> ## Documentation Index
> Fetch the complete documentation index at: https://docs.didit.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Email Risk API

> Risk-score an email address without sending an OTP. Deliverability, disposable-domain, breach, and fraud signals in one server-to-server call.

Use `POST /v3/email/risk/` when you need email intelligence without asking the user to enter a one-time code.

It does not send an email. It creates an API session, enriches the address, applies your email-risk rules, and returns the same normalized email block used by Email Verification in one synchronous response.

When the request is saved, Didit can also use the scored email as aggregate evidence in **Networks**. Network graphs may show high-risk email intelligence, breach context, and social-profile coverage on shared email signals, but they do not reveal the raw email address to other organizations.

## Interpret the response

* `status` is the final decision for this API session. It is normally `Approved`; the risk evaluation can produce `In Review` or `Declined`.
* `email.is_breached`, `email.is_disposable`, and `email.is_undeliverable` are the stable yes/no signals for application logic.
* `email.breaches` lists the most recent known breaches containing the address when coverage is available, with the breach date and the data classes exposed.
* `email.email_intelligence.score` uses a 0-100 risk scale where a higher number means higher risk. `breach_risk_level` (`Low`, `Medium`, `High`) and `no_of_breaches` are derived views.
* `email.email_intelligence.reason_codes` explains which normalized signals contributed to the result. Values can grow over time, so do not reject unknown codes.
* `email.email_intelligence` and `email.enrichment` are compatibility aliases with the same normalized object. New integrations can read `email.enrichment`.
* `email.matches` lists other sessions of your application where the same address was used by a different user. Use it for duplicate-account detection.
* `request_id` is the API session id. Store it with `vendor_data` if you need to correlate the result with later webhooks or console activity.

<Warning>
  `email.email_intelligence` and `email.enrichment` are best-effort fields. A completed lookup can omit both when no usable intelligence data is returned for that address, domain, or plan. Build rules on `is_breached`, `is_disposable`, and `is_undeliverable` first and treat missing intelligence as "unknown", not "safe".
</Warning>

## Social footprint add-on

Set `enable_social` to `true` to add a `email_social` block to the response under `email`: the online platforms this email address is registered on, grouped by category, with the summary counts and any profile details our data partners return.

* `email.email_social.profiles_registered` and `email.email_social.profiles_checked` are the headline numbers: platforms where the email address is confirmed registered, out of the platforms evaluated.
* `email.email_social.registered_platforms` and `email.email_social.not_registered_platforms` list each platform with its `category` and `scope` (`global`, or `local` for region-specific platforms).
* `email.email_social.categories` gives the registered count and ratio per category, and `email.email_social.profiles` carries per-platform profile details when a platform exposes them (name, photo URL, about text, privacy status, business-account flag).
* Summary indexes (`digital_footprint_diversity`, `digital_sophistication_index`, `engagement_depth_index`, `subscription_affordability_index`) are 0-10 composites. Every count can be `null` when the check returned no data for it.

`profiles_registered: 0` is a real answer, not a failure: the platforms were checked and the email address was found on none of them, which is a common synthetic-identity signal. This endpoint does not act on it by itself - use `email_no_social_presence_action` in a workflow to turn it into a Review or Decline verdict.

The block is absent when `enable_social` is not set, and also when the social check could not be completed - in which case it is not billed.

## Sandbox behavior

Sandbox keys validate the request and return deterministic approved data. They do not send an email, consume credits, create a session, or contribute to Networks. With `enable_social` set, they also return a deterministic `email_social` block.

## Billing

Email Risk API calls use Email Risk API pricing, lower than full Email Verification because no email is sent. A live request is billable once the lookup starts, even when some best-effort fields are unavailable.

The social footprint add-on is billed separately: one `email_social` unit per request on top of the Email Risk API price, whenever the check completes. The credit check before the lookup covers both.


