Five signals, one key and one credit balance. Spaw reads each against the datasets that actually decide it — live DNS and an SMTP handshake that never sends a message, national numbering plans, network and threat feeds, postal formats and registers, company registers — and a sixth endpoint checks the first four against each other. Every verdict names its reason and its sources, and an answer that comes back negative never costs a credit.
10 free lookups a month · no credit card · one credit per answer, everything included
Live demo
POST /demo/email · no key needed
Response
{
"syntax_valid": true,
"mx_found": true,
"mx_provider": "other",
"domain_category": "disposable",
"disposable": true, (flagged)
"is_relay": false,
"role": false,
"free_provider": true,
"risk_score": 90,
"deliverable": "risky",
"ok_to_send": false, (flagged)
"blocked_by": "disposable", (flagged)
…
}
Every call returns the same envelope: a verdict, the fields behind it, and the source that produced them. These are the fields teams reach for first; the full set ships in every response.
POST /api/v1/email
Catch disposable inboxes, role accounts, dead domains, and typos at the signup form, before they reach your list.
| field | type | example |
|---|---|---|
| deliverable | string | "risky" |
| risk_score | number | 90 |
| disposable | boolean | true |
| mx_provider | string | null | "google" |
| mailbox_exists | boolean | null | true |
| did_you_mean | string | null | null |
1 credit per fresh answer
Try it livePOST /api/v1/phone
Normalize any number to E.164, learn its line type, carrier and block status, and catch fictional, disposable and virtual numbers before you dial or text.
| field | type | example |
|---|---|---|
| valid | boolean | true |
| e164 | string | "+14155550142" |
| line_type | string | "fixed_line_or_mobile" |
| block_status | string | null | "reserved" |
| is_fictional | boolean | true |
| risk_score | number | null | 100 |
1 credit per fresh answer
Learn morePOST /api/v1/ip
Place every visitor on the map and flag the ones that are not visitors at all: cloud and datacenter ranges, Tor exits, named VPN exits, and iCloud Private Relay.
| field | type | example |
|---|---|---|
| country | string | "US" |
| asn | number | 15169 |
| org | string | "Google LLC" |
| is_datacenter | boolean | true |
| risk_score | number | 40 |
1 credit per fresh answer
Learn morePOST /api/v1/address
Read a postal address against its own country’s format, name the delivery point behind it, check the postcode against the national directory, and see how many companies are registered there.
| field | type | example |
|---|---|---|
| valid | boolean | true |
| address_type | string | "private_mailbox" |
| postal_code_valid | boolean | true |
| exists | boolean | null | null |
| companies_registered | number | null | 4218 |
| risk_score | number | null | 60 |
1 credit per valid answer
Learn morePOST /api/v1/entity
Read a Legal Entity Identifier or a company number against the public registers, synced locally: the legal name, whether the entity is still live, and where it was formed.
| field | type | example |
|---|---|---|
| found | boolean | true |
| name | string | null | "ACME HOLDINGS LIMITED" |
| status | string | null | "active" |
| jurisdiction | string | null | "GB-ENG" |
| registered_at | string | null | "1998-03-11" |
| checksum_valid | boolean | null | true |
1 credit when a register answers
Learn morePOST /api/v1/consistency
Run any of the signals above in one call and see where they agree and where they do not. No score and no verdict — the comparisons quote both sides so you can see the working.
| field | type | example |
|---|---|---|
| signals | object | { email, phone, ip, address } |
| country_agreement | string | null | "agree" |
| comparisons | array | 8 entries |
| flags | string[] | ["ip_country_differs_from_address_country"] |
| withheld | string | null | "low_confidence" |
The signals you ask for; the comparison is free
Learn moreYou pay for answers, not attempts. One balance covers every endpoint, and the meter only moves when Spaw tells you something useful.
Run out of credits and the API answers with a typed 402 before any work runs. Nothing is billed behind your back.
The monthly grant lands on every account, paid or not. What you do not use stays on your balance, with no expiry.
