Didit Email Verification API

Didit Email Verification API

Overview

Three standalone endpoints:

1. Send a one-time code to an email address: POST /v3/email/send/
2. Check the code the user typed and get the email report: POST /v3/email/check/
3. Risk (no code sent): score an address in one call: POST /v3/email/risk/

Key constraints (send + check):

• The check finds the verification by your application + the email address. It does not take request_id.
• A pending verification lives 5 minutes from the first send. Retries do not extend it.
• 3 code attempts per verification. Wrong codes 1 and 2 return "Failed"; the 3rd wrong code finalizes it as "Declined" (EMAIL_CODE_ATTEMPTS_EXCEEDED).
• One resend per pending verification: a second send for the same address inside the window returns "Retry" with the same request_id and a fresh code (the previous code stops working). A further send starts a new verification with a new request_id.
• Codes are compared case-insensitively. Only the most recent code is valid.
• No pending verification (never sent, already finalized, undeliverable at send, or older than 5 minutes): the check returns HTTP 200 with status: "Expired or Not Found".
• Each new verification is stored as an API session: request_id works with GET /v3/session/{sessionId}/decision/, shows in the Business Console, and fires status.updated webhooks as it progresses. Each risk call also creates an API session.

Capabilities: known data breaches (breaches[]), disposable providers, deliverability (syntax and DNS/MX), duplicates across your sessions (matches[]), your email blocklist/allowlist, optional social footprint (enable_social), fraud signals.

Sandbox: sandbox API keys skip delivery, billing and persistence. Send returns a static "Success" with a random request_id; on check use code 123456 (any well-formed code returns a simplified "Approved" payload). Risk returns deterministic approved data. Malformed input still returns 400.

Pricing: Email Verification $0.03 per successful send ("Success"); "Retry" and "Undeliverable" sends and checks are free (apart from the optional social add-on); standalone calls have no free tier. No list price is published for POST /v3/email/risk/ (the docs say it is lower than Email Verification) or for the social footprint add-on (enable_social, billed per request on top of the endpoint price, not billed when the lookup could not complete). These are the list prices until 1 November 2026, when Didit pricing changes and the 500 free checks a month become $10 of free credit a month. Check didit.me/pricing for current prices.

API Reference: Send Code | Check Code | Email Risk Feature Guide: https://docs.didit.me/core-technology/email-verification/overview

Authentication

Every request needs the x-api-key header. Use your application's API key from the Didit Business Console under Developers > API keys, or create an account and key programmatically (see Getting Started). Named keys with custom access need Sessions write to run standalone checks; a key limited to some workflows or to approved sessions cannot run them.

Getting Started (No Account Yet?)

If you don't have a Didit API key, create one in 2 API calls:

1. Register: POST https://apx.didit.me/auth/v2/programmatic/register/ with {"email": "[email protected]", "password": "MyStr0ng!Pass"}
2. Check email for a 6-character verification code