---
title: "Risk"
method: POST
path: "/v1/email/risk"
tags: ["Fraud"]
---

# Risk

`POST /v1/email/risk`

## Request

- Base URL: `https://telemetry.stytch.com`
- URL: `https://telemetry.stytch.com/v1/email/risk`
- Auth: HTTP basic

Get risk information for a specific email address.
The response will contain a recommended action (`ALLOW`, `BLOCK`, or `CHALLENGE`) and a more granular `risk_score`.
You can also check the `address_information` and `domain_information` fields for more information about the email address and email domain.

This feature is in beta. Reach out to us [here](mailto:fraud-team@stytch.com?subject=Email_Intelligence_Early_Access) if you'd like to request early access.

## Request body

- ApiFraudV1FraudEmailRiskRequest: Request type
  - `email_address` string, required: The email address to check.

## Response `200`

Successful response

- ApiFraudV1FraudEmailRiskResponse
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `address_information` ApiFraudV1AddressInformation, required
    - `has_known_bounces` boolean, required: Whether email sent to this address is known to have bounced previously.
    - `has_valid_syntax` boolean, required: Whether this email address is valid.
    - `is_suspected_role_address` boolean, required: Whether the local part of the email appears to be a role or group, rather than an individual end user.
    - `normalized_email` string, required: The normalized email address after removing '.' characters and any characters after a '+'.
    - `tumbling_character_count` integer, required: The number of '.' and '+' characters in the email address. A higher tumbling count indicates a higher potential for fraud.
  - `domain_information` ApiFraudV1DomainInformation, required
    - `has_mx_or_a_record` boolean, required: Whether the email has appropriate DNS records to deliver a message.
    - `is_disposable_domain` boolean, required: Whether the email domain is known to be disposable.
  - `action` 'ALLOW' | 'CHALLENGE' | 'BLOCK', required
  - `risk_score` integer, required: A score from 0 to 100 indicating how risky the email is. 100 is the most risky.
  - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2026-01-21** `f54fc44a13ff`: 1 info
  - endpoint added
- **2026-01-21** `867ccef43360`: 1 breaking
  - api path removed without deprecation
- **2026-01-21** `3e4c16dac486`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/email/risk/post.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)