Spaw checks syntax, live MX records, SPF and DMARC, disposable and role lists, and runs an SMTP mailbox handshake that never sends a message. Every verdict names its reason and its data sources. One key, one credit balance, and undeliverable results never cost a credit. Phone, IP and postal address verification run on the same key.
10 free lookups a month · no credit card · one credit per answer, everything included
POST /api/v1/email
Request
curl https://spaw.co/api/v1/email \
-H "Authorization: Bearer sk_live_…"\
-H "Content-Type: application/json"\
-d '{ "email": "[email protected]" }'
Response
200 · 41 ms
{
"success": true,
"data": {
"syntax_valid": true,
"mx_found": true,
"mx_provider": "other",
"disposable": true, (flagged)
"role": false,
"free_provider": false,
"risk_score": 90,
"deliverable": "risky"
},
"meta": { "credits_used": 1, "credits_remaining": 499, "cache_hit": false}
}
Every call returns the same envelope: a verdict, the fields behind it, and the source that produced them. These are the fields teams reach for first; the full set ships in every response.
POST /api/v1/email
Catch disposable inboxes, role accounts, dead domains, and typos at the signup form, before they reach your list.
| field | type | example |
|---|---|---|
| deliverable | string | "risky" |
| risk_score | number | 90 |
| disposable | boolean | true |
| mx_provider | string | null | "google" |
| mailbox_exists | boolean | null | true |
| did_you_mean | string | null | null |
1 credit per fresh answer
Try it livePOST /api/v1/phone
Normalize any number to E.164, learn its line type, carrier and block status, and catch fictional, disposable and virtual numbers before you dial or text.
| field | type | example |
|---|---|---|
| valid | boolean | true |
| e164 | string | "+14155550142" |
| line_type | string | "fixed_line_or_mobile" |
| block_status | string | null | "reserved" |
| is_fictional | boolean | true |
| risk_score | number | null | 100 |
1 credit per fresh answer
Learn morePOST /api/v1/ip
Place every visitor on the map and flag the ones that are not visitors at all: cloud and datacenter ranges, Tor exits, named VPN exits, and iCloud Private Relay.
| field | type | example |
|---|---|---|
| country | string | "US" |
| asn | number | 15169 |
| org | string | "Google LLC" |
| is_datacenter | boolean | true |
| risk_score | number | 40 |
1 credit per fresh answer
Learn morePOST /api/v1/address
Read a postal address against its own country’s format, name the delivery point behind it, check the postcode against the national directory, and see how many companies are registered there.
| field | type | example |
|---|---|---|
| valid | boolean | true |
| address_type | string | "private_mailbox" |
| postal_code_valid | boolean | true |
| exists | boolean | null | null |
| companies_registered | number | null | 4218 |
| risk_score | number | null | 60 |
1 credit per valid answer
Learn moreYou pay for answers, not attempts. One balance covers every endpoint, and the meter only moves when Spaw tells you something useful.
Run out of credits and the API answers with a typed 402 before any work runs. Nothing is billed behind your back.
The monthly grant lands on every account, paid or not. What you do not use stays on your balance, with no expiry.
Send up to 100,000 rows in one job. We call your webhook, signed, when it finishes.
| outcome | credits |
|---|---|
| Fresh lookup with a usable answer | 1 credit |
| Invalid input or no match | 0 |
| Repeat of a recent lookup, within 7 days | 0 |
| Rejected or failed request | 0 |
| Monthly free grant, every account | +10 |
Anything you paid to check once is free to check again for a week.
Every response includes a sources array naming the dataset and version behind each field, so any verdict can be traced, reproduced, and challenged.
