API
Contact data with the verification detail attached. REST, JSON, one error shape, and a generated OpenAPI 3.1 spec that cannot drift from the server.
curl -sG 'https://api.verifyinbox.tech/api/v1/email-finder' \ -H 'Authorization: Bearer vi_live_…' \ -d domain=acme.com \ -d first_name=Jane \ -d last_name=Doe
{
"email": "[email protected]",
"firstName": "Jane",
"lastName": "Doe",
"position": "Chief Executive Officer",
"department": "executive",
"seniority": "executive",
"confidence": 96,
"confidenceBand": "high",
"nameSource": "jsonld",
"pattern": "{first}.{last}",
"verification": {
"status": "deliverable",
"acceptAll": false,
"disposable": false,
"smtp": "250 OK",
"score": 98
},
"sources": [
{
"uri": "https://acme.com/team",
"extractedOn": "2026-08-20T09:14:02.000Z",
"lastSeenOn": "2026-08-25T06:03:11.000Z",
"stillOnPage": true
}
]
}Endpoints and what they cost
| Endpoint | Credits | Notes |
|---|---|---|
| GET /domain-search | 1 | Addresses at a domain, with source pages. Refunded if empty. |
| GET /email-finder | 1 | Name plus domain to an address. Refunded if not found. |
| GET /company | 1 | Company profile. Refunded if not indexed. |
| GET /email-count | 0 | How much data exists. Always free. |
| POST /verify | 0.5 | Verify one address. Not charged if inconclusive. |
| POST /bulk/upload | 0 | Stage a CSV. Reserves nothing until confirmed. |
| POST /bulk/:id/confirm | per row | Priced on unique addresses only. |
| GET /credits/ledger | 0 | Every credit movement, with the operation behind it. |
The one thing to get right in your integration
Treat ENGINE_CAPACITY and any result with retryable: true as "ask again later", never as a result. Both mean the mailbox was not tested. Writing either into your database as undeliverable will remove real customers from your list, and neither is charged — so retrying costs you nothing.
Idempotency
Endpoints that move money or launch a bulk job require an Idempotency-Key. Reuse the same key across retries of one intent. The same key with a different body is a conflict rather than a silent replay, which is what makes the guarantee worth anything.
Webhooks
Bulk jobs and low-credit warnings can be delivered to an endpoint you control, signed sha256=<hex> over the exact body — the same convention GitHub uses, so you probably already have code that verifies it. Endpoints must be https, and private address ranges are refused.
API questions
How do I authenticate?
A bearer token: Authorization: Bearer vi_live_… Keys are created in the dashboard, shown once, and stored only as a hash. A key's scopes are intersected with its creator's live permissions on every request, so revoking a person's access revokes their keys' power with it.
What happens when verification capacity runs out?
You get a 503 with error code ENGINE_CAPACITY and a Retry-After header. That is not a failure and it is not charged — the mailbox was never tested. Treat it as "ask again", never as a result.
How are errors structured?
Every error is { error: { code, message, details?, retryAfterSeconds? } }. Switch on code — it comes from a closed catalogue. Message text is written for humans and may change between releases.
Are there SDKs?
Not yet. The OpenAPI 3.1 specification is generated from the route schemas themselves, so a generated client is accurate by construction — and the spec cannot drift from what the server actually accepts.
What are the rate limits?
Per key, and per route according to cost. Verification is tighter than search because each call spends real sending capacity. Limits are returned in standard draft-7 rate limit headers.