About Spaw

Spaw is a verification API, launched in 2026 at spaw.co. You send an identifier someone typed into a form — an email address, a phone number, an IP address, a postal address, a business number — and the API answers what it is, why it says so, and how much to trust the answer. Six signals run off one key and one credit balance. The same engine sits behind a dashboard, bulk uploads, a browser form widget, and an MCP server for AI agents.

The six signals

• Email verification (POST /v1/email). Whether mail to an address will arrive. The address is parsed against RFC 5322 and then against the username rules of the big providers, so [email protected] is rejected the way Gmail itself would reject it. MX records are resolved at query time: a domain with no MX record but an A record is reported as implicit MX, a null MX record as a domain that declines all mail, MX hosts pointing at dead or private addresses as unresolvable. SPF and DMARC records are read and the DMARC policy is reported. The domain is matched against the open disposable-provider list, including domains whose mail is handled by a listed operator, and the local part against the open role-address list. A curated map catches gmail.con and friends and suggests the intended domain. Finally an SMTP handshake asks the receiving server whether the mailbox exists; the conversation ends before any message is transmitted, and nothing is ever sent to an address you check. 46 fields, including what the username and the domain look like, whether the mail hosts sit on a threat blocklist, and two signals read from traffic rather than lists.
• Phone intelligence (POST /v1/phone). Any number normalised to E.164, national, international and tel: forms, with its line type and carrier, each naming the source that decided it, and the regulator's own block status read from the regulators' allocation tables for the United States, Canada, the United Kingdom, France, Australia, the Netherlands, New Zealand, Mexico, Poland and Italy. Fictional ranges, disposable numbers and virtual services are flagged, and every answer ends with your own phone policy's ok_to_send decision. 49 fields.
• IP intelligence (POST /v1/ip). Where an address is, who runs it, and whether it is a visitor at all: the network and its ASN, country facts with the sanctions programmes and FATF list naming the country, the time zone down to the nearest place, datacenter and cloud ranges, corporate gateway egress, Tor exits with a thirty-day history, named VPN and relay exits, mobile and satellite operators, verified crawlers named individually, the public blocklists an address appears on, and your own allow and deny lists. 62 fields.
• Address verification (POST /v1/address). A postal address read against its own country's format, ending in a decision — ok_to_ship and blocked_by from your own shipping policy — and answering whether the street or town is a placeholder somebody typed to get past the form: the parsed parts, the kind of delivery point it names — street, PO box, private mailbox, general delivery, rural route, military, parcel locker, bulk mail — whether the postcode exists and is live or terminated and whether the town and region written on it belong to that postcode, whether the building appears in a national address register and where it stands, what the register says it is used for, how many companies are registered there and whether the address is a mailbox operator's branch or a registered agent's, and which parts of the address a dataset stood behind and what was normalised. Nothing in the answer says who lives or works at an address. 61 fields.
• Business verification (POST /v1/entity). A Legal Entity Identifier or a UK company number read against open registers synced onto this server: the legal name, whether the entity is still live in the register's own wording, its country, jurisdiction and incorporation date, and for a LEI its check digit and registration status. Where both registers hold one entity they are compared field by field, with both sides quoted. Spaw is not affiliated with either register. 20 fields, and no registered address, deliberately: an identifier does not say whether a company or a sole trader stands behind it.
• Cross-signal consistency (POST /v1/consistency). Any subset of the four above in one call. Each signal answers exactly as its own endpoint, and on top of that the agreements and disagreements between them are named with the fields that decided each one, both sides quoted. There is no score, no risk level, no verdict and no recommendation, and there will not be one: a difference between two fields is a fact about the fields, not a judgement about a person.

Domain intelligence asks the same questions about a whole domain rather than one address, at GET /v1/email/domain/{domain}. It bills on its own but belongs to the email product.