| endpoint | dataset | refreshed |
|---|---|---|
| /v1/email | Live DNS MX, SPF, and DMARC resolution | at request time |
| /v1/email | Curated disposable-domain lists | weekly |
| /v1/email | Open role-address and free-provider lists | weekly |
| /v1/email | Provider username rules and typo-squat map | curated in-repo |
| /v1/email | RDAP registry registration dates | at request time, cached a week |
| /v1/email | SMTP mailbox checks, partner infrastructure | at request time |
| /v1/phone | Google's libphonenumber metadata | with each upstream release |
| /v1/phone | NANPA and CNAC central office code tables (US, territories, Canada) | weekly |
| /v1/phone | Ofcom National Numbering Scheme tables (UK) | weekly |
| /v1/phone | ARCEP, ACMA and ACM numbering registers (France, Australia, the Netherlands) | weekly |
| /v1/phone | Open list of numbers used by SMS-receiving websites | weekly |
| /v1/phone | Fictional and drama number ranges | curated in-repo |
| /v1/ip | DB-IP Lite city and ASN databases | monthly |
| /v1/ip | Tor Project exit list; X4BNet datacenter and VPN lists | daily |
| /v1/ip | Published ranges and geofeeds of AWS, Google Cloud, Microsoft Azure, Oracle Cloud, DigitalOcean, Linode, Vultr, Cloudflare, and Fastly | daily |
| /v1/ip | Mullvad, NordVPN, and Private Internet Access server lists; Apple’s iCloud Private Relay egress list | daily |
| /v1/ip | Spamhaus DROP and ASN-DROP threat blocklists; abuse.ch Feodo Tracker botnet C2 list | daily |
| /v1/ip | Crawler ranges published by Google, Microsoft, OpenAI, Perplexity, DuckDuckGo, and Ahrefs | daily |
| /v1/ip | RFC 8805 geofeeds discovered across the five regional registries | weekly |
| /v1/address | Postal formats and postcode patterns for 206 countries | bundled and versioned |
| /v1/address | 52 postal operators’ own naming for boxes, lockers and routes | curated in-repo |
| /v1/address | National address registers of the US, France, Switzerland, Austria, Czechia and Norway | with each publisher release |
| /v1/address | ONS Postcode Directory for Great Britain (Northern Ireland excluded) | with each ONS release |
| /v1/address | Companies House and the Colorado, New York and Oregon business registries | with each published snapshot |
| /v1/address | Branch lists mailbox and mail-forwarding operators publish | with each publisher release |
Block data reflects the original allocation, never a later port. Live carrier status is next on the roadmap, behind the same envelope and a published premium credit.
Send the value you want checked with a bearer key and branch on what comes back. Every failure is a stable, documented code, and rate-limit headers ship on every response.
| error.code | http | when |
|---|---|---|
| UNAUTHENTICATED | 401 | The key is missing, malformed, or revoked. |
| VALIDATION_FAILED | 422 | The input could not be parsed as an email, phone, IP, or address. |
| RATE_LIMITED | 429 | You went over your plan's requests per second. |
| INSUFFICIENT_CREDITS | 402 | The balance is empty. The lookup did not run. |
| KEY_SPEND_CAP_REACHED | 429 | A browser key spent its daily credit cap. Resets each day. |
| ADDRESS_LIST_UNAVAILABLE | 501 | The postcode endpoint has no licensed partner configured. Nothing is charged. |
$ curl https://spaw.co/api/v1/email \ -H "Authorization: Bearer sk_live_…" \ -H "Content-Type: application/json" \ -d '{"email": "[email protected]"}' { "success": true, "data": { "deliverable": "deliverable", "disposable": false, "risk_score": 10, "sources": [ { "dataset": "disposable-domains", "version": "2026-08-29" } ], … }, "meta": { "credits_used": 1, "credits_remaining": 499, … } }
Start free, then buy credits once as a pack or let a monthly plan deposit the same credits for less. Both land in one balance, credits are spent the same way on every endpoint, and a plan is cancelled in one click. What never costs a credit is listed on the pricing page.
$0forever
10 credits / month
no credit card required
$7per month
or $9 one-time
1,000 credits every month
$7.00 per 1,000 on the plan
$29per month
or $39 one-time
5,000 credits every month
$5.80 per 1,000 on the plan
$119per month
or $149 one-time
25,000 credits every month
$4.76 per 1,000 on the plan
$399per month
or $499 one-time
100,000 credits every month
$3.99 per 1,000 on the plan
Every account gets every endpoint (email, phone and IP are live today), the seven-day repeat cache, free invalid results, and credits that never expire. Packs and plans are bought from the dashboard and top up the same balance the free credits land in; a plan can be changed or cancelled there at any time.
Something else on your mind? Write to [email protected].
The API returns a clear 402 response before running the lookup, so you are never billed for work that cannot complete. Your free credits renew automatically at the start of each month.
No. Lookups that return no match cost nothing, and repeat lookups served from the seven-day cache cost nothing. Credits are only spent on fresh answers.
From auditable sources: international numbering plans and the regulators’ number-block allocation tables for phone; live DNS and curated domain lists for email; and, for IP, openly licensed geolocation databases plus the Tor exit list, the cloud providers’ own published ranges, VPN providers’ server lists, Apple’s relay egress list, and the Spamhaus and abuse.ch threat blocklists; and, for postal addresses, the countries’ own postal formats, the operators’ naming for boxes, six national address registers, the ONS Postcode Directory and open company registers. Every response names the exact dataset and version that produced it.
Yes. 10 credits refill every month with no credit card on file — enough to try every endpoint and keep a test integration alive.
Yes, on every account. Send up to 100,000 rows to the bulk endpoint or upload a CSV from the dashboard. Jobs run in the background and call your webhook, signed, when they finish.
Inputs are processed to answer the request and retained only for your own usage logs and the short result cache. We do not resell or enrich submitted data, and you can purge a workspace at any time.
Create a key, make your first call, and keep 10 free lookups a month.