POST /v1/ - Check an email address

Score an email address for signup risk. AuthFlame parses the address, normalizes it to a canonical form, evaluates syntax, entropy, and domain signals, and returns a recommended action.

Endpoint

POST https://api.authflame.com/v1/

Headers

string

required

Bearer token containing your AuthFlame API key. Example: Bearer af_live_....

string

required

Must be application/json.

Body

string

required

The email address to check. Submit the raw value the user entered; AuthFlame handles trimming, casing, and normalization.

Example request

curl -X POST https://api.authflame.com/v1/ \
  -H "Authorization: Bearer af_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"email": "test@example.com"}'

$headers = @{
  "Authorization" = "Bearer af_live_your_api_key"
  "Content-Type"  = "application/json"
}
$body = @{ email = "test@example.com" } | ConvertTo-Json

Invoke-RestMethod `
  -Uri "https://api.authflame.com/v1/" `
  -Method Post `
  -Headers $headers `
  -Body $body

const response = await fetch("https://api.authflame.com/v1/", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.AUTHFLAME_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ email: "test@example.com" }),
});

const result = await response.json();

import os
import requests

response = requests.post(
    "https://api.authflame.com/v1/",
    headers={
        "Authorization": f"Bearer {os.environ['AUTHFLAME_API_KEY']}",
        "Content-Type": "application/json",
    },
    json={"email": "test@example.com"},
)

result = response.json()

Response

string

Unique check identifier, prefixed with chk_. Log this for auditing and support.

string

ISO 8601 UTC timestamp for when the check was created.

object

Decision summary derived from the underlying signals.

Show summary

string

Recommended enforcement action.ALLOW or BLOCK.

integer

Integer risk score from 0 (safe) to 100 (highest risk).

string

Coarse bucket derived from the score. One of low, medium, or high.

object

Canonical parsed form of the input address.

Show normalized

string

The address as submitted.

string

Deduplicated form after stripping sub-address tags and provider-specific dot rules. Store this to detect duplicate signups.

string

Local part of the canonical address (the portion before @).

string

Domain portion of the canonical address.

string | null

The +tag portion of the local part, or null if none.

boolean

true if provider-specific dot normalization (for example, Gmail) changed the local part.

object

Raw signals that produced the summary.

Show signals

object

Show syntax

boolean

true if the address parses cleanly.

object

Show entropy

number

Shannon entropy of the local part.

boolean

true when the score crosses AuthFlame’s threshold for auto-generated addresses.

object

Show domain

boolean

true if the domain matches AuthFlame’s disposable-domain list.

boolean

true if the domain is a public free provider (Gmail, Outlook, etc.).

boolean

true if a live DNS lookup returned MX records for the domain.

boolean

true if the domain accepts mail for any local part.

boolean

true if the local part looks like a shared inbox (info, support, etc.).

string

low, medium, or high, based on abuse patterns for the top-level domain.

Example response

200 OK

{
  "summary": {
    "action": "ALLOW",
    "risk_score": 3,
    "risk_level": "low"
  },
  "normalized": {
    "raw": "test@example.com",
    "canonical": "test@example.com",
    "local_part": "test",
    "domain": "example.com",
    "subaddress": null,
    "has_dots_removed": false
  },
  "signals": {
    "syntax": { "valid_format": true },
    "entropy": { "score": 1.5, "suspicious": false },
    "domain": {
      "is_known_disposable": false,
      "is_known_free_provider": false,
      "has_mx": true,
      "is_catch_all": false,
      "is_role_account": false,
      "tld_risk_level": "low"
    }
  }
}

Errors

See Errors for the shared error envelope and HTTP status codes. Common errors for this endpoint:

400 — request body is missing email or is not valid JSON.
401 — API key is missing, malformed, or revoked.
422 — the submitted string cannot be parsed as an email address.
429 — rate limit exceeded. Retry with exponential backoff.

Overview

Endpoints

POST /v1/ - Check an email address

Endpoint

Headers

Body

Example request

Response

Example response

Errors

​Endpoint

​Headers

​Body

​Example request

​Response

​Example response

​Errors

Endpoint

Headers

Body

Example request

Response

Example response

Errors