Email Verification API: A Developer's Guide

What Is an Email Verification API?

An email verification API is an HTTP endpoint that answers one question on demand: is this address deliverable? Instead of building and maintaining your own syntax parsing, DNS/MX lookups, and SMTP probing — and getting your sending IPs blocked in the process — you make a request to a hosted service and get back a clean, structured verdict. It's the programmable version of the email verification a tool does through a dashboard.

"Email validation API", "email verifier API", and "email checker API" all describe the same thing — the terms are used interchangeably. Wherever you need to keep bad addresses out of your data, an API is how you wire that check directly into your product:

How Does an Email Verification API Work?

An email verification API works by running an address through a series of escalating checks server-side and rolling the outcome into a single response. Each layer is cheaper and faster than the one after it, so the API resolves obvious cases early and only does the expensive work when it has to:

All of that happens server-side in a single call — average response time is under 200ms for most domains — and you get back one JSON object with the verdict and the individual signals that produced it.

How Do You Integrate an Email Verification API?

You integrate an email verification API in three steps: get an API key, send a POST request with the address, and handle the JSON response. With Enrichley the verification endpoint is POST https://api.enrichley.io/api/v1/validate-single-email, and you authenticate by putting your key in the X-Api-Key header on every request.

Here's a complete request in three common forms. Same endpoint, same headers — pick your language:

cURL

curl -X POST "https://api.enrichley.io/api/v1/validate-single-email" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -d '{"email": "[email protected]"}'

JavaScript (fetch)

const response = await fetch(
  "https://api.enrichley.io/api/v1/validate-single-email",
  {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "X-Api-Key": "YOUR_API_KEY",
    },
    body: JSON.stringify({ email: "[email protected]" }),
  }
);

const data = await response.json();
console.log(data.valid, data.result); // true "ok"

Python (requests)

import requests

response = requests.post(
    "https://api.enrichley.io/api/v1/validate-single-email",
    headers={
        "Content-Type": "application/json",
        "X-Api-Key": "YOUR_API_KEY",
    },
    json={"email": "[email protected]"},
)

data = response.json()
print(data["valid"], data["result"])  # True "ok"

What Does the API Response Tell You?

The API response tells you both the headline verdict and the individual signals behind it, so you can make your own policy decision. A verification returns a JSON object like this:

{
  "email": "[email protected]",
  "valid": true,
  "result": "ok",
  "mx_domain": "example.com",
  "email_type": "business",
  "mx_provider": "google",
  "mx_secure_email_gateway": false,
  "credits_consumed": true
}

The valid boolean is the headline — safe to send or not. The result field gives the detail, one of five values:

Alongside the verdict, each response carries context — mx_domain and mx_provider (the mail host), email_type (e.g. business), mx_secure_email_gateway (whether the domain sits behind a security gateway), and credits_consumed (whether this call spent a credit). Rate-limit and balance state come back in response headers — x-ratelimit-remaining and x-credits-remaining — so a well-behaved client can self-throttle without a second call.

How Does the API Handle Catch-All Domains?

Catch-all domains are where email verification APIs quietly separate into good and mediocre. A catch-all (accept-all) domain is configured to accept mail for every address at the domain, whether the mailbox exists or not. That defeats the standard SMTP check: the server says "yes" to everything, so a plain check can't tell a real inbox from a typo. And catch-all isn't a rare edge case — 40-60% of B2B domains are catch-all.

In the response, the result field tells you exactly which kind you're in: catch_all_validated when we confirm a deliverable inbox inside a catch-all domain (with valid: true), versus catch_all for an accept-all domain we couldn't resolve. A resolved catch-all comes back as a first-class deliverable result, not dumped into a "risky" pile. If catch-all handling is your main concern, the dedicated catch-all verifier and our guide on how to verify catch-all emails go deeper.

Pricing, Credits & Rate Limits

Enrichley bills the API by credit: each email verification costs one credit. Plans start at $59/mo for 5,000 credits (Starter) and scale up from there, and — this is the part that matters for developers — full API access is included on every tier, so the API isn't locked behind an enterprise contract. Credits roll over for as long as your subscription is active, and annual billing saves 15%.

You can check your remaining balance any time with the GET /me endpoint, which returns your account status, remaining credits, and monthly allocation. Need more than 10 requests per second for a large batch job? Contact support about higher-throughput enterprise options. See the pricing page for the full tier breakdown.

Frequently Asked Questions