Send up to 100,000 rows in one job. We call your webhook, signed, when it finishes.
| outcome | credits |
|---|---|
| Fresh lookup with a usable answer | 1 credit |
| Invalid input or no match | 0 |
| Repeat of a recent lookup, within 7 days | 0 |
| Rejected or failed request | 0 |
| Monthly free grant, every account | +10 |
Anything you paid to check once is free to check again for a week.
Every response includes a sources array naming the dataset and version behind each field, so any verdict can be traced, reproduced, and challenged.
| endpoint | dataset | refreshed |
|---|---|---|
| /v1/email | Live DNS MX, SPF, and DMARC resolution | at request time |
| /v1/email | Curated disposable-domain lists | weekly |
| /v1/email | Open role-address and free-provider lists | weekly |
| /v1/email | Provider username rules and typo-squat map | curated in-repo |
| /v1/email | Relay-service, parking-nameserver, domain-category and name lists | curated in-repo |
| /v1/email | Threat blocklists over the MX hosts (Spamhaus DROP, Feodo) | daily, shared with IP |
| /v1/email | RDAP registry registration and expiry dates | at request time, cached a week |
| /v1/email | SMTP mailbox checks, partner infrastructure | at request time |
| /v1/phone | Google's libphonenumber metadata | with each upstream release |
| /v1/phone | NANPA central office code and thousands-block tables (US, territories), CNAC code table (Canada) | daily (NANPA), weekly (CNAC) |
| /v1/phone | Ofcom National Numbering Scheme tables (UK) | weekly |
| /v1/phone | ARCEP, ACMA and ACM numbering registers (France, Australia, the Netherlands) | weekly |
| /v1/phone | NAD and IFT numbering registers (New Zealand, Mexico) | weekly |
| /v1/phone | UKE and MIMIT numbering tables (Poland, Italy) | weekly |
| /v1/phone | Two open lists of numbers used by SMS-receiving websites | daily |
| /v1/phone | FTC reported-calls data (US unwanted-call complaints) | each weekday file, kept 90 days |
| /v1/phone | Fictional and drama number ranges | curated in-repo |
| /v1/ip | DB-IP Lite city and ASN databases | monthly |
| /v1/ip | Tor Project exit list and relay data, with a thirty-day exit history | hourly |
| /v1/ip | X4BNet datacenter and VPN lists | daily |
| /v1/ip | Published ranges and geofeeds of AWS, Google Cloud, Microsoft Azure, Oracle Cloud, DigitalOcean, Linode, Vultr, Cloudflare, Fastly, and GitHub Actions | daily |
| /v1/ip | Mullvad, NordVPN, Private Internet Access, IVPN, AirVPN, and VPN Gate server lists; Apple’s iCloud Private Relay egress list | daily |
| /v1/ip | Zscaler cloud enforcement node ranges (corporate gateways) | daily |
| /v1/ip | Spamhaus DROP and ASN-DROP threat blocklists; abuse.ch Feodo Tracker botnet C2 list | daily |
| /v1/ip | Attack-source lists: Emerging Threats compromised hosts, CINS Army, blocklist.de | hourly |
| /v1/ip | Crawler ranges published by Google, Microsoft, OpenAI, Perplexity, DuckDuckGo, and Ahrefs | daily |
| /v1/ip | GeoNames populated places (time zones by nearest place) | monthly |
| /v1/ip | OFAC country programmes and FATF lists; mobile carrier and satellite operator ASNs | curated in-repo |
| /v1/ip | RFC 8805 geofeeds discovered across the five regional registries | weekly |
| /v1/address | Postal formats and postcode patterns for 207 countries and territories | bundled and versioned |
| /v1/address | 52 postal operators’ own naming for boxes, lockers and routes | curated in-repo |
| /v1/address | Official building registers of thirteen countries and three German Länder, Great Britain’s streets from OS Open Names, and the Census Bureau’s US house-number ranges | with each publisher release |
| /v1/address | ONS Postcode Directory for Great Britain (Northern Ireland excluded) | with each ONS release |
| /v1/address | GeoNames postal codes for about a hundred more countries | weekly |
| /v1/address | Companies House, INSEE Sirene, the Brønnøysund register, and the Colorado, New York, Oregon, Connecticut and Hawaii business registries | with each published snapshot |
| /v1/address | Branch lists mailbox and mail-forwarding operators publish | with each publisher release |
Block data reflects the original allocation, never a later port. Live carrier status is next on the roadmap, behind the same envelope and a published premium credit.
