Create an API key
Sign up, open API Access, and create a key with the scopes you need. Store it in a server-side environment variable and revoke it if it is exposed.
DMPHub REST API
Bearer API keys. JSON in, JSON out. Base URL https://app.dmphub.com/api/v1
Authentication
Send Authorization: Bearer dmph_live_…. Create keys in the dashboard under API Access, up to 10 per account, and revoke any of them at any time.
Scoped keys
Give each key only what it needs: verify:write, phone-verify:write, domain-verify:write, jobs:read, results:read, suppression-lists:write, webhooks:write and more. A missing scope returns 403.
Rate limits
60 requests per minute per key. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. On 429, wait for Retry-After.
Webhooks
Events email_verified, list_completed, list_failed. Each delivery is signed in X-DmpHub-Signature: sha256=… (HMAC of the raw body) and retried up to 3 times.
Credits
One credit per check from the same wallet as the dashboard. A cached email result costs nothing. With no credits left the API returns 402 INSUFFICIENT_CREDITS.
Email result
status is valid, invalid, risky or unknown. Risky results list why in riskReasons, with a riskScore and a plain-language recommendation.
Error handling
Errors return { error, code }: 400 VALIDATION_ERROR, 401 UNAUTHORIZED, 402 INSUFFICIENT_CREDITS, 403 FORBIDDEN, 429, and 500 VERIFICATION_FAILED (no credit is charged).
OpenAPI spec
The live spec is at /api/v1/openapi.json with an interactive reference at /api/v1/docs. Both need your API key.
Get started in three steps
Call the API from your server, read the status and reasons, then route each record to the right workflow.
Send a JSON request
Pick the endpoint for the record type. Send the bearer key and a JSON body over HTTPS.
Use the result
Act on status. Treat unknown (no mailbox answer) and risky records as review items, not as confirmed valid.
Example request
DMPHUB_API_BASE is https://app.dmphub.com/api/v1. The key stays out of browser code.
curl --request POST "$DMPHUB_API_BASE/verify/email" \
--header "Authorization: Bearer $DMPHUB_API_KEY" \
--header "Content-Type: application/json" \
--data '{"email":"jane@company.com"}'Example response
Real fields of POST /api/v1/verify/email, shortened. Values depend on the address.
{
"email": "jane@company.com",
"status": "valid",
"riskReasons": [],
"domainStatus": "valid",
"riskScore": 4,
"catchAll": false,
"domainHealth": { "grade": "A", "score": 92, "spf": true, "dkim": true, "dmarc": true },
"recommendation": "Safe to send",
"creditsUsed": 1,
"verifiedAt": "2026-10-17T09:12:44.512Z"
}Production checklist
- Keep API keys on your server, never in public frontend JavaScript.
- Handle 401, 402 and 403 explicitly, and retry a 429 only after Retry-After.
- Verify the X-DmpHub-Signature header before you process a webhook.
- Deduplicate lists before you start a job, and decide which statuses need human review.
See every endpoint in the API reference
The full reference — every endpoint, request body, and response — is part of your account. Create a free account to open it, get your first API key, and start with 100 free credits.
