API reference

One endpoint does the work: POST /v1/lookup. Send an email address or a domain and get back its category, spam verdict, email signals and, for company domains, a company profile. Base URL https://pingutil.com. Everything is JSON.

Want to click instead of read? The interactive explorer runs requests from your browser, and the OpenAPI 3 spec works with any client generator. For copy-paste examples in several languages see the quickstart.

Authentication

Send your key as a bearer token: Authorization: Bearer pk_live_…. Create keys on the dashboard after signing in with your email (no password). The full key is shown once; we store only a SHA-256 hash. Keep it on your server. Never ship it in browser or mobile code.

POST /v1/lookup

curl -X POST https://pingutil.com/v1/lookup \
  -H "Authorization: Bearer $PINGUTIL_KEY" \
  -H "Content-Type: application/json" \
  -d '{"input": "jane@stripe.com"}'

GET /v1/lookup?input=jane@stripe.com&skip_enrichment=true works too, with the same fields as query parameters.

Request fields

Response

{
  "domain": "stripe.com",
  "domain_unicode": "stripe.com",
  "category": "company",
  "subcategory": null,
  "is_email": true,
  "input_normalized": "jane@stripe.com",
  "cached": true,
  "fetched_at": "2026-10-01T08:00:00.000Z",
  "last_refreshed_at": "2026-09-28T12:34:56.000Z",
  "company": {
    "name": "Stripe",
    "industry": "Financial Services",
    "founded_year": 2010,
    "headquarters": { "city": "South San Francisco", "region": "CA", "country": "US" },
    "employee_size_estimate": "5001-10000",
    "funding_stage": "series_d_plus",
    "linkedin_url": "https://www.linkedin.com/company/stripe",
    "confidence": 0.9
  },
  "email_signals": {
    "is_randomized": false,
    "randomness_score": 12,
    "is_role_based": false,
    "is_system_generated": false,
    "is_sales_outreach": false,
    "domain_looks_random": false
  },
  "domain_signals": null,
  "verdict": { "is_spam": false, "low_trust": false, "reason": null },
  "meta": {
    "source": "@cf/openai/gpt-oss-20b",
    "categorization_source": "fallthrough",
    "categorization_confidence": "medium",
    "request_id": "req_..."
  }
}

The company object is trimmed above. The full list of company fields is below.

Response fields

Profiles come from an AI model filling a fixed schema. By default the Worker fetches the company's homepage and gives it to gpt-oss-20b on Cloudflare Workers AI as evidence; meta.grounding_sources lists the page it used. The server can also run Gemini with Google Search grounding. Validated output is cached per domain, so the first lookup of a new company takes a few seconds and later ones are fast.

POST /v1/verify

Checks whether a single mailbox exists. It runs the syntax and disposable-domain checks, finds the domain's mail server, then opens an SMTP conversation and asks about the address with RCPT TO. It hangs up before sending anything. It also probes a random address on the same domain to spot catch-all servers. Results are cached for 30 days (one hour for unknown), and the cache stores a keyed SHA-256 hash (HMAC) of the address, not the address itself.

curl -X POST https://pingutil.com/v1/verify \
  -H "Authorization: Bearer $PINGUTIL_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "jane@stripe.com"}'

{
  "email": "jane@stripe.com",
  "input": "jane@stripe.com",
  "status": "valid",
  "reason": "mailbox_exists",
  "score": 95,
  "did_you_mean": null,
  "checks": {
    "syntax": true, "disposable": false, "free_provider": false,
    "role_based": false, "randomized": false,
    "domain_exists": true, "has_mx": true,
    "mailbox": "exists", "catch_all": false
  },
  "mx_host": "aspmx.l.google.com",
  "smtp": { "code": 250, "enhanced": "2.1.5", "message": "2.1.5 OK" },
  "cached": false,
  "checked_at": "2026-10-21T10:00:00.000Z"
}

GET /v1/verify?email=… works too. To check up to 50 addresses in one call, send {"emails": [...]} to POST /v1/verify/batch; you get {"results": [...]} back in the same order. Most checks take one to five seconds; a slow mail server can take up to 25.

Verification statuses

score (0–100) orders results within a status. did_you_mean is set when the domain looks like a typo of a big provider (gmial.com → gmail.com). Some providers, Yahoo among them, accept every address during the SMTP conversation and bounce later. Those come back as risky / accept_all rather than valid.

Errors and limits

Every error has the same shape:

{ "error": "rate_limited", "message": "retry after 60s", "retry_after_seconds": 60 }

In a signup flow, decide up front what happens when the API is unreachable or rate-limited. Failing open (let the signup through, check later) is the usual choice.

The demo also has daily budgets shared by all anonymous visitors: 50 new company profiles and 150 mailbox checks. Past those it still answers, from cache for lookups and DNS-only for verification. The demo is protected by Cloudflare Turnstile: the page solves a challenge, exchanges it at POST /v1/demo/session for a 30-minute session bound to the visitor's IP, and sends it as the x-demo-session header. Requests without a valid session get 401 turnstile_required, and browsers on other sites get a 403, so curl and server code should use /v1/lookup or /v1/verify with a key.

Other endpoints