The disposable lookup

curl -sS https://api.emvero.tech/v1/disposable \
  -H "Authorization: Bearer emv_your_credential" \
  -H "Content-Type: application/json" \
  -d '{"domain":"mailinator.com"}'

{
  "domain": "mailinator.com",
  "ascii_domain": "mailinator.com",
  "disposable": true,
  "dataset_version": "2026-08-18.1+ab12cd34ef56"
}

It costs nothing. No credits are spent, no X-Credits-Charged or X-Credits-Remaining is returned, and an empty balance does not refuse it. It can be free because it is free to answer: the lists are held in memory, so nothing here queries a resolver, opens an SMTP session, or spends any part of a destination’s patience.

It still needs a credential, like every other operation. What is free is the answer, not the access.

What it does not tell you

It answers exactly one question - is this domain on the throwaway-mail lists

• and it is the same signal a verification reports in checks.disposable, read from the same bundle, so the two cannot disagree.

Everything else a verification establishes is absent:

• It does not say the domain resolves, publishes mail routing, or accepts mail at all. mailinator.com and a domain registered ten minutes ago and pointed nowhere both come back "disposable": false or true on the strength of the list alone.
• It does not say a mailbox exists. Nothing is asked of any destination.
• It cannot produce a verdict. There is no status, no action and no reason_codes here, because none of them would be earned.

"disposable": false means nobody has listed the domain. That is not the same fact as “this is a genuine provider”, and it is the misreading worth guarding against: a throwaway service that launched this morning is unlisted everywhere, including here. Use it to reject, never to admit.

Where the answer comes from, and dataset_version

The list is assembled from four published feeds, merged by agreement - a domain enters on the strength of a curated source alone or of any two sources naming it - and filtered against a curated set of real providers, so a feed calling gmail.com throwaway does not reach you.

dataset_version identifies that bundle. It is a label plus a digest of the values, so re-indenting a source list does not mint a new version and a changed list cannot fail to. Two things it is for: pinning a support conversation about a domain to the exact list that answered, and knowing that a cached answer of yours was taken against a bundle that has since moved.

The lists are updated daily, without a release, and a domain can be added or removed on any of those days. Cache an answer for hours, not for weeks.

Sending an address instead of a domain

domain accepts a whole address, because the code asking this question usually has one:

{ "domain": "someone@mailinator.com" }

Only the domain is read. The local part is discarded before anything else happens - before the domain is even normalised - and appears in no response, no log and no error message. It is a convenience rather than a second field, and sending one has exactly the same effect as sending the domain by itself.

The domain is normalised the way every other lookup on this service normalises one, so an internationalised name is converted before it is compared and comes back in both forms.

When to use this, and when to buy a check

Use this to filter throwaway providers, and to do it on volumes where paying per domain would not be worth it - a list you already hold, a blocklist you refresh nightly, a form that greys out a submit button.

Buy a domain-depth check when the question is whether mail can reach the domain at all. It resolves the name, reads the mail routing, returns a real verdict, and reports every risk signal rather than this one - a role account, a public mailbox provider, a probable typo of a large provider, a domain that publishes MX 0 ".". It costs 2 credits and answers something this cannot.

Buy a full check on a signup form. Neither of the above asks the destination about the recipient.

There are two more free lookups beside this one, answering different questions about a domain for nothing: the catch-all lookup and the public-provider lookup.

Errors

Status	Meaning
400	missing_domain, or invalid_domain for something no lookup can be made for. Fix the request; it will not succeed on retry.
401	Missing or unrecognised credential.
413	The request body is larger than permitted.
429	Caller or source budget exceeded. Back off; honour Retry-After.
503	annotation_unavailable - the reference lists are not loaded, so no answer can be given.

The 503 is worth one sentence, because the alternative would have been cheaper and much worse. A service that had lost its lists could answer "disposable": false to everything, and from outside that reads exactly like a domain examined and found unremarkable. It refuses instead. Treat it as no answer, not as a negative one.