Send the value you want checked with a bearer key and branch on what comes back. Every failure is a stable, documented code, and rate-limit headers ship on every response.
| error.code | http | when |
|---|---|---|
| UNAUTHENTICATED | 401 | The key is missing, malformed, or revoked. |
| VALIDATION_FAILED | 422 | The input could not be parsed as an email, phone, IP, or address. |
| RATE_LIMITED | 429 | You went over your plan's requests per second. |
| INSUFFICIENT_CREDITS | 402 | The balance is empty. The lookup did not run. |
| KEY_SPEND_CAP_REACHED | 429 | A browser key spent its daily credit cap. Resets each day. |
| ADDRESS_LIST_UNAVAILABLE | 501 | No licensed list or open street listing covers the country or the postcode asked for. Nothing is charged. |
$ curl https://spaw.co/api/v1/email \ -H "Authorization: Bearer sk_live_…" \ -H "Content-Type: application/json" \ -d '{"email": "[email protected]"}' { "success": true, "data": { "deliverable": "deliverable", "disposable": false, "risk_score": 10, "sources": [ { "dataset": "disposable-domains", "version": "2026-08-29" } ], … }, "meta": { "credits_used": 1, "credits_remaining": 499, … } }
/docs/api
Every endpoint with its request, response, and error codes, plus a page of its own for each operation, each reason, and each error.
openapi 3.1
The reference pages are generated from it, so a client you generate cannot drift from what the docs say.
/integrations
Official PHP, Node.js, and Python clients, and a page per platform that says how it connects and whether it works today.
Agents reach the same endpoints over the Model Context Protocol: twelve tools, your own API key, the same billing and the same answers.
/docs/mcp$ claude mcp add --transport http spaw https://spaw.co/mcp \ --header "Authorization: Bearer sk_live_…"
Start free, then buy credits once as a pack or let a monthly plan deposit the same credits for less. Both land in one balance, credits are spent the same way on every endpoint, and a plan is cancelled in one click. What never costs a credit is listed on the pricing page.
$0forever
10 credits / month
no credit card required
$7per month
or $9 one-time
1,000 credits every month
$7.00 per 1,000 on the plan
$29per month
or $39 one-time
5,000 credits every month
$5.80 per 1,000 on the plan
$119per month
or $149 one-time
25,000 credits every month
$4.76 per 1,000 on the plan
$399per month
or $499 one-time
100,000 credits every month
$3.99 per 1,000 on the plan
Every account gets every endpoint, the seven-day repeat cache, free invalid results, and credits that never expire. Packs and plans are bought from the dashboard and top up the same balance the free credits land in; a plan can be changed or cancelled there at any time.
Something else on your mind? Ask support.
The API returns a clear 402 response before running the lookup, so you are never billed for work that cannot complete. Your free credits renew automatically at the start of each month.
No. Lookups that return no match cost nothing, and repeat lookups served from the seven-day cache cost nothing. Credits are only spent on fresh answers.
From auditable sources: international numbering plans and the regulators’ number-block allocation tables for phone; live DNS and curated domain lists for email; and, for IP, openly licensed geolocation databases plus the Tor exit list, the cloud providers’ own published ranges, VPN providers’ server lists, Apple’s relay egress list, and the Spamhaus and abuse.ch threat blocklists; and, for postal addresses, the countries’ own postal formats, the operators’ naming for boxes, the official building registers of thirteen countries and three German Länder, the ONS Postcode Directory and GeoNames postal codes, and open company registers. Every response names the exact dataset and version that produced it.
Yes. 10 credits refill every month with no credit card on file — enough to try every endpoint and keep a test integration alive.
Yes, on every account. Send up to 100,000 rows to the bulk endpoint or upload a CSV from the dashboard. Jobs run in the background and call your webhook, signed, when they finish.
Inputs are processed to answer the request and retained only for your own usage logs and the short result cache. We do not resell or enrich submitted data, and you can purge a workspace at any time.
Create a key, make your first call, and keep 10 free lookups a month.