Docs

Three endpoints, one response shape, and an explicit answer to the question every other vendor leaves vague: what happens when the answer is genuinely not knowable.

A request

curl -X POST https://api.proofwire.app/v1/email   -H "Authorization: Bearer pk_test_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"   -H "Content-Type: application/json"   -H "Idempotency-Key: $(uuidgen)"   -d '{"value": "catchall@sandbox.proofwire.app"}'

The three-state verdict

valid

Confidence ≥ 0.62. Billed.

invalid

Confidence ≤ 0.35. Billed.

unknown

Inside the band. Never billed. Handle it explicitly — it is an answer, not an error.

Why unknown exists at all

The commonest case is a catch-all mail server: it answers 250 for every address, including ones that cannot exist, so its acceptance of yours proves nothing. The industry norm is to report that as valid and invoice for it — which is where the "we were told it was deliverable and it hard-bounced" complaints come from. We return unknown, charge nothing, and tell you which control probe led us there.

Reading the evidence

Each evidence[] entry carries a weight in log-odds. Positive pushes toward valid, negative toward invalid, and zero means the signal is real but deliberately does not move the verdict — it feeds risk instead.

The weights sum, the sum goes through a sigmoid, and that is confidence. Evidence carrying a freshnessDays value is discounted as it ages, so a month-old carrier record never counts the same as a live probe.

Validity and risk are separate

A real, reachable mobile can belong to a serial fraudster. A disposable inbox can be perfectly deliverable today. Folding those into one number is why fraud scores read as noise, so you get both and gate on whichever your use case cares about.

Idempotency

Send Idempotency-Key on every call if your client retries on timeout. A retry with the same key replays the stored response and spends nothing. Reusing a key with a different body returns 409 rather than quietly answering the wrong question.

Sandbox fixtures

Without deterministic fixtures there is no way to write a test for how your integration behaves on an inconclusive verdict, so that path ships untested.

SubjectInputVerdictWhat it exercises
phone+15005550001validValid, reachable mobile on a major carrier.
phone+15005550002invalidDisconnected number — reachable check fails.
phone+15005550006validVoIP line — valid but not a mobile. The case cheap APIs get wrong.
phone+15005550009validOn the US Do Not Call registry — valid, but calling it is a TCPA exposure.
phone+1500555invalidImpossible length — rejected in tier 1, never billed.
emailvalid@sandbox.proofwire.appvalidDeliverable mailbox, control probe correctly rejected.
emailbounce@sandbox.proofwire.appinvalidHard bounce — permanent 550 from the receiving server.
emailcatchall@sandbox.proofwire.appunknownCatch-all domain. Returns unknown and costs zero credits — the false positive competitors bill you for.
emailgreylisted@sandbox.proofwire.appunknownTemporary 451. Inconclusive, so unknown and unbilled.
emaildisposable@mailinator.comvalidThrowaway inbox - technically deliverable, high risk. Two axes disagreeing on purpose.
emailuser@gmial.cominvalidTypo with a suggested correction - recovers the signup instead of losing it.
ip8.8.8.8validDatacenter address - routable, but a bot signal on a consumer signup.
ip192.168.1.1invalidRFC 1918 private address - a forwarded-for header is being trusted that should not be.

Full reference

OpenAPI 3.1 document · Live status · Benchmark JSON