IsEmailSpam REST API

Current access

API key

Available from your profile after you create an account or log in.

Limits

Requests are limited by account role across per-minute, hourly, daily, and monthly windows.

Checks

Each request checks the exact email address and sender domain against the IsEmailSpam blacklist.

Invalid keys

Unknown API keys return a 401 response.

What the API checks

Send an email address and the API checks the exact address and its sender domain against the IsEmailSpam blacklist.

Who it is useful for

Use it in signup flows, contact forms, moderation tools, and internal review workflows where you need a programmatic spam signal.

Get an API key

Create an account, log in, and generate an API key from your profile. Create an account or log in.

Use an API client collection

Download and import a collection for Postman or HTTPie, then set its base_url, api_key, email, and domain variables once to try every API request.

Example check request

curl "https://isemailspam.com/api/check?api_key=your_key&email=email_to_check@example.com" \
  -H "Accept: application/json"

Example response

{
  "data": {
    "spam_email": {
      "checked_email": "email_to_check@example.com",
      "is_spam": false
    },
    "spam_domain": {
      "checked_domain": "example.com",
      "is_spam": false
    }
  }
}

Example report requests

Report a spam email address or sender domain with your API key. Send the key as an api_key field, not an Authorization header. Send one value per request: either email or domain.

curl -X POST https://isemailspam.com/api/report \
  -H "Accept: application/json" \
  -d "api_key=your_key" \
  -d "email=spammer@example.com"

curl -X POST https://isemailspam.com/api/report \
  -H "Accept: application/json" \
  -d "api_key=your_key" \
  -d "domain=spam-domain.example"

Example report response

{
  "data": {
    "status": "ok",
    "type": "email",
    "data": {
      "email": "spammer@example.com",
      "is_active": true
    }
  }
}

Rate limits and access

API usage is limited by account role across rolling windows: the last 60 seconds, the last 60 minutes, the last 24 hours, and the last 30 days. These limits do not reset at a fixed clock time such as the top of the minute, hour, or midnight; requests automatically leave the count when they are older than the window.

Each account can also be restricted to specific source IP addresses. If your API key is valid but the request comes from an IP address that is not allowed for the account, the API returns a 403 response. Commercial or higher-volume access can be managed by assigning the appropriate account limits.

Error responses

The API uses standard HTTP status codes so integrations can handle errors predictably. Successful check and report requests return 200 responses with a data object.

HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 3600
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0

{
  "message": "Too Many Attempts."
}

HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "message": "Source IP is not allowed for this API key."
}

HTTP/1.1 422 Unprocessable Content
Content-Type: application/json

{
  "message": "The email field is required.",
  "errors": {
    "email": [
      "The email field is required."
    ]
  }
}