What’s the rate limit?

500 requests per second by default, per API key. We raise it on request for teams sending high volume — just email us with your expected throughput and we’ll bump you up.

Is there a free tier?

Every account gets 100 free credits to test. After that, prepaid credits start at $8 for 1,000 verifications. No subscription required.

Do you have a sandbox / test environment?

Yes. Pass `test_mode: true` to any endpoint and we return deterministic mock responses for the common cases (valid, invalid, typo, disposable, role) — free of charge.

How do you handle PII?

mailfloss is GDPR and CCPA compliant. Verification requests are logged for 30 days for debugging, then purged. We never train models on customer data. Full data processing addendum available on request.

99.99% uptime, measured monthly. SLA credits apply for verified downtime. Public status page at status.mailfloss.com.

Can my AI agent use this?

Yes. The API is designed for programmatic use — deterministic JSON responses, structured failure reasons, idempotent requests with optional request_id. We’ve also published an OpenAPI 3.1 spec at api.mailfloss.com/openapi.json for code generation and tool-call schemas.

mailfloss · API

Email verification, as a single endpoint.

A REST API for verifying email addresses — JSON in, JSON out. Built for product teams and AI agents that need programmatic answers, not dashboards.

Free 7-day trial · Easy setup · Money-back guarantee

10,000 / min

default rate limit — raise on request

99.996%

uptime — Live status →

20+

verification checks per address

Bearer · JSON

auth · format · OpenAPI 3.1 spec

GET · api.mailfloss.com

Request

curl "https://api.mailfloss.com/v1/[email protected]" \
  -H "Authorization: Bearer $MAILFLOSS_API_KEY"

200 OKResponse · application/json

{
  "email": "[email protected]",
  "domain": "theshire.com",
  "status": "passed",
  "reason": "valid",
  "passed": true,
  "role": false,
  "disposable": false,
  "free": false,
  "suggestion": "",
  "meta": ""
}

In short

What does the mailfloss email verification API do?

The mailfloss email verification API checks whether an email address is valid, deliverable, disposable, role-based, or likely to bounce — in real time, from your own code. Send an address to a single REST endpoint and get back a clear result plus the risk signals you can act on at signup, checkout, or form submission. It's the same verification engine behind mailfloss's automated list cleaning, exposed for developers.

The verify endpoint

GET one address. Get back a verdict.

A single GET with your key in a Bearer header and the address as a query param. No SDK required — plain HTTPS works in any language.

GET /v1/verify

curl "https://api.mailfloss.com/v1/[email protected]" \
  -H "Authorization: Bearer $MAILFLOSS_API_KEY"

200 OKResponse

application/json

{
  "email": "[email protected]",
  "domain": "theshire.com",
  "status": "passed",
  "reason": "valid",
  "passed": true,
  "role": false,
  "disposable": false,
  "free": false,
  "suggestion": "",
  "meta": ""
}

X-Request-Id: req_…returned as a response header · 1 credit / verification

status is a closed enum

passedundeliverableriskyunknown

Spotted a typo? When an address looks misspelled, mailfloss returns the likely correction in the suggestion field — here gmial.cmo becomes gmail.com. status stays the deliverability verdict; the fix always lives in suggestion, so you can offer the user a “Did you mean…?” prompt.

GET /v1/[email protected]

{
  "email": "[email protected]",
  "domain": "gmial.cmo",
  "status": "undeliverable",
  "reason": "invalid",
  "passed": false,
  "suggestion": "[email protected]",
  "meta": ""
}

Endpoints

The developer surface.

Made for the AI era — every endpoint returns deterministic JSON an agent can call directly, no scraping or screen-reading required. Bearer token only. Rate limit is 10,000 requests/min per key — a 429 includes a Retry-After header. POST routes accept an Idempotency-Key header for safe retries.

Verify

GET/v1/verifyVerify a single email address.

Batch

POST/v1/batch-verifySubmit a list of addresses for async verification.

GET/v1/batch-verify/{id}/statusCheck progress of a batch job.

GET/v1/batch-verify/{id}/resultsRetrieve results once the job is finished.

POST/v1/batch-verify/{id}/cancelCancel a running batch job.

Jobs

GET/v1/jobsList your verification jobs.

GET/v1/jobs/{id}Fetch a single job.

Usage

GET/v1/reports/usageRemaining credits and usage for the current period.

Account

GET/v1/check-keyValidate an API key.

GET/v1/accountAccount details and credit balance.

GET/v1/organizationOrganization details.

Privacy

POST/v1/erasuresSubmit a data-erasure (GDPR / CCPA) request.

Webhooks

Get pushed the result — skip the polling.

Two flavors: a per-job webhook on batch verifications, and broader account webhooks that fire as your lists are cleaned.

API-level · batch webhook

Pass a webhook_url to a batch job and mailfloss POSTs the finished job — its id and verdict summary — to that URL, so you never have to poll for status.

POST /v1/batch-verify

{
  "emails": ["[email protected]", "[email protected]"],
  "webhook_url": "https://you.com/hook"
}

Account webhooks

React to changes across your mailfloss account — these fire as your lists are cleaned, not on individual /v1/verify calls. Each webhook is a name, one or more trigger events, a destination URL, a data source, and an optional secret.

Configured today in the dashboard → API & Webhooks

Programmatic /v1/webhooks management — coming soon

25+ granular triggers, in dot notation

status.*

status.undeliverablestatus.riskystatus.unknown

reason.*

reason.bouncedreason.invalidreason.rolereason.disposablereason.blacklistedreason.accept_allreason.spamreason.complainer…

contact.*

contact.fixedcontact.unsubscribedcontact.deletedcontact.taggedcontact.updated

job

job.finished

Payload mailfloss POSTs

Flat JSON body. email, domain, status, reason, passed, processed and integration are always present; suggestion appears on fixes; an event-specific boolean (fixed / unsubscribed / deleted / tagged / updated) accompanies contact.* events; event is the dot-notation trigger.

