Signals API documentation

Check an email address and/or IP against the network in a single request. Start free to get a key.

Base URL & authentication

All requests go to https://www.senderregistry.com/api/v1 over HTTPS. Authenticate with your secret key as a Bearer token. Keep keys server-side; never expose them in client code.

curl "https://www.senderregistry.com/api/v1/check?email=foo@mailinator.com&ip=185.220.101.1" \
  -H "Authorization: Bearer sr_live_your_key_here"

Endpoints

All three are GET requests and take query parameters.

/v1/checkPass email and/or ip. Returns every signal your plan includes.
/v1/check/emailPass email. Email-based signals only.
/v1/check/ipPass ip. The Tor exit signal only.

Response

One key per signal. Commodity signals are a boolean; reputation signals are an object. A signal your plan does not include is replaced by { "upgrade_required": true }.

{
  "disposable": true,
  "tor_exit": true,
  "risky_tld": false,
  "bulk_sender":     { "flagged": false },
  "known_malicious": { "flagged": true, "first_seen": "2026-07-14", "network_confirmation": "CORROBORATED" }
}
  • disposable - the email is on a throwaway/temporary domain.
  • tor_exit - the IP is a Tor exit node.
  • risky_tld - the email is on an abused top-level domain.
  • bulk_sender - flagged, plus confirmations (independent organisations) and unwanted_pct when flagged.
  • known_malicious - flagged, plus first_seen and, for a domain, network_confirmation when flagged.

Rate limits & quota

Each key has an optional per-hour rate limit. Your plan has a monthly check allowance shared across all your keys. When you reach the monthly allowance, requests return 429 until it resets on the 1st. Track usage in your console.

Errors

  • 401 - missing, invalid, expired or disabled key.
  • 400 - no valid email or ip supplied.
  • 429 - hourly rate limit or monthly quota reached.

Code examples

Python

import requests
r = requests.get(
    "https://www.senderregistry.com/api/v1/check",
    params={"email": email, "ip": ip},
    headers={"Authorization": "Bearer " + KEY},
)
data = r.json()
if data.get("disposable") or data.get("known_malicious", {}).get("flagged"):
    reject_signup()

Node

const res = await fetch(
  `https://www.senderregistry.com/api/v1/check?email=${encodeURIComponent(email)}&ip=${ip}`,
  { headers: { Authorization: `Bearer ${KEY}` } }
);
const data = await res.json();

PHP

$ch = curl_init("https://www.senderregistry.com/api/v1/check?email=" . urlencode($email) . "&ip=" . $ip);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer " . $KEY]);
$data = json_decode(curl_exec($ch), true);

Start free