- Check an email address POST
- Check an IP address POST
- Check a rate limit POST
- Classify content POST
- Assess an event POST
- Report an assessment's outcome POST
- Create a rate limit bucket POST
- Add an allow or block list entry POST
- Create a rule POST
- Delete a rate limit bucket DELETE
- Remove a list entry DELETE
- Delete a rule DELETE
- Forget a user DELETE
- Retrieve an assessment GET
- Retrieve the calibration GET
- Retrieve a rate limit bucket GET
- Retrieve a list entry GET
- Retrieve a rule GET
- Retrieve the risk settings GET
- List assessments GET
- List rate limit buckets GET
- List allow and block list entries GET
- List rules GET
- Update a rate limit bucket PATCH
- Update a rule PATCH
- Update the risk settings PATCH
Check an email address
Email intelligence on its own: syntax, disposable domains, whether the domain can receive mail (DNS), role accounts, free providers, the canonical mailbox, typo suggestions and the domain's age (RDAP). Stateless: nothing is stored or counted, so it never flags an address for having been seen before (assessments do). Failed lookups are listed in degraded. Sandbox keys see the documented test domains (@disposable.test, @undeliverable.test, @new.test).
bearerAuthAuthorizationBearer <token>A secret API key from the dashboard: coss_live_… for production environments, coss_test_… for sandbox environments.
Coss-Version?"2026-10-10"The API version (a date) to use for this request. Defaults to your organization's version, pinned to the latest one when it first used the API and upgraded from the dashboard. The SDK always sends the version it was built for.
"2026-10-10"application/json- body
- body
- …
email*stringThe address to check, as given.
1 <= length <= 320What COSS knows about the address.
application/json- response
- response
- …
object*"risk_email_check""risk_email_check"email*stringvalid*booleanSyntactically valid (the rest assumes it is).
domain*string|nullcanonical*|The mailbox with the provider's aliasing folded (dots and +tags at Gmail…): two addresses with the same canonical form reach one inbox.
disposable*booleandeliverability*stringFrom DNS (MX, A, AAAA). unknown when the lookup failed or timed out.
"deliverable""undeliverable""unknown"role_account*booleanfree_provider*booleansuggestion*|The likely intended domain when this one looks like a typo of a popular one.
domain_age_days*|Days since the domain was registered (RDAP); null when unknown or not looked up (free providers, disposable domains).
degraded*array<>Lookups that failed or timed out (their fields are unknown/null).
import { Coss } from "coss";const coss = new Coss({ apiKey: process.env.COSS_API_KEY, baseUrl: "https://api.coss.com",});const { data, error } = await coss.risk.checkEmail("ada@gnail.com");{ "object": "risk_email_check", "email": "ada@gnail.com", "valid": true, "domain": "gnail.com", "canonical": "ada@gnail.com", "disposable": false, "deliverability": "deliverable", "role_account": false, "free_provider": false, "suggestion": "gmail.com", "domain_age_days": 7300, "degraded": []}