curl -X POST https://verification.didit.me/v3/email/risk/ \
-H 'x-api-key: YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"email": "alice@example.com",
"country_code": "US",
"vendor_data": "lead-123",
"metadata": {"source": "signup_prescreen"}
}'import os, requests
resp = requests.post(
"https://verification.didit.me/v3/email/risk/",
headers={"x-api-key": os.environ["DIDIT_API_KEY"], "Content-Type": "application/json"},
json={
"email": "alice@example.com",
"country_code": "US",
"vendor_data": "lead-123",
"metadata": {"source": "signup_prescreen"},
},
timeout=15,
)
resp.raise_for_status()
result = resp.json()
print(result["status"]) # Approved / In Review / Declined
print(result["email"]["is_breached"], result["email"]["is_disposable"])const res = await fetch('https://verification.didit.me/v3/email/risk/', {
method: 'POST',
headers: {
'x-api-key': 'YOUR_API_KEY',
'Content-Type': 'application/json',
},
body: JSON.stringify({
email: 'alice@example.com',
country_code: 'US',
vendor_data: 'lead-123',
metadata: { source: 'signup_prescreen' },
}),
});
const data = await res.json();
console.log(data.status, data.email.is_breached, data.email.is_disposable);<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://verification.didit.me/v3/email/risk/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'email' => 'alice@example.com'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://verification.didit.me/v3/email/risk/"
payload := strings.NewReader("{\n \"email\": \"alice@example.com\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://verification.didit.me/v3/email/risk/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"email\": \"alice@example.com\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://verification.didit.me/v3/email/risk/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"email\": \"alice@example.com\"\n}"
response = http.request(request)
puts response.read_bodyEmail Risk API
Risk-score an email address without sending an OTP. Deliverability, disposable-domain, breach, and fraud signals in one server-to-server call.
curl -X POST https://verification.didit.me/v3/email/risk/ \
-H 'x-api-key: YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"email": "alice@example.com",
"country_code": "US",
"vendor_data": "lead-123",
"metadata": {"source": "signup_prescreen"}
}'import os, requests
resp = requests.post(
"https://verification.didit.me/v3/email/risk/",
headers={"x-api-key": os.environ["DIDIT_API_KEY"], "Content-Type": "application/json"},
json={
"email": "alice@example.com",
"country_code": "US",
"vendor_data": "lead-123",
"metadata": {"source": "signup_prescreen"},
},
timeout=15,
)
resp.raise_for_status()
result = resp.json()
print(result["status"]) # Approved / In Review / Declined
print(result["email"]["is_breached"], result["email"]["is_disposable"])const res = await fetch('https://verification.didit.me/v3/email/risk/', {
method: 'POST',
headers: {
'x-api-key': 'YOUR_API_KEY',
'Content-Type': 'application/json',
},
body: JSON.stringify({
email: 'alice@example.com',
country_code: 'US',
vendor_data: 'lead-123',
metadata: { source: 'signup_prescreen' },
}),
});
const data = await res.json();
console.log(data.status, data.email.is_breached, data.email.is_disposable);<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://verification.didit.me/v3/email/risk/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'email' => 'alice@example.com'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://verification.didit.me/v3/email/risk/"
payload := strings.NewReader("{\n \"email\": \"alice@example.com\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://verification.didit.me/v3/email/risk/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"email\": \"alice@example.com\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://verification.didit.me/v3/email/risk/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"email\": \"alice@example.com\"\n}"
response = http.request(request)
puts response.read_bodyPOST /v3/email/risk/ when you need email intelligence without asking the user to enter a one-time code.
It does not send an email. It creates an API session, enriches the address, applies your email-risk rules, and returns the same normalized email block used by Email Verification in one synchronous response.
When the request is saved, Didit can also use the scored email as aggregate evidence in Networks. Network graphs may show high-risk email intelligence, breach context, and social-profile coverage on shared email signals, but they do not reveal the raw email address to other organizations.
