Skip to main content
GET
Use this endpoint to verify a single email address in real-time. OrbiSearch checks DNS records, MX records, and the target mail server to determine whether the mailbox exists and is accepting mail. The response includes a status, a detailed substatus, a plain-English explanation, domain-level signals (mx_record, is_domain_catch_all, is_secure_email_gateway), and enrichment flags such as is_disposable and is_role_account. See the response schema for the meaning of each status and substatus value.

Rate limits

This endpoint is rate-limited to 20 requests per second per account. Exceeding this limit returns a 429 Too Many Requests response. See errors for how to handle rate limit responses.

Authorizations

X-API-Key
string
header
required

API key for authentication

Query Parameters

email
string
required

Email address to verify.

Required string length: 3 - 320
Example:

"jane.doe@acme.com"

timeout
integer
default:97

Timeout in seconds (3-97).

Required range: 3 <= x <= 97
Example:

70

Response

Successful Response

Verification result for a single email address.

email
string
required

The email address that was verified.

Example:

"jane.doe@acme.com"

status
enum<string>
required

Overall verification status: safe (deliverable), risky (uncertain), invalid (undeliverable), unknown (verification failed).

Available options:
safe,
risky,
invalid,
unknown
Pattern: ^(safe|risky|invalid|unknown)$
Example:

"safe"

explanation
string
required

Plain-English explanation of the verification result.

Example:

"Safe to email. The mailbox exists and is deliverable."

email_provider
string
required

Email service provider (Google Workspace, Gmail, Microsoft Outlook, etc.).

Example:

"Google Workspace"

substatus
string | null

Specific reason for the status (e.g., deliverable, catch_all, policy_blocked, mailbox_not_found, invalid_syntax, greylisted, timeout).

Example:

"deliverable"

mx_record
string | null

The main mail server the domain uses to receive email. Null if the domain has no mail server configured. When that happens, substatus will be no_mx_records.

Example:

"aspmx.l.google.com"

is_domain_catch_all
boolean | null

True if the domain accepts mail for any username (catch-all). Null if we could not determine whether the domain is catch-all.

Example:

false

is_secure_email_gateway
boolean
default:false

True if the domain is protected by a secure email gateway: Proofpoint, Mimecast, Barracuda, or Trend Micro.

Example:

false

is_disposable
boolean | null

True if this is a temporary/disposable email service, false if not, null if unknown.

Example:

false

is_role_account
boolean | null

True if this is a generic role-based email (info@, support@, etc.), false if not, null if unknown.

Example:

false

is_free
boolean | null

True if this is from a free email provider (gmail.com, yahoo.com, etc.), false if not, null if unknown.

Example:

false

confidence
integer | null

How certain we are in the result, on a 0–100 scale. Use it alongside status to tune how aggressively you filter. For safe results: 99 = deliverable, highest certainty; 98 = deliverable, but the domain sits behind a secure email gateway (Mimecast, Proofpoint, Barracuda, Trend Micro) that may still filter the message after accepting it; 97 = the address exists, but carries some risk of bouncing after acceptance. For invalid and risky, 99 means we are certain of the negative result. For unknown, 0. null when no score could be attached to the result. Treat that as unscored, not as low confidence.

Required range: 0 <= x <= 100
Example:

99