## OpenAPI

````yaml POST /v3/email/risk/
openapi: 3.0.0
info:
  version: 3.0.0
  title: Didit Verification API
  description: Identity verification API. Authenticate with x-api-key header.
servers:
  - url: https://verification.didit.me
security: []
tags: []
paths:
  /v3/email/risk/:
    post:
      tags:
        - Standalone APIs
      summary: Risk-score an email address
      description: >-
        Return deliverability, disposable-address, breach, cross-session match,
        and normalized risk-intelligence signals without sending an OTP. The
        endpoint creates an API session and returns its id as `request_id`.


        **Decision.** The top-level `status` mirrors `email.status`. It is
        normally `Approved`; the risk evaluation can produce `In Review` or
        `Declined`.


        **Compatibility aliases.** Live responses expose the normalized
        intelligence object as both `email.email_intelligence` and
        `email.enrichment`. The values are identical. New integrations can read
        `email.enrichment`. Both keys are absent when no usable intelligence
        data was returned.


        **Billing.** Live calls use Email Risk API pricing. The request is
        billable once the lookup starts, even when some best-effort fields are
        unavailable.


        **Sandbox.** Sandbox keys validate the request and return deterministic
        approved data without sending an email, consuming credits, creating a
        session, or contributing to Networks.


        **Authentication.** Send your application's API key in `x-api-key`.
        Missing or invalid credentials return `403` - this API never returns
        `401`.


        **Rate limit.** Shared write budget of 300 requests per minute per API
        key across all POST/PATCH/DELETE endpoints.


        **Social footprint.** Set `enable_social` to `true` to add a
        `email_social` block: the online platforms this address is registered
        on, with per-category counts and any profile details available.
        `profiles_registered: 0` means the platforms were checked and the
        address was found on none of them - a valid, billable answer. The block
        is absent when the add-on was not requested or the check could not be
        completed, and it is not billed in that case. Billing adds one
        `email_social` unit per request on top of this endpoint's own price.
      operationId: post_v3email_risk
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailRiskRequest'
            examples:
              Minimal:
                summary: Score an address with defaults
                value:
                  email: alice@example.com
              Full context:
                summary: Score with signals, country hint, and correlation ids
                value:
                  email: alice@example.com
                  country_code: US
                  signals:
                    ip: 192.0.2.1
                    device_id: 8F0B8FDD-C2CB-4387-B20A-56E9B2E5A0D2
                    device_platform: web
                    os_version: '14.4'
                    app_version: 1.2.34
                    user_agent: >-
                      Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
                      AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4
                      Safari/605.1.15
                  vendor_data: lead-123
                  metadata:
                    source: signup_prescreen
      responses:
        '200':
          description: >-
            The risk evaluation completed. Inspect `status` for the decision;
            HTTP is always `200` for completed lookups.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailRiskResponse'
              examples:
                Clean address:
                  summary: Deliverable address with no breach exposure
                  value:
                    request_id: 82397be9-5921-4970-a979-2d5b43e08b33
                    status: Approved
                    email:
                      status: Approved
                      email: alice@example.com
                      is_breached: false
                      breaches: []
                      is_disposable: false
                      is_undeliverable: false
                      verification_attempts: 0
                      verified_at: null
                      warnings: []
                      lifecycle: []
                      matches: []
                      email_intelligence:
                        score: 4
                        deliverable: high
                        breach_risk_level: Low
                        breach_risk_index: 4
                        is_recent_breach: false
                        is_frequent_breached: false
                        is_disposable: false
                        is_free_domain: false
                        is_breached: false
                        no_of_breaches: 0
                        reason_codes: []
                      enrichment:
                        score: 4
                        deliverable: high
                        breach_risk_level: Low
                        breach_risk_index: 4
                        is_recent_breach: false
                        is_frequent_breached: false
                        is_disposable: false
                        is_free_domain: false
                        is_breached: false
                        no_of_breaches: 0
                        reason_codes: []
                    vendor_data: lead-123
                    metadata:
                      source: signup_prescreen
                    created_at: '2026-09-01T10:30:00.123456+00:00'
                Breached address:
                  summary: Address found in known breaches
                  value:
                    request_id: d1e5c2a8-6f30-4c1a-8b2d-3e4f5a6b7c8d
                    status: In Review
                    email:
                      status: In Review
                      email: bob@example.org
                      is_breached: true
                      breaches:
                        - name: ExampleBreach2023
                          domain: example.org
                          breach_date: '2023-06-01'
                          breach_emails_count: 1200000
                          description: A data breach affecting example.org accounts.
                          logo_path: https://logos.example.org/example.png