What every answer has in common

• The response names its data sources, each with a version or a sync date, so you can see exactly what the answer was based on.
• Null means "not evaluated", never "no". A field Spaw could not check comes back null and says why, rather than guessing a plausible value.
• A risk score you can audit. Four of the six — email, phone, IP and address — carry a 0 to 100 score that is a published sum of weights, one per signal, not a black box. Business verification has no score, and neither does the consistency check.
• Two premium checks are off, and say so. A live carrier check on a phone number and a deliverability check on a postal address both need a licensed partner. Until one is configured they add nothing to the bill and the response reports that the check did not run.

How billing works

You pay for answers, not attempts. What counts as an answer differs by signal — the pricing page carries the rate card, one row per endpoint — but the rule is the same everywhere:

• A fresh lookup that comes back with a usable answer costs 1 credit, and one credit covers five IP lookups.
• A non-answer is free: an invalid number, a reserved IP range, an address that cannot stand, a malformed business identifier, an email answer whose mailbox check was uncertain. Undeliverable email verdicts are free within a fair-use allowance.
• Repeating a lookup within 7 days is free.
• Every account gets 100 free credits at the start of each month, with no card required, and unused free credits accumulate.
• Pack credits never expire; plan credits roll over up to three months' allowance and stay usable for 60 days after you cancel.

What we hold ourselves to

• Full data everywhere. The free tools show the same fields as the paid API.
• No data sales. What you submit is used to answer your query and for nothing else. Only email verification keeps a history row, and it is deleted after 30 days; phone, IP, address and business lookups write no history and no log line carrying the value. The privacy policy and the security page spell this out.

Channels

• REST API at https://spaw.co/api/v1, documented in the API reference
• The dashboard, with a playground for every signal, history, bulk runs, monitors, and suppression lists
• Bulk uploads of up to 100,000 email addresses, phone numbers, IP addresses or postal addresses, with signed completion webhooks
• A browser form widget that checks email addresses and phone numbers as people type
• An MCP server whose twelve tools let AI agents run the same lookups with your API key, one value or a list at a time

Open data we build on

Spaw credits the open datasets it relies on: Google's libphonenumber, the regulators' number-block tables (NANPA's central-office code, thousands-block and NPA reports, CNAC, Ofcom (Ofcom copyright, reused with acknowledgement), ARCEP under the Licence Ouverte / Open Licence, ACMA, ACM, New Zealand's NAD, Mexico's CRT (formerly the IFT), Poland's UKE — Urząd Komunikacji Elektronicznej, whose tables Spaw retrieves weekly and processes into block answers — and Italy's MIMIT, credited with a link to its numbering page as its legal notes ask), the Federal Trade Commission's Do Not Call reported-calls files (a US Government work), the SMS-receiving number lists of iP.1 Networks and Castle (both MIT), DB-IP Lite, the disposable/disposable-email-domains list, the mixmaxhq role-based address list, and the Kikobeats free-email-domains list. IP lookups also read the Tor Project's exit list and Onionoo relay data, X4BNet's datacenter and VPN lists, the published IP ranges and geofeeds of AWS, Google Cloud, Microsoft Azure, Oracle Cloud, DigitalOcean, Linode, Vultr, Cloudflare and Fastly, GitHub's hosted runner ranges, the server lists of Mullvad, NordVPN, Private Internet Access, IVPN, AirVPN and the VPN Gate project, Apple's iCloud Private Relay egress list, the cloud enforcement node ranges Zscaler publishes, and the threat blocklists Spamhaus DROP and ASN-DROP (© The Spamhaus Project, used with the credit its terms ask for) and abuse.ch's Feodo Tracker (CC0), the attack-source lists of Emerging Threats (from its BSD-licensed open ruleset), CINS and blocklist.de, the ranges Google, Microsoft, OpenAI, Perplexity, DuckDuckGo and Ahrefs publish so sites can verify their crawlers, the RFC 8805 geofeeds network operators publish about their own ranges, and the GeoNames list of populated places (CC BY 4.0) for time zones by nearest place. The sanctions and FATF facts come from a curated file that names the OFAC programme list and the FATF plenary it was checked against.