Interpret the response
statusis the final decision for this API session. It is normallyApproved; the risk evaluation can produceIn RevieworDeclined.email.is_breached,email.is_disposable, andemail.is_undeliverableare the stable yes/no signals for application logic.email.breacheslists the most recent known breaches containing the address when coverage is available, with the breach date and the data classes exposed.email.email_intelligence.scoreuses a 0-100 risk scale where a higher number means higher risk.breach_risk_level(Low,Medium,High) andno_of_breachesare derived views.email.email_intelligence.reason_codesexplains which normalized signals contributed to the result. Values can grow over time, so do not reject unknown codes.email.email_intelligenceandemail.enrichmentare compatibility aliases with the same normalized object. New integrations can reademail.enrichment.email.matcheslists other sessions of your application where the same address was used by a different user. Use it for duplicate-account detection.request_idis the API session id. Store it withvendor_dataif you need to correlate the result with later webhooks or console activity.
email.email_intelligence and email.enrichment are best-effort fields. A completed lookup can omit both when no usable intelligence data is returned for that address, domain, or plan. Build rules on is_breached, is_disposable, and is_undeliverable first and treat missing intelligence as “unknown”, not “safe”.Social footprint add-on
Setenable_social to true to add a email_social block to the response under email: the online platforms this email address is registered on, grouped by category, with the summary counts and any profile details our data partners return.
email.email_social.profiles_registeredandemail.email_social.profiles_checkedare the headline numbers: platforms where the email address is confirmed registered, out of the platforms evaluated.email.email_social.registered_platformsandemail.email_social.not_registered_platformslist each platform with itscategoryandscope(global, orlocalfor region-specific platforms).email.email_social.categoriesgives the registered count and ratio per category, andemail.email_social.profilescarries per-platform profile details when a platform exposes them (name, photo URL, about text, privacy status, business-account flag).- Summary indexes (
digital_footprint_diversity,digital_sophistication_index,engagement_depth_index,subscription_affordability_index) are 0-10 composites. Every count can benullwhen the check returned no data for it.
profiles_registered: 0 is a real answer, not a failure: the platforms were checked and the email address was found on none of them, which is a common synthetic-identity signal. This endpoint does not act on it by itself - use email_no_social_presence_action in a workflow to turn it into a Review or Decline verdict.
The block is absent when enable_social is not set, and also when the social check could not be completed - in which case it is not billed.
Sandbox behavior
Sandbox keys validate the request and return deterministic approved data. They do not send an email, consume credits, create a session, or contribute to Networks. Withenable_social set, they also return a deterministic email_social block.
Billing
Email Risk API calls use Email Risk API pricing, lower than full Email Verification because no email is sent. A live request is billable once the lookup starts, even when some best-effort fields are unavailable. The social footprint add-on is billed separately: oneemail_social unit per request on top of the Email Risk API price, whenever the check completes. The credit check before the lookup covers both.Authorizations
Body
Email address to score.
"alice@example.com"
Optional ISO 3166-1 alpha-2 or alpha-3 country hint for intelligence coverage.
3"US"
Optional device and network context observed by your application. All fields are optional. Passing them feeds cross-session match detection in Networks.
Show child attributes
Show child attributes
Your stable reference for this request. Stored on the API session and echoed in the response.
Your non-sensitive JSON metadata. Stored on the API session and echoed in the response.
When true, also look up the social footprint of the address - the email, social, professional, e-commerce and entertainment platforms it is registered on. Billed as one email_social unit per request in addition to this endpoint's own price.
true
Response
The risk evaluation completed. Inspect status for the decision; HTTP is always 200 for completed lookups.
Id of the API session created for this request. Store it with vendor_data if you need to correlate the result with later webhooks or console activity.
Final decision for this API session. Normally Approved; the risk evaluation can produce In Review or Declined.
Approved, In Review, Declined Timestamp of this response.
Echo of the vendor_data you sent, null when you did not send one.
Echo of the metadata you sent, null when you did not send one.
Normalized email report, the same block used by Email Verification responses.
Show child attributes
Show child attributes