{
  "email": "[email protected]",
  "domain": "gmial.cmo",
  "status": "risky",
  "reason": "accept_all",
  "passed": false,
  "processed": true,
  "integration": "mailchimp",
  "suggestion": "[email protected]",
  "fixed": true,
  "event": "contact.fixed"
}

Verify the signature

When a webhook secret is set, every delivery carries an X-Request-Signature header — an HMAC-SHA1 of the raw JSON body, keyed by your secret.

const sig = crypto
  .createHmac('sha1', SECRET)
  .update(rawBody)
  .digest('hex');
 
// constant-time compare
sig === req.headers['x-request-signature'];

Delivery

Respond 200 to acknowledge a delivery.

Non-200 responses are retried with exponential backoff — 5 retries over ~60s to 5 min.

After 5 straight failures the webhook is auto-deactivated.

Best-effort: no ordering guarantee, and events may arrive in bursts.

Built for

Use cases that match the surface area.

PRODUCT TEAMS

Verify signups inline

Pass every incoming address through verify before it hits your users table — block disposable, surface a typo suggestion, reject invalid, all in one request.

GET /v1/verify

AI AGENTS

Resolve addresses programmatically

Agents need ground-truth on whether an address is real. mailfloss returns a deterministic verdict with a closed status enum and structured reasons — ideal for tool calls.

GET /v1/verify · structured JSON · idempotent reads

BULK VERIFICATION

Clean an inherited list

Acquired a database, or got a CSV from a partner? Submit the whole list to batch-verify and pass a webhook_url to get notified upon completion.

POST /v1/batch-verify

TRANSACTIONAL EMAIL

Verify before you send

Check an address right before a password reset, receipt, or magic link goes out — so critical mail doesn’t bounce and your sender reputation stays clean.

GET /v1/verify

How the mailfloss API compares to other verification APIs

Capability	mailfloss	ZeroBounce	Kickbox	Hunter
Single real-time verify endpoint	Yes — GET /v1/verify, JSON in and JSON out	Real-time API available	Yes — API or JS widget, developer setup	Verification alongside prospect discovery
Typo correction in the response	Yes — returns a suggestion field (gmial.cmo → gmail.com)	Typos are flagged as invalid, not fixed	No — invalid addresses are flagged, not fixed	—
Automated recurring cleanup (beyond the API)	Yes — connect a supported ESP for hands-off, scheduled cleanup	Manual or API-driven runs	No — re-uploads required	One-off verification, prospecting-led
Best fit	Teams that want a real-time API plus automated ESP list cleaning	High-volume bulk verification	Bulk-only, developer-led workflows	Outbound teams needing prospect discovery plus verification

Full comparisons: ZeroBounce alternatives NeverBounce alternatives

API vs list cleaning

What’s the difference between a real-time verification API and bulk list cleaning?

A real-time verification API checks one address the moment you need it — at signup, checkout, or form submission — and returns a verdict in a single request, so you can block a bad address before it ever reaches your database. Bulk list cleaning runs the same checks across an entire existing list at once, usually on a schedule, to remove or fix addresses that have gone bad over time.

mailfloss does both from the same engine. Call GET /v1/verify to validate addresses in real time from your own code, and connect a supported email platform to clean the list you already have automatically on a recurring schedule — so mailfloss is not a bulk-CSV-only verifier; the API and ongoing ESP cleanup run off one verification core.

Spam signups

How do you stop spam signups on email forms automatically?

Verify email addresses in real time, at the form itself. Call the mailfloss API on submit: invalid, disposable, and typoed addresses are rejected — or the typo is corrected — before they ever reach your list. A CAPTCHA like Cloudflare Turnstile blocks bots, but it can't catch fake or mistyped addresses that real users submit, so pair both layers. mailfloss then keeps cleaning your connected list automatically for anything that slips through.

What customers say

Brandon McDonald

Director of Marketing

We were looking for an email validation service that could support enterprise level volume and tight integration with HubSpot, and frankly mailfloss was the only game in town.

Clients

No SDK required — plain HTTPS works.

Every endpoint is a plain HTTPS call with a Bearer header, so any language with an HTTP client is ready today. Typed SDKs are on the way.

Typed SDKs — coming soon

NodeSoon

PythonSoon

GoSoon

RubySoon

API pricing

Pay per verification. No subscription required.

Prepaid credits — one credit per verification. The bigger the pack, the lower the per-credit price.

Credits
One-time price
Per credit

1,000

$0.008

10,000

$40

$0.004

50,000

$160

$0.0032

100,000

$300

$0.003

250,000

$500

$0.002

500,000

$800

$0.0016

1,000,000

$1,200

$0.0012

2,500,000

$2,600

$0.00104

Prices shown + tax. A standing 15% promo currently applies at checkout. Need higher volume? See the full pricing page.

See full pricing

API FAQ

Common questions.

10,000 requests per minute per API key by default. Exceed it and you get a 429 with a Retry-After header telling you when to retry. Need more? Email us with your expected throughput and we’ll raise it.

Related resources

Automated email verification

The no-code product behind the API — connect your ESP and clean lists on autopilot.

All integrations

Connect mailfloss to Mailchimp, Klaviyo, HubSpot, and more.

Pricing & credits

Prepaid verification credits — one credit per check.

ZeroBounce alternatives

How mailfloss compares for automated list cleaning.

Ready when you are

Stop paying to email a leaky list.

Connect your email platform in 30 seconds. mailfloss starts catching typos and cleaning your list on autopilot.

Free 7-day trialEasy setupMoney-back guarantee