Works out a person's work address from their name and their company's mail domain, and checks the candidates with the domain's mail server. Charges 5 credits.

Only verified: true is a confirmed address. It is set on a valid verdict alone: the mail server accepted the mailbox, and the domain does not accept mail for every address. A result with verified: false can still carry an email (catch_all, risky, role): that is the best guess for this person, the candidate the finder ranked highest. On catch_all the domain accepts every address, so nothing was confirmed, and the message says whether the guess follows a pattern an address at this domain was confirmed with before or is only the most common pattern; on risky the server showed the mailbox exists (it accepted it, or reported it full), but risk signals remain. A role address (such as info@) can be a mailbox the server accepted, but it reaches a shared inbox, so it is not confirmed as this person's. Do not count it as found.

Needs the Starter plan or higher. On the Free plan the request is refused with 403 PLAN_UPGRADE_REQUIRED before anything is charged.

status is the verdict on the address it settled on: valid, risky, role, catch_all or not_found. unknown is no longer returned (an inconclusive check is the 503 below), nor is invalid_name (an unusable name is a 400). A catch_all outcome still charges, and it is INCONCLUSIVE rather than negative: the domain accepts every recipient, so no address could be confirmed either way. It may come back with a best-guess email (unverified) or with email: null (both shapes occur), so branch on status, never on whether email is present.

A name over 64 characters is a 400 before the charge: RFC 5321 caps a local part at 64 octets, so no candidate could exist. So is a name that spells to more than 64 letters in a-z (ß is written ss).

Names are spelled in a-z before the candidates are built. Accents are dropped, and letters with no accent to drop are written the usual way: ø as o, æ as ae, ß as ss, ł as l, đ and ð as d, þ as th, ı as i, œ as oe, so Søren is searched as soren. A name that also contains a letter with no single a-z spelling (such as ə, ʒ or ʃ, or a letter from another script next to Latin ones) is a 400 with nothing charged, rather than a search for a misspelled name.

A catch_all status does not guarantee an address. When the domain accepts every recipient and no candidate clears the confidence threshold, the paid result comes back with email: null and confidence: 0: you have bought the search and learned that no address can be confirmed.

A special-use domain is a 400 before the charge. .example, .test, .invalid, .localhost, .local, .onion, .alt, .internal, .corp, .home, .mail, and home.arpa with the other special-use .arpa names are never answered for in the public DNS, so no address under them can exist and every candidate could only fail. So are RFC 2606's documentation domains example.com, example.net and example.org and any name under them: they resolve, but publish a null MX, and the worker refuses them before SMTP. They used to be searched and billed (5 credits) for a not_found that was certain before the search began.

A domain that cannot receive mail is a 400 before the charge. Its mail servers are read the way GET /v1/domain/{domain} reads them: a domain that does not exist, publishes a null MX (RFC 7505), or has neither an MX record nor an A or AAAA address is a 400 saying which, with nothing searched and nothing charged. A domain with only an address record receives mail there (RFC 5321's implicit MX) and is searched. A lookup that fails is a 503 with retry_after_seconds, also uncharged.

A public mailbox provider is a 400 before the charge. gmail.com, yahoo.com, outlook.com and the other domains POST /v1/verify reports free_provider: true for hold addresses their owners chose, not ones built from a name, so a person's address there cannot be found from their name: any address returned could belong to someone else.

Both refusals apply to new work only: a repeat under an Idempotency-Key whose earlier attempt was paid for is still answered from its receipt.

An incomplete negative search is a 503, not a not_found. When the search produces no usable candidate and some generated addresses remain unanswered (a probe timed out or the search budget ended), it cannot establish that the other addresses are absent. This includes searches where some candidates were rejected and others could not be checked, and probes that settled nothing about the mailbox: unknown, a policy block of the sending server, greylisting, a temporary or connection failure, or risky without evidence that the mailbox exists. Such a probe is never returned as the address. It answers a retryable 503 SERVICE_UNAVAILABLE and charges nothing; with an Idempotency-Key the charge is refunded, so a retry under the same key is a new paid search rather than a replay. A not_found is billed only when every generated candidate was answered.

{
  "data": {
    "status": "valid"
  }
}