Verify any email address with one API call.

Spaw checks syntax, live MX records, SPF and DMARC, disposable and role lists, and runs an SMTP mailbox handshake that never sends a message. Every verdict names its reason and its data sources. One key, one credit balance, and undeliverable results never cost a credit. Phone and IP intelligence ship next.

Get your API key View pricing

10 free lookups a month · no credit card · one credit per answer, everything included

POST /api/v1/email

Request

curl https://spaw.co/api/v1/email \

-H "Authorization: Bearer sk_live_…"\

-H "Content-Type: application/json"\

-d '{ "email": "[email protected]" }'

Response

200 · 41 ms

{

"success": true,

"data": {

"syntax_valid": true,

"mx_found": true,

"mx_provider": "other",

"disposable": true, (flagged)

"role": false,

"free_provider": false,

"risk_score": 90,

"deliverable": "risky"

"meta": { "credits_used": 1, "credits_remaining": 499, "cache_hit": false}

}

Disposable41 ms1 credit

spaw.co

Three endpoints, one response shape.

Every call returns the same envelope: a verdict, the fields behind it, and the source that produced them. These are the fields teams reach for first; the full set ships in every response.

POST /api/v1/email

Email verification

Catch disposable inboxes, role accounts, dead domains, and typos at the signup form, before they reach your list.

field	type	example
deliverable	string	"risky"
risk_score	number	90
disposable	boolean	true
mx_provider	string \| null	"google"
mailbox_exists	boolean \| null	true
did_you_mean	string \| null	null

1 credit per fresh answer

Try it live

POST /api/v1/phone

Coming soon

Phone intelligence

Normalize any number to E.164 and learn its line type, carrier region, and timezone before you dial or text it.

field	type	example
valid	boolean	true
e164	string	"+14155550142"
line_type	string	"fixed_line_or_mobile"
region	string	"San Francisco, CA"
timezones	string[]	["America/Los_Angeles"]

1 credit per fresh answer

Learn more

POST /api/v1/ip

Coming soon

IP intelligence

Place every visitor on the map and flag the ones that are not visitors at all: datacenter ranges, Tor exits, known VPNs.

field	type	example
country	string	"US"
asn	number	15169
org	string	"Google LLC"
is_datacenter	boolean	true
risk_score	number	40

1 credit per fresh answer

Learn more

How credits work

You pay for answers, not attempts. One balance covers all three endpoints, and the meter only moves when Spaw tells you something useful.

A hard stop, never a surprise bill

Run out of credits and the API answers with a typed 402 before any work runs. Nothing is billed behind your back.

Free credits that accumulate

The monthly grant lands on every account, paid or not. What you do not use stays on your balance, with no expiry.

Bulk jobs with signed webhooks

Send up to 100,000 rows in one job. We call your webhook, signed, when it finishes.

outcome	credits
Fresh lookup with a usable answer	1 credit
Invalid input or no match	0
Repeat of a recent lookup, within 7 days	0
Rejected or failed request	0
Monthly free grant, every account	+10

Anything you paid to check once is free to check again for a week.

Where the answers come from

Every response includes a sources array naming the dataset and version behind each field, so any verdict can be traced, reproduced, and challenged.

endpoint	dataset	refreshed
/v1/email	Live DNS MX, SPF, and DMARC resolution	at request time
/v1/email	Curated disposable-domain lists	weekly
/v1/email	Open role-address and free-provider lists	weekly
/v1/email	Provider username rules and typo-squat map	curated in-repo
/v1/email	RDAP registry registration dates	at request time, cached a week
/v1/email	SMTP mailbox checks, partner infrastructure	at request time
/v1/phonesoon	Google's libphonenumber metadata	with each upstream release
/v1/ipsoon	DB-IP Lite city and ASN databases	monthly
/v1/ipsoon	Tor exit, datacenter, and VPN ranges	daily

Live carrier status and caller-ID name are next on the roadmap, behind the same envelope and the same credit.

Plain REST with typed errors.

Send the value you want checked with a bearer key and branch on what comes back. Every failure is a stable, documented code, and rate-limit headers ship on every response.

error.code	http	when
UNAUTHENTICATED	401	The key is missing, malformed, or revoked.
VALIDATION_FAILED	422	The input could not be parsed as a phone, email, or IP.
RATE_LIMITED	429	You went over your plan's requests per second.
INSUFFICIENT_CREDITS	402	The balance is empty. The lookup did not run.
KEY_SPEND_CAP_REACHED	429	A browser key spent its daily credit cap. Resets each day.

$ curl https://spaw.co/api/v1/email \
    -H "Authorization: Bearer sk_live_…" \
    -H "Content-Type: application/json" \
    -d '{"email": "[email protected]"}'

{
  "success": true,
  "data": {
    "deliverable": "deliverable",
    "disposable": false,
    "risk_score": 10,
    "sources": [
      { "dataset": "disposable-domains", "version": "2026-08-29" }
    ],
    …
  },
  "meta": { "credits_used": 1, "credits_remaining": 499, … }
}

Pricing

Start free, then buy credits once as a pack or let a monthly plan deposit the same credits for less. Both land in one balance, credits are spent the same way on every endpoint, and a plan is cancelled in one click. What never costs a credit is listed on the pricing page.

Free

$0forever

10 credits / month

no credit card required

Every endpoint, bulk jobs, webhooks
Dashboard playground and monitors
Community support

Start free

Starter

$7per month

or $9 one-time

1,000 credits every month

$7.00 per 1,000 on the plan

Credits never expire
Cancel anytime
Email support

Get started

Growth

Scale

$119per month

or $149 one-time

25,000 credits every month

$4.76 per 1,000 on the plan

Credits never expire
Cancel anytime
Priority support

Get started

Volume

$399per month

or $499 one-time

100,000 credits every month

$3.99 per 1,000 on the plan

Credits never expire
Cancel anytime
Priority support

Get started

Every account gets each endpoint as it launches (email is live today), the seven-day repeat cache, free invalid results, and credits that never expire. Packs and plans are bought from the dashboard and top up the same balance the free credits land in; a plan can be changed or cancelled there at any time.

Common questions

Something else on your mind? Write to [email protected].

What happens when I run out of credits?

The API returns a clear 402 response before running the lookup, so you are never billed for work that cannot complete. Your free credits renew automatically at the start of each month.

Do failed lookups cost credits?

No. Lookups that return no match cost nothing, and repeat lookups served from the seven-day cache cost nothing. Credits are only spent on fresh answers.

Where does the data come from?

From auditable sources: international numbering plans for phone; live DNS and curated domain lists for email; and openly licensed geolocation databases plus the public Tor exit-node and datacenter/VPN range lists for IP. Every response names the exact dataset and version that produced it.

Is the free tier really recurring?

Yes. 10 credits refill every month with no credit card on file — enough to try every endpoint and keep a test integration alive.

Can I verify a whole list at once?

Yes, on every account. Send up to 100,000 rows to the bulk endpoint or upload a CSV from the dashboard. Jobs run in the background and call your webhook, signed, when they finish.

What do you keep after a lookup?

Inputs are processed to answer the request and retained only for your own usage logs and the short result cache. We do not resell or enrich submitted data, and you can purge a workspace at any time.

Start verifying today.

Create a key, make your first call, and keep 10 free lookups a month.

Get your API key