Skip to content
Mailcleaner · API reference

Email validation API docs.

Drive Flaxxa Mailcleaner from your own software: a REST API with workspace keys, signed webhooks and idempotency keys.

No credit card
Free plan
Cancel anytime
flaxxa.com / product / mailcleaner / docs
cURLREST · JSON
# Flaxxa Mailcleaner · first request
curl https://flaxxa.com/api/v1/mailcleaner \
  -H "Authorization: Bearer $FLAXXA_KEY" \
  -H "Accept: application/json"

# webhooks: X-Flaxxa-Signature (HMAC-SHA256)
# retries: Idempotency-Key, 24 h
200 OKapplication/json
+ webhooks · HMAC-signed
REST
Requests per key by default
120/min
Idempotency window
24h
Quick start

How do I make my first API call?

Replace $FLAXXA_KEY with a key from your workspace. The first call returns a real id you can use for the next ones.

cURL
# Verify one address
curl -X POST https://flaxxa.com/api/v1/mailcleaner/verify \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]", "depth": "standard" }'
Node
const res = await fetch("https://flaxxa.com/api/v1/mailcleaner/verify", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.FLAXXA_MAILCLEANER_KEY}`,
    Accept: "application/json",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ email: "[email protected]", depth: "standard" }),
});
const { data, meta } = await res.json();
// data.verdict, data.risk_score; meta.pending = still being confirmed
PHP
$res = Http::withToken(env('FLAXXA_MAILCLEANER_KEY'))->acceptJson()
    ->post('https://flaxxa.com/api/v1/mailcleaner/verify/batch', [
        'emails'    => ['[email protected]', '[email protected]'],
        'depth'     => 'standard',
        'typo_mode' => 'fix',
    ])->throw()->json();

$jobId = $res['data']['id']; // poll GET /jobs/{id}/status until fully_done
Python
import requests
r = requests.post("https://flaxxa.com/api/v1/mailcleaner/jobs/upload",
    headers={"Authorization": f"Bearer {KEY}", "Accept": "application/json"},
    files={"file": open("emails.csv", "rb")})
r.raise_for_status()
print(r.json()["data"]["id"])  # the job id
Request
POST /api/v1/mailcleaner/verify HTTP/1.1
Host: flaxxa.com
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "email": "[email protected]",
  "depth": "standard"
}
Response · 201
HTTP/1.1 200 OK
Content-Type: application/json

{
  "data": {
    "email":                "[email protected]",
    "verdict":              "valid",
    "sub_verdict":          "smtp_accepted",
    "risk_score":           15,
    "confidence_score":     92,
    "mx_found":             true,
    "smtp_connectable":     true,
    "is_disposable":        false,
    "is_role_based":        false,
    "is_free_provider":     false,
    "catch_all_score":      0,
    "suggested_correction": null,
    "domain":               "example.com"
  },
  "meta": { "pending": false, "fully_done": true, "recheck_after": null }
}
Authentication

How do I authenticate?

Every call requires Authorization: Bearer <key>. Rotate from workspace settings — old keys are revoked instantly. Server-side only; never ship a live key to the browser.

Base URLhttps://flaxxa.com/api/v1/mailcleaner
Verify

Verify API

Check one address, or a batch of up to 1,000. Optional depth: quick, standard (default), deep or premium.

POST/verify

Verify one email

Returns the verdict, reason, risk and confidence scores. meta.pending is true while an accept-all or greylisted address is still being confirmed; re-check after recheck_after.

POST/verify/batch

Verify a batch

Up to 1,000 addresses in the background. Optional typo_mode (fix or reject). Malformed addresses come back as invalid rather than failing the batch. Returns a job to poll.

Jobs

Jobs API

Bulk verification jobs from a pasted list or an uploaded file.

POST/jobs

Create a job

Starts a job from a list of addresses.

POST/jobs/upload

Upload a file

Multipart field file: CSV, TSV, TXT or XLSX, up to 25 MB.

POST/jobs/scan

Typo scan

Finds likely typos in a list before you run it. No job, no credits.

GET/jobs

List jobs

Your workspace's jobs, newest first.

GET/jobs/{id}/status

Job status

Progress and per-verdict counts. Poll until fully_done is true; respect poll_interval_ms.

GET/jobs/{id}/results

Job results

Paginated results, 100 rows per page.

GET/jobs/{id}/export

Export results

Download as CSV or XLSX, optionally filtered by verdict and narrowed to chosen columns.

POST/jobs/{id}/cancel

Cancel a job

Stops a job that is still running.

Suppressions

Suppressions API

The do-not-mail list. Suppressed addresses come back as invalid without being checked.