                          data_classes:
                            - email_addresses
                            - passwords
                          is_verified: true
                      is_disposable: false
                      is_undeliverable: false
                      verification_attempts: 0
                      verified_at: null
                      warnings: []
                      lifecycle: []
                      matches: []
                      email_intelligence:
                        score: 58
                        deliverable: high
                        breach_risk_level: High
                        breach_risk_index: 72
                        is_recent_breach: true
                        is_frequent_breached: true
                        is_disposable: false
                        is_free_domain: true
                        is_breached: true
                        no_of_breaches: 4
                        reason_codes:
                          - BREACH_EXPOSURE
                          - FREQUENT_BREACH
                      enrichment:
                        score: 58
                        deliverable: high
                        breach_risk_level: High
                        breach_risk_index: 72
                        is_recent_breach: true
                        is_frequent_breached: true
                        is_disposable: false
                        is_free_domain: true
                        is_breached: true
                        no_of_breaches: 4
                        reason_codes:
                          - BREACH_EXPOSURE
                          - FREQUENT_BREACH
                    vendor_data: lead-125
                    metadata: null
                    created_at: '2026-09-01T10:30:00.123456+00:00'
        '400':
          $ref: '#/components/responses/EmailRiskValidationError'
        '403':
          $ref: '#/components/responses/RiskPermissionDenied'
        '429':
          $ref: '#/components/responses/RateLimitedWrite'
      security:
        - ApiKeyAuth: []
      x-codeSamples:
        - lang: curl
          label: curl
          source: |-
            curl -X POST https://verification.didit.me/v3/email/risk/ \
              -H 'x-api-key: YOUR_API_KEY' \
              -H 'Content-Type: application/json' \
              -d '{
                "email": "alice@example.com",
                "country_code": "US",
                "vendor_data": "lead-123",
                "metadata": {"source": "signup_prescreen"}
              }'
        - lang: python
          label: Python
          source: >-
            import os, requests


            resp = requests.post(
                "https://verification.didit.me/v3/email/risk/",
                headers={"x-api-key": os.environ["DIDIT_API_KEY"], "Content-Type": "application/json"},
                json={
                    "email": "alice@example.com",
                    "country_code": "US",
                    "vendor_data": "lead-123",
                    "metadata": {"source": "signup_prescreen"},
                },
                timeout=15,
            )

            resp.raise_for_status()

            result = resp.json()

            print(result["status"])  # Approved / In Review / Declined

            print(result["email"]["is_breached"],
            result["email"]["is_disposable"])
        - lang: javascript
          label: JavaScript
          source: >-
            const res = await
            fetch('https://verification.didit.me/v3/email/risk/', {
              method: 'POST',
              headers: {
                'x-api-key': 'YOUR_API_KEY',
                'Content-Type': 'application/json',
              },
              body: JSON.stringify({
                email: 'alice@example.com',
                country_code: 'US',
                vendor_data: 'lead-123',
                metadata: { source: 'signup_prescreen' },
              }),
            });

            const data = await res.json();

            console.log(data.status, data.email.is_breached,
            data.email.is_disposable);
components:
  schemas:
    EmailRiskRequest:
      type: object
      required:
        - email
      properties:
        email:
          type: string
          format: email
          description: Email address to score.
          example: alice@example.com
        country_code:
          type: string
          maxLength: 3
          description: >-
            Optional ISO 3166-1 alpha-2 or alpha-3 country hint for intelligence
            coverage.
          example: US
        signals:
          $ref: '#/components/schemas/RiskSignals'
        vendor_data:
          type: string
          description: >-
            Your stable reference for this request. Stored on the API session
            and echoed in the response.
        metadata:
          type: object
          nullable: true
          additionalProperties: true
          description: >-
            Your non-sensitive JSON metadata. Stored on the API session and
            echoed in the response.
        enable_social:
          type: boolean
          default: false
          description: >-
            When true, also look up the social footprint of the address - the
            email, social, professional, e-commerce and entertainment platforms
            it is registered on. Billed as one `email_social` unit per request
            in addition to this endpoint's own price.
          example: true
    EmailRiskResponse:
      type: object
      required:
        - request_id
        - status
        - created_at
      properties:
        request_id:
          type: string
          format: uuid
          description: >-
            Id of the API session created for this request. Store it with
            `vendor_data` if you need to correlate the result with later
            webhooks or console activity.
        status:
          type: string
          enum:
            - Approved
            - In Review
            - Declined
          description: >-
            Final decision for this API session. Normally `Approved`; the risk
            evaluation can produce `In Review` or `Declined`.
        vendor_data:
          type: string
          nullable: true
          description: >-
            Echo of the `vendor_data` you sent, `null` when you did not send
            one.
        metadata:
          type: object
          nullable: true
