leaked", "name": "Leaked", "description": "The address appears in known data leaks.", "points": 10 }
      ],
      "positive": [
        { "code": "EM-T-01", "key": "has_linkedin", "name": "LinkedIn account", "description": "The address is linked to a LinkedIn profile.", "points": -10 },
        { "code": "EM-T-03", "key": "company_exists", "name": "Company resolved", "description": "The address is associated with a known company.", "points": -10 },
        { "code": "EM-T-06", "key": "name_resolved", "name": "Name resolved", "description": "A real first and last name is associated.", "points": -10 }
      ]
    },
    "basicError": null,
    "advancedError": null
  }
}

Intel (result)

result.intel is the consolidated view — the same envelope shape as phone, lowercase canonical vocabulary. Email basic is a single source, so values are direct (no per-field vote wrappers). The extended blocks (identity, company, social, breaches) are null on a basic check.

Field	Type	Description
`address`	object	`email`, `domain`, `freeProvider` (free webmail).
`valid`	boolean	Syntactically + MX-valid, assignable address.
`deliverability`	object	`status` (`deliverable`, `undeliverable`, `risky`, `disposable`, `spamtrap`, `unknown`), `catchAll`, `spamtrap`, `disposable`.
`domainInfo`	object	`ageDays` (`null` if unknown), `mxValid`, `trust` (`trusted`, `neutral`, `suspicious`, `malicious`, `unknown`).
`reputation`	object	`leaked` (in a public leak) and the extended `scoreCluster`.
`identity / company / social / breaches`	object \| null	Extended blocks — see Extended block.
`meta`	object	`extended` and `sources{ok,total}`.

Fraud score

Same 0–100 model and low / medium / high / critical bands as phone, and the same fraud.negative[] (risk) / fraud.positive[] (trust) split — each signal with a stable code, name, description and points. Key email signals:

Code	Signal	Points	Trigger
`EM-R-01`	`undeliverable`	+100	Mailbox can't receive mail.
`EM-R-04` / `EM-R-05`	`disposable_email` / `spam_trap`	+100	Throwaway or trap address.
`EM-R-12`	`malicious_domain`	+100	Domain flagged malicious.
`EM-R-08`	`invalid_mx`	+60	No valid MX records.
`EM-R-09`	`young_domain_30d`	+50	Domain younger than 30 days.
`EM-R-11` / `EM-R-19`	`suspicious_domain` / `parked_domain`	+40	Suspicious or parked domain.
`EM-R-06`	`catch_all`	+25	Catch-all domain.
`EM-T-01` / `EM-T-03` / `EM-T-06`	`has_linkedin` / `company_exists` / `name_resolved`	−10	Resolved identity lowers risk.

Extended block

These blocks live directly on result.intel. They are populated only when extended_check: true and the extended source responded; otherwise each is null and advancedError is set.

Field	Type	Description
`social`	object	Platform → `boolean`: linkedin, twitter, amazon, instagram, spotify, office365, …
`breaches`	object	`{ count, first, last, list[] }` — breach exposure history.
`company`	object	`{ name, industry, employees, country, jobTitle, founded }` (any field may be `null`).
`identity`	object	`{ firstName, lastName, avatar }`. `avatar` is re-hosted on our storage (the data vendor is never exposed).
`scoreCluster`	string	Extended trust band.

Retrieve & batch

GET/api/v1/result/email[email protected]

GET/api/v1/result/:checkId

Latest stored result for that value / id, or 404 not_found.

CSV batch

POST/api/v1/batch/email

multipart/form-data, file field (one email per row, max 10 000), optional extended_check. Then poll GET /api/v1/batch/:jobId and download via GET /api/v1/batch/:jobId/result — identical to the phone batch flow.