API Documentation

Disposable Armor API

Everything you need to detect disposable emails, analyze email quality, and protect your application from fraud.

Authentication

All API requests require authentication with your API key. Include it in the request headers:

Request Headers
Authorization: Bearer YOUR_API_KEY
// OR
X-API-Key: YOUR_API_KEY

API Keys Per Plan

Free
Up to 1 API key
Basic
Up to 3 API keys
Pro
Up to 7 API keys
Plus
Up to 10 API keys
Growth
Up to 25 API keys
Enterprise
Up to 50 API keys

Rate Limits

Monthly Quotas

Based on your subscription plan, resets on billing anniversary.

Free100/mo
Basic3,000/mo
Pro15,000/mo
Plus30,000/mo
Growth150,000/mo
EnterpriseCustom

Technical Rate Limit

All plans are limited to protect against abuse.

60
requests per minute

Exceeding either limit returns a 429 status code with details about which limit was exceeded.

API Endpoint

GET/api/v1/check

This endpoint accepts two different query parameters depending on your use case. Choose the one that fits your needs:

Use the domain parameter when you only need to check if a domain is disposable. This is useful when you already have the domain extracted or want to validate domains in bulk.

What you get
  • • Disposable domain detection
  • • Allowlist check (legitimate providers)
  • • Advanced detection — MX-record analysis (paid plans)
  • • Private relay & alias detection (paid plans)
Example
GET /api/v1/check?domain=mailinator.com

Use the email parameter when you have a complete email address. The domain is automatically extracted, plus you get additional email quality analysis on paid plans.

What you get
  • • Everything from domain check
  • • Email quality analysis (paid plans)
  • • Alias detection with normalized email
  • • Bot/auto-generated detection
  • • Role account detection
Example
GET /api/v1/[email protected]

Recommended: Use the email parameter to get the most comprehensive analysis, especially for signup forms and user registration flows.

Code Examples

# Check a domain only
curl -X GET "https://disposablearmor.com/api/v1/check?domain=mailinator.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Check a full email (recommended for signups)
curl -X GET "https://disposablearmor.com/api/v1/[email protected]" \
  -H "Authorization: Bearer YOUR_API_KEY"

Response Examples

Response Fields

domain
string
The domain that was checked
is_temporary
boolean
true if the domain is identified as disposable/temporary
is_allowed
boolean
If true, domain is on the allowlist of legitimate providers (overrides is_temporary)
checks_remaining
number
API calls remaining in your current billing period
limit
number
Total monthly API call limit for your plan
reset_date
string
Date when your monthly quota resets (YYYY-MM-DD)

Email Quality Analysis

Paid Plans

Comprehensive email analysis with confidence scores for different risk categories. Only available when using the email parameter.

overall_risk
string
Risk level: low, medium, high, or critical
risk_score
integer
Overall risk score (0-100, whole numbers) combining all confidence factors. A clean email scores 0.
confidence
object
Category-specific confidence scores, each an integer from 0-100 (see below)
indicators
string[]
Array of detected indicator codes (da_* prefix)
alias_detection
object
Detailed alias analysis with normalized email
summary
string
Human-readable summary of the analysis

Indicator Codes

These codes appear in the indicators array and identify specific risk patterns.

da_alias_plus_tagEmail uses +tag aliasing (e.g., [email protected])
da_alias_plus_randomPlus tag appears random/auto-generated - likely evading detection
da_alias_dot_separatedEmail uses dot-based aliasing (dots ignored by Gmail, etc.)
da_alias_excessive_dotsExcessive dot usage suggests intentional aliasing
da_alias_separator_patternSeparator pattern detected (e.g., u.s.e.r or u-s-e-r)

Score Recommendations

Use these recommended thresholds as a starting point for your implementation. Adjust based on your specific use case and risk tolerance.

Overall Risk Score

0-39
Low Risk
✓ Allow signup
40-69
Medium Risk
⚠ Review or add verification
70-89
High Risk
⚠ Require verification
90-100
Critical
✗ Block or reject

Private Relay & Alias Detection

The confidence score is a whole number reflecting how the match was made, not a probability estimate. A score of 0 means nothing was detected.