          additionalProperties: true
          description: Echo of the `metadata` you sent, `null` when you did not send one.
        created_at:
          type: string
          format: date-time
          description: Timestamp of this response.
        email:
          type: object
          description: >-
            Normalized email report, the same block used by Email Verification
            responses.
          required:
            - status
            - email
            - is_breached
            - breaches
            - is_disposable
            - is_undeliverable
          properties:
            status:
              type: string
              enum:
                - Approved
                - In Review
                - Declined
              description: Decision for this email address. Mirrors the top-level `status`.
            email:
              type: string
              description: The scored address.
              example: alice@example.com
            is_breached:
              type: boolean
              description: Whether the address appears in a known credential breach.
            breaches:
              type: array
              description: >-
                Up to 5 most recent known breaches containing this address.
                Empty array when `is_breached` is `false`.
              items:
                type: object
                properties:
                  name:
                    type: string
                    description: Breach identifier.
                  domain:
                    type: string
                    description: Domain of the breached service.
                  breach_date:
                    type: string
                    format: date
                    description: Date the breach occurred.
                  breach_emails_count:
                    type: integer
                    description: Total number of accounts exposed in the breach.
                  description:
                    type: string
                    description: >-
                      Human-readable description of the breach (may contain HTML
                      markup).
                  logo_path:
                    type: string
                    description: URL of the breached service's logo.
                  data_classes:
                    type: array
                    items:
                      type: string
                    description: >-
                      Categories of data exposed, in snake_case (e.g.,
                      `email_addresses`, `passwords`).
                  is_verified:
                    type: boolean
                    description: Whether the breach has been verified as legitimate.
            is_disposable:
              type: boolean
              description: Whether the domain belongs to a throwaway provider.
            is_undeliverable:
              type: boolean
              description: Whether the address was found undeliverable.
            verification_attempts:
              type: integer
              description: OTP sends for this address. `0` for risk lookups.
            verified_at:
              type: string
              format: date-time
              nullable: true
              description: >-
                When the address was last verified by an OTP. `null` for risk
                lookups.
            warnings:
              type: array
              description: >-
                Risk warnings recorded for this request. Empty array when there
                are none.
              items:
                $ref: '#/components/schemas/RiskWarning'
            lifecycle:
              type: array
              description: >-
                Chronological audit trail of the request. Empty array for risk
                lookups without sends.
              items:
                $ref: '#/components/schemas/RiskLifecycleEvent'
            matches:
              type: array
              description: >-
                Other sessions of your application where the same email address
                was used by a different user (different `vendor_data`). Up to 5
                entries. Empty array when there are no matches.
              items:
                $ref: '#/components/schemas/EmailMatchItem'
            email_intelligence:
              $ref: '#/components/schemas/EmailIntelligence'
            enrichment:
              $ref: '#/components/schemas/EmailIntelligence'
            email_social:
              $ref: '#/components/schemas/EmailSocialFootprint'
    RiskSignals:
      type: object
      description: >-
        Optional device and network context observed by your application. All
        fields are optional. Passing them feeds cross-session match detection in
        Networks.
      properties:
        ip:
          type: string
          format: ip
          description: IPv4 or IPv6 address observed for the end user.
          example: 192.0.2.1
        device_id:
          type: string
          maxLength: 255
          description: >-
            Stable device identifier collected by your application (Android
            `ANDROID_ID`, iOS `identifierForVendor`).
        device_platform:
          type: string
          enum:
            - android
            - ios
            - ipados
            - tvos
            - web
          description: Platform of the end user's device.
        device_model:
          type: string
          maxLength: 255
          description: Device model reported by your application.
        os_version:
          type: string
          maxLength: 64
          description: Operating-system version.
        app_version:
          type: string
          maxLength: 64
          description: Version of your application.
        user_agent:
          type: string
          maxLength: 512
          description: Browser or app user agent.
    RiskWarning:
      type: object
      required:
        - feature
        - risk
        - log_type
        - short_description
        - long_description
      properties:
        feature:
          type: string
          description: Feature that produced the warning.
        risk:
          type: string
          description: Machine-readable risk code. New values can be added over time.
        additional_data:
          type: object
          nullable: true
          additionalProperties: true
          description: Risk-specific context, or `null`.
