API Documentation

Disposable Armor API

Everything you need to detect disposable emails, analyze email quality, and protect your application from fraud.

Authentication

All API requests require authentication with your API key. Include it in the request headers:

Request Headers
Authorization: Bearer YOUR_API_KEY
// OR
X-API-Key: YOUR_API_KEY

API Keys Per Plan

Free
1 key
Basic
3 keys
Pro
7 keys
Plus
10 keys
Growth
25 keys
Enterprise
Unlimited

Rate Limits

Monthly Quotas

Based on your subscription plan, resets on billing anniversary.

Free100/mo
Basic3,000/mo
Pro15,000/mo
Plus30,000/mo
Growth150,000/mo
EnterpriseCustom

Technical Rate Limit

All plans are limited to protect against abuse.

60
requests per minute

Exceeding either limit returns a 429 status code with details about which limit was exceeded.

API Endpoint

GET/api/v1/check

This endpoint accepts two different query parameters depending on your use case. Choose the one that fits your needs:

Use the domain parameter when you only need to check if a domain is disposable. This is useful when you already have the domain extracted or want to validate domains in bulk.

What you get
  • • Disposable domain detection
  • • Allowlist check (legitimate providers)
  • • Advanced ML detection (paid plans)
  • • Apple proxy detection (paid plans)
Example
GET /api/v1/check?domain=mailinator.com

Use the email parameter when you have a complete email address. The domain is automatically extracted, plus you get additional email quality analysis on paid plans.

What you get
  • • Everything from domain check
  • • Email quality analysis (paid plans)
  • • Alias detection with normalized email
  • • Bot/auto-generated detection
  • • Role account detection
Example
GET /api/v1/[email protected]

Recommended: Use the email parameter to get the most comprehensive analysis, especially for signup forms and user registration flows.

Code Examples

# Check a domain only
curl -X GET "https://www.disposablearmor.com/api/v1/check?domain=mailinator.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Check a full email (recommended for signups)
curl -X GET "https://www.disposablearmor.com/api/v1/[email protected]" \
  -H "Authorization: Bearer YOUR_API_KEY"

Response Examples

Response Fields

domain
string
The domain that was checked
is_temporary
boolean
true if the domain is identified as disposable/temporary
is_allowed
boolean
If true, domain is on the allowlist of legitimate providers (overrides is_temporary)
checks_remaining
number
API calls remaining in your current billing period
limit
number
Total monthly API call limit for your plan
reset_date
string
Date when your monthly quota resets (YYYY-MM-DD)

Email Quality Analysis

Paid Plans

Comprehensive email analysis with confidence scores for different risk categories. Only available when using the email parameter.

overall_risk
string
Risk level: low, medium, high, or critical
risk_score
number
Overall risk score (0-100) with decimal precision, combining all confidence factors
confidence
object
Category-specific confidence scores with decimal precision (see below)
indicators
string[]
Array of detected indicator codes (da_* prefix)
alias_detection
object
Detailed alias analysis with normalized email
summary
string
Human-readable summary of the analysis

Indicator Codes

These codes appear in the indicators array and identify specific risk patterns.

da_alias_plus_tagEmail uses +tag aliasing (e.g., [email protected])
da_alias_plus_randomPlus tag appears random/auto-generated - likely evading detection
da_alias_dot_separatedEmail uses dot-based aliasing (dots ignored by Gmail, etc.)
da_alias_excessive_dotsExcessive dot usage suggests intentional aliasing
da_alias_separator_patternSeparator pattern detected (e.g., u.s.e.r or u-s-e-r)

Score Recommendations

Use these recommended thresholds as a starting point for your implementation. Adjust based on your specific use case and risk tolerance.

Overall Risk Score

0-39
Low Risk
✓ Allow signup
40-69
Medium Risk
⚠ Review or add verification
70-89
High Risk
⚠ Require verification
90-100
Critical
✗ Block or reject

Apple Proxy Detection

The confidence score indicates how likely the email/IP is an Apple privacy service.

Score RangeMeaningRecommended Action
0-30%Not an Apple proxyTreat as normal email
30-70%Possible Apple serviceConsider additional verification
70-90%Likely Apple proxyFlag for review, may limit features
90-100%Confirmed Apple proxyHandle as privacy-conscious user

Note: Apple proxy users are legitimate but privacy-conscious. Consider allowing them while noting they may have limited trackability.

Email Quality Confidence Scores

Each category has its own confidence score. Here are recommended thresholds:

Alias ConfidenceDuplicate detection
<40 Normal
40-70 Possible alias
>70 Likely alias

💡 Store normalized_email and check for duplicates when alias ≥40

Bot Generated ConfidenceSpam prevention
<40 Human-like
40-60 Suspicious
>60 Likely bot

💡 Add CAPTCHA or phone verification when bot_generated ≥50

Role Account ConfidencePersonal email enforcement
<50 Personal
50-80 Shared inbox
>80 Automated/noreply

💡 Reject signups with role_account ≥70 if you require personal emails

Invalid ConfidenceFormat validation
<20 Valid format
20-50 Minor issues
>50 Invalid

💡 Always reject emails with invalid ≥80 (malformed/RFC non-compliant)

Example Implementation

// Example: Signup validation logic
async function validateSignup(email) {
  const response = await fetch(`/api/v1/check?email=${email}`, {
    headers: { 'Authorization': 'Bearer YOUR_API_KEY' }
  });
  const data = await response.json();
  
  // Block disposable emails
  if (data.is_temporary) {
    return { allowed: false, reason: 'Disposable email not allowed' };
  }
  
  // Block invalid emails
  if (data.email_quality?.confidence.invalid >= 80) {
    return { allowed: false, reason: 'Invalid email format' };
  }
  
  // Block likely bots
  if (data.email_quality?.confidence.bot_generated >= 60) {
    return { allowed: false, reason: 'Suspicious email pattern', requireCaptcha: true };
  }
  
  // Flag aliases for duplicate checking
  if (data.email_quality?.confidence.alias >= 40) {
    const normalizedEmail = data.email_quality.alias_detection.normalized_email;
    const existingUser = await checkExistingUser(normalizedEmail);
    if (existingUser) {
      return { allowed: false, reason: 'Account already exists' };
    }
  }
  
  // Optionally require personal emails (block role accounts)
  if (data.email_quality?.confidence.role_account >= 70) {
    return { allowed: false, reason: 'Please use a personal email address' };
  }
  
  return { allowed: true, riskScore: data.email_quality?.risk_score || 0 };
}

Error Responses

400
invalid_inputMissing or invalid query parameter
401
invalid_api_keyInvalid or missing API key
429
monthly_limit_exceededMonthly API quota exceeded
429
technical_rate_limit_exceeded60 requests/minute limit exceeded

Accuracy Disclaimer

While our service strives for high accuracy, we cannot guarantee 100% accuracy in all cases. The disposable email landscape is constantly evolving.

We recommend implementing appropriate fallback mechanisms and user verification processes. Disposable Armor should be used as one component of a comprehensive email validation strategy.

Ready to Get Started?

Sign up for a free account to get your API key and start protecting your service from disposable emails.