GET/suppressions

List suppressions

Suppressed addresses with their reason.

POST/suppressions

Add a suppression

Adds an address with a reason.

POST/suppressions/import

Import

Adds many addresses at once.

DELETE/suppressions/{id}

Remove

Removes one suppression.

POST/suppressions/bulk-delete

Remove many

Removes several suppressions in one call.

Account and usage

Account and usage API

Check a key and what's left before a big run.

GET/account

Account

A free key check: workspace, credits left, monthly allowance and rate limit.

GET/usage

Usage

The last 30 days of checks by verdict and depth, plus credits and allowance remaining.

GET/results

All results

Results across every job.

GET/domains

Domains

What has been learnt about the domains you have checked.

Domain checks

Domain checks API

Audit the domain you send from.

POST/auth-audits

Run an audit

Checks SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT and returns suggested DNS records.

GET/auth-audits/{id}

Get an audit

One audit's results.

POST/server-test

Mail server test

Tests MX, SMTP, STARTTLS and authentication for a domain and grades it A to F.

Monitors

Monitors API

Scheduled re-checks of a connected email tool or CRM.

GET/monitors

List monitors

Your scheduled re-checks.

POST/monitors

Create

Source, cadence and optional write-back.

PUT/monitors/{id}

Update

Change the cadence or settings.

POST/monitors/{id}/run-now

Run now

Runs a monitor straight away.

Webhooks

Webhooks API

Get told when a job finishes instead of polling.

POST/webhooks

Register

An HTTPS URL and events (default app.mailcleaner.job.completed). The signing secret is shown once.

GET/webhooks

List

Your Mailcleaner webhook endpoints.

GET/webhooks/event-catalog

Events

The event names you can subscribe to.

POST/webhooks/{id}/test

Send a test

Sends a signed sample delivery.

DELETE/webhooks/{id}

Remove

Deletes an endpoint.

Webhook events

Which webhook events can I subscribe to?

Subscribe via POST /webhooks. Verify X-Flaxxa-Signature on every payload.

  • app.mailcleaner.job.completed

    A bulk job finished, with its per-verdict counts. The signal to pull results.

  • app.mailcleaner.job.created

    A bulk job was created.

  • app.mailcleaner.job.cancelled

    A job was cancelled.

  • app.mailcleaner.email.verified

    One address finished verification (one event per address).

  • app.mailcleaner.suppression.added

    An address was added to the suppression list.

  • app.mailcleaner.suppression.removed

    An address was removed from the suppression list.

  • app.mailcleaner.auth.noncompliant

    A domain audit found SPF, DKIM or DMARC problems.

Errors

What errors can the API return?

All errors return a JSON envelope: { error: { code, message, details } }. Retry idempotent calls on 5xx with exponential backoff.

CodeNameWhen it fires
401unauthorizedAPI key missing, invalid or revoked.
402insufficient_creditsNot enough credits for the check. The body gives required and balance.
402plan limitThe monthly verification or bulk job allowance is used up. The body names the feature_key, limit and used.
402feature_disabledThe plan doesn't include this feature, such as Deep checks, the widget or the result explainer.
403forbiddenThe key lacks the scope for this endpoint, such as a read-only key verifying.
409conflictA request with the same Idempotency-Key is still running. Retry after Retry-After.
422unprocessableValidation failed: a bad depth, more than 1,000 addresses in a batch, or a missing or oversized file.
429rate_limitedOver the per-key or per-workspace rate limit. Retry-After is included.
Conventions

Which rules apply to every request?

Every Flaxxa app's API follows the same authentication, rate limits, idempotency and webhook signing.

Bearer auth

Every API call uses a Bearer token. Keys belong to a workspace and are scoped per app. Create and revoke them from workspace API settings.

Rate limits

Each key can make 120 requests a minute unless the app sets its own limit. Going over returns 429 with a Retry-After header.

Idempotency

Send an Idempotency-Key header on a POST and a retry with the same key within 24 hours returns the first response instead of running again.

Signed webhooks

Every webhook payload carries an X-Flaxxa-Signature HMAC-SHA256 header made with the secret you get when you subscribe. Verify it before processing.

API FAQ

Flaxxa Mailcleaner API: common questions

Frequently asked questions

Yes. A REST API at https://flaxxa.com/api/v1/mailcleaner, called with a workspace API key scoped to Flaxxa Mailcleaner.

Get started in minutes

Ship faster with Flaxxa Mailcleaner.

Create a workspace, make an API key in its settings, and send your first request.

Free plan · No credit card · Cancel anytime