        log_type:
          type: string
          enum:
            - error
            - warning
            - information
          description: Severity used by the decision rules.
        short_description:
          type: string
          description: Human-readable one-line summary.
        long_description:
          type: string
          description: Human-readable explanation.
    RiskLifecycleEvent:
      type: object
      required:
        - type
        - timestamp
        - details
        - fee
      properties:
        type:
          type: string
          description: Machine-readable event type. New values can be added over time.
        timestamp:
          type: string
          format: date-time
          description: When the event happened.
        details:
          type: object
          nullable: true
          additionalProperties: true
          description: Event-specific payload, or `null`.
        fee:
          type: number
          description: USD amount billed for this event.
    EmailMatchItem:
      type: object
      description: >-
        Another session of your application that used the same email address
        with a different `vendor_data`.
      properties:
        session_id:
          type: string
          format: uuid
          description: Session id of the other verification that used this email address.
        session_number:
          type: integer
          description: Human-friendly sequential number of that session.
        vendor_data:
          type: string
          nullable: true
          description: '`vendor_data` of that session.'
        verification_date:
          type: string
          description: When that session was created (`YYYY-MM-DDTHH:MM:SSZ`).
        email:
          type: string
          description: The matched email address.
        status:
          type: string
          description: >-
            Status of that session (e.g., `Approved`, `Declined`, `In
            Progress`).
        is_blocklisted:
          type: boolean
          description: Whether the email address is on your application's blocklist.
        api_service:
          type: string
          nullable: true
          description: >-
            For API-type sessions, the standalone API that created it; `null`
            for regular verification sessions.
        source:
          type: string
          description: >-
            Where the match was found. Usually `session`; a blocklist hit via an
            organization list entry uses `list_entry`.
    EmailIntelligence:
      type: object
      description: >-
        Normalized email-intelligence block. Present only when the intelligence
        add-on ran for this email; when present it is also exposed as the
        `enrichment` alias with identical values.
      properties:
        score:
          type: number
          nullable: true
          description: Normalized 0-100 risk score. Higher is riskier.
        deliverable:
          type: string
          nullable: true
          description: Deliverability band (e.g., `high`).
        breach_risk_level:
          type: string
          nullable: true
          description: '`Low`, `Medium` or `High`.'
        breach_risk_index:
          type: number
          nullable: true
          description: Numeric breach-risk index.
        is_recent_breach:
          type: boolean
          nullable: true
          description: '`true` when the address appears in a recent breach.'
        is_frequent_breached:
          type: boolean
          nullable: true
          description: '`true` when the address appears in many breaches.'
        is_disposable:
          type: boolean
          nullable: true
          description: '`true` when the domain is a throwaway provider.'
        is_free_domain:
          type: boolean
          nullable: true
          description: '`true` when the domain is a free mail provider.'
        is_breached:
          type: boolean
          nullable: true
          description: '`true` when the address appears in known breaches.'
        no_of_breaches:
          type: number
          nullable: true
          description: Number of known breaches containing the address.
        reason_codes:
          type: array
          items:
            type: string
          description: >-
            Machine-readable codes explaining the score. Values can grow over
            time, so do not reject unknown codes.
    EmailSocialFootprint:
      type: object
      nullable: true
      description: >-
        Social footprint of the email address: the online platforms it is
        registered on. Present only when `enable_social` was set and the check
        completed. Every count may be null when no data was returned for it.
        `profiles_registered: 0` means the platforms were checked and the email
        address was found on none of them - a valid, billable answer and a
        common synthetic-identity signal.
      properties:
        profiles_registered:
          type: integer
          nullable: true
          description: Platforms where the email address is confirmed registered.
          example: 5
        profiles_checked:
          type: integer
          nullable: true
          description: Platforms evaluated for registration.
          example: 14
        names_found:
          type: integer
          nullable: true
          description: Platforms that returned an associated name.
          example: 0
        photos_found:
          type: integer
          nullable: true
          description: Platforms that returned a profile photo.
          example: 0
        communication_breadth:
          type: integer
          nullable: true
          description: Communication platforms with detected presence.
          example: 2
        digital_footprint_diversity:
          type: integer
          nullable: true
          description: Distinct platform categories with detected presence.
          example: 5
        digital_sophistication_index:
          type: integer
          nullable: true
          description: Composite digital-maturity indicator, 0-10.
          example: 5
        engagement_depth_index:
          type: integer
          nullable: true
          description: Profile-richness indicator, 0-10.
          example: 3
        subscription_affordability_index:
          type: integer
          nullable: true
          description: Free vs paid platform mix, 0-10.