ScoreMethodMeaningRecommended Action
0none / skippedNothing detected, or no check could be completedTreat as a normal email
90mx_fingerprintCustom domain whose mail is handled by a relay providerTreat as a relay address
91ip_rangeSupplied end-user IP is in Apple's Private Relay egress rangesHandle as a privacy-conscious user
99domain_matchAddress is on a provider-owned alias domain — definitiveHandle per your alias policy

Note: Relay and alias users are legitimate but privacy-conscious. Consider allowing them while noting they may have limited trackability and can disable the alias at any time.

Email Quality Confidence Scores

Each category has its own confidence score. Here are recommended thresholds:

Alias ConfidenceDuplicate detection
<40 Normal
40-70 Possible alias
>70 Likely alias

💡 Store normalized_email and check for duplicates when alias ≥40

Bot Generated ConfidenceSpam prevention
<40 Human-like
40-60 Suspicious
>60 Likely bot

💡 Add CAPTCHA or phone verification when bot_generated ≥50

Role Account ConfidencePersonal email enforcement
<50 Personal
50-80 Shared inbox
>80 Automated/noreply

💡 Reject signups with role_account ≥70 if you require personal emails

Invalid ConfidenceFormat validation
<20 Valid format
20-50 Minor issues
>50 Invalid

💡 Always reject emails with invalid ≥80 (malformed/RFC non-compliant)

Example Implementation

// Example: Signup validation logic
async function validateSignup(email) {
  const response = await fetch(`/api/v1/check?email=${email}`, {
    headers: { 'Authorization': 'Bearer YOUR_API_KEY' }
  });
  const data = await response.json();
  
  // Block disposable emails
  if (data.is_temporary) {
    return { allowed: false, reason: 'Disposable email not allowed' };
  }
  
  // Block invalid emails
  if (data.email_quality?.confidence.invalid >= 80) {
    return { allowed: false, reason: 'Invalid email format' };
  }
  
  // Block likely bots
  if (data.email_quality?.confidence.bot_generated >= 60) {
    return { allowed: false, reason: 'Suspicious email pattern', requireCaptcha: true };
  }
  
  // Flag aliases for duplicate checking
  if (data.email_quality?.confidence.alias >= 40) {
    const normalizedEmail = data.email_quality.alias_detection.normalized_email;
    const existingUser = await checkExistingUser(normalizedEmail);
    if (existingUser) {
      return { allowed: false, reason: 'Account already exists' };
    }
  }
  
  // Optionally require personal emails (block role accounts)
  if (data.email_quality?.confidence.role_account >= 70) {
    return { allowed: false, reason: 'Please use a personal email address' };
  }
  
  return { allowed: true, riskScore: data.email_quality?.risk_score || 0 };
}

Error Responses

400
invalid_inputMissing or invalid query parameter
401
invalid_api_keyInvalid or missing API key
429
monthly_limit_exceededMonthly API quota exceeded
429
technical_rate_limit_exceeded60 requests/minute limit exceeded

Monthly Limit Error Body

When your monthly quota is exhausted, the 429 response includes a human-readable message and an upgrade_url you can surface to your users.

{
  "error": "Monthly API call limit exceeded",
  "limit": 3000,
  "reset_date": "2025-01-31",
  "code": "monthly_limit_exceeded",
  "message": "Monthly check limit reached for your plan. Upgrade to continue: https://disposablearmor.com/pricing",
  "upgrade_url": "https://disposablearmor.com/pricing"
}

Accuracy Disclaimer

While our service strives for high accuracy, we cannot guarantee 100% accuracy in all cases. The disposable email landscape is constantly evolving.

We recommend implementing appropriate fallback mechanisms and user verification processes. Disposable Armor should be used as one component of a comprehensive email validation strategy.

Ready to Get Started?

Sign up for a free account to get your API key and start protecting your service from disposable emails.