Address verification reads the country address formats from Google's Address Data Service (© Google LLC, CC BY 4.0), first imported through commerceguys/addressing (MIT), and the national address registers: the US National Address Database and the Census Bureau's TIGER/Line address ranges (both public domain), the Base Adresse Nationale (IGN/DINUM, Licence Ouverte 2.0), the Swiss official directory of building addresses (© swisstopo), the Czech RÚIAN from ČÚZK, the Norwegian Matrikkelen from Kartverket and Latvia's State Address Register from the Valsts zemes dienests (all CC BY 4.0), the Austrian address register (CC BY 4.0, credited as © Österreichisches Adressregister, Stichtagsdaten vom DD.MM.YYYY — the reference date of the installed snapshot, which the status page lists as the at-adressregister version), Belgium's BeST Address registers of Flanders, Wallonia and Brussels republished by FPS BOSA (CC BY 4.0), Luxembourg's BD-Adresses from the Administration du cadastre et de la topographie (CC0), Danmarks Adresseregister (DAR) from Klimadatastyrelsen (CC BY 4.0), New Zealand's street addresses from Land Information New Zealand (CC BY 4.0, where a LINZ key is configured), and — incorporating or developed using G-NAF © Geoscape Australia, licensed by the Commonwealth of Australia under the Open Geo-coded National Address File (G-NAF) End User Licence Agreement — the Australian address file, which is never used to build a mailing list. The Netherlands' Basisregistratie Adressen en Gebouwen (BAG) comes from Kadaster (CC0 1.0), and Brazil's addresses from IBGE's Cadastro Nacional de Endereços para Fins Estatísticos, the 2022 census address list (public data). Three German Länder publish their own building registers: Berlin's addresses from Geoportal Berlin (Amt für Statistik Berlin-Brandenburg) and North Rhine-Westphalia's Gebäudereferenzen from Geobasis NRW, both under Datenlizenz Deutschland – Zero 2.0, and Rhineland-Palatinate's Hauskoordinaten © GeoBasis-DE / LVermGeoRP under Datenlizenz Deutschland – Namensnennung 2.0. US ZIP codes gain the places whose land they cover from the Census Bureau's ZCTA relationship files (public domain). Great Britain's streets and the places its postcodes are written with come from Ordnance Survey's Open Names (Open Government Licence v3.0, containing OS data © Crown copyright and database right 2026). Postcodes come from the ONS Postcode Directory, which contains ONS, OS and Royal Mail data © Crown copyright and database right 2026 under the Open Government Licence v3.0 — Northern Irish postcodes are excluded, because reusing them needs a Land & Property Services licence — and, outside Great Britain, from the GeoNames postal-code dump (CC BY 4.0). Companies registered at an address are counted from the Companies House free company data product (Open Government Licence v3.0), INSEE's Sirene base (Licence Ouverte 2.0), the Brønnøysund Register Centre's Enhetsregisteret (NLOD 2.0) and the Colorado, New York, Oregon, Connecticut and Hawaii business registries (the states' own open data portals); mail drops from the branch lists mailbox operators publish themselves; and registered-agent addresses from the agents' own published addresses and the public filings that name them (US state listings and filings, and Companies House filings). The other names a town or a one-city region is written under come from the GeoNames list of populated places (CC BY 4.0), and the counties an Irish Eircode routing key reaches are derived from the Residential Property Price Register (© Property Services Regulatory Authority, under the PSRA's re-use terms; read 24 September 2026).

Business verification reads the GLEIF Level 1 golden copy of Legal Entity Identifier reference data (CC0 1.0) and the same Companies House free company data product (Open Government Licence v3.0). Both are downloaded and queried here, so no third party sits in the request path — and neither register provides, supports or authorises the answer Spaw gives.

Contact

Questions, partnership requests, and press: [email protected].