          example: 2
        free_platforms:
          type: integer
          nullable: true
          description: Registrations on free platforms.
          example: 4
        full_paid_platforms:
          type: integer
          nullable: true
          description: Registrations on fully paid platforms.
          example: 0
        partial_paid_platforms:
          type: integer
          nullable: true
          description: Registrations on freemium platforms.
          example: 1
        whatsapp_profile_completeness:
          type: string
          nullable: true
          enum:
            - Basic
            - Partial
            - Complete
            - Not Present
            - null
          description: Completeness of the WhatsApp profile. Phone only; null for email.
          example: Partial
        registered_platforms:
          type: array
          description: Platforms where registration is confirmed.
          items:
            $ref: '#/components/schemas/SocialFootprintPlatform'
        not_registered_platforms:
          type: array
          description: Platforms checked with a negative result.
          items:
            $ref: '#/components/schemas/SocialFootprintPlatform'
        categories:
          type: object
          description: Registered count and ratio per platform category.
          additionalProperties:
            $ref: '#/components/schemas/SocialFootprintCategorySummary'
        profiles:
          type: object
          description: >-
            Per-platform profile details, keyed by platform, when the platform
            exposes them.
          additionalProperties:
            $ref: '#/components/schemas/SocialFootprintProfile'
    SocialFootprintPlatform:
      type: object
      properties:
        platform:
          type: string
          description: Platform identifier.
          example: whatsapp
        category:
          type: string
          description: >-
            Platform category, e.g. MESSAGING, SOCIAL_MEDIA, ECOMMERCE,
            PROFESSIONAL, EMAIL_PROVIDER.
          example: MESSAGING
        scope:
          type: string
          enum:
            - global
            - local
          description: '`global` for worldwide platforms, `local` for region-specific ones.'
          example: global
    SocialFootprintCategorySummary:
      type: object
      properties:
        registered:
          type: integer
          nullable: true
          description: Platforms in this category where registration is confirmed.
          example: 2
        ratio:
          type: number
          format: float
          nullable: true
          description: >-
            Share of the category's checked platforms with a registration,
            0.0-1.0.
          example: 0.6667
    SocialFootprintProfile:
      type: object
      properties:
        name:
          type: string
          nullable: true
          description: Profile name, when the platform exposes one.
        photo:
          type: string
          nullable: true
          description: Profile photo URL, when the platform exposes one.
        about:
          type: string
          nullable: true
          description: Profile about/bio text, when the platform exposes one.
        privacy_status:
          type: string
          nullable: true
          enum:
            - PUBLIC
            - PRIVATE
            - null
          description: Profile visibility, when the platform exposes it.
        business_account:
          type: boolean
          nullable: true
          description: >-
            Whether the profile is a business account, when the platform exposes
            it.
  responses:
    EmailRiskValidationError:
      description: Request validation failed.
      content:
        application/json:
          examples:
            Missing email:
              summary: Missing email
              value:
                email:
                  - This field is required.
            Invalid email:
              summary: Invalid email
              value:
                email:
                  - Enter a valid email address.
            Invalid country hint:
              summary: Invalid country hint
              value:
                country_code:
                  - Ensure this field has no more than 3 characters.
    RiskPermissionDenied:
      description: >-
        The API key is missing or invalid, or the organization cannot cover the
        live lookup. This API never returns `401`.
      content:
        application/json:
          examples:
            Missing or invalid API key:
              summary: No `x-api-key` header, or the key is invalid or revoked
              value:
                detail: You do not have permission to perform this action.
            Not enough credits:
              summary: Organization balance cannot cover the lookup price
              value:
                error: You don't have enough credits to perform this request.
    RateLimitedWrite:
      description: >-
        The shared write limit of 300 requests per minute per API key was
        exceeded. Honor `Retry-After` before retrying.
      content:
        application/json:
          schema:
            type: object
            required:
              - detail
            properties:
              detail:
                type: string
          example:
            detail: >-
              Write request rate limit exceeded. You can make up to 300 requests
              per minute.
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        Your application's API key, from Developers -> API keys in the Business
        Console. The primary key has full access. A named key can be scoped:
        none, read or write per resource, limited to some workflows or to
        approved sessions, to a list of IP addresses, and to an expiry date. 401
        means the key is missing, wrong, revoked or expired; 403 means the key
        has no access to this resource or action, or the request came from an
        address outside its IP list; 404 on a session route means the session is
        outside the key's workflows or statuses. A key without media access
        receives image, video and PDF URLs as null, and a key without sessions
        write receives session links and tokens as null. See
        https://docs.didit.me/console/api-keys.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.