Compliance & Business Tier 3 Ready POST /v1/signup-fraud

Disposable Email & Signup Fraud Detection API — Block Fake Accounts at Edge

Block disposable emails, alias abuse, and bot signups with a 0–100 fraud risk score. Score user signups in milliseconds: detect disposable email domains, subaddressing (+tag), Gmail dot-aliasing, gibberish local-parts, and datacenter IPs.

Try It Live in Your Browser · No API Key Required

1. Interactive Sandbox & Sample JSON Output

200 OK · Ready

Editable Request JSON (`POST /v1/signup-fraud`)

Live 200 OK Response Envelope

{
  "ok": true,
  "data": {
    "trust_score": 20,
    "risk_level": "high",
    "verdict": "block",
    "email_analysis": {
      "valid_syntax": true,
      "domain": "mailinator.com",
      "is_disposable": true,
      "is_free_provider": false,
      "is_role_address": false,
      "has_plus_alias": true,
      "has_mx": null
    },
    "ip_analysis": null,
    "ua_analysis": null,
    "signals": [
      {
        "id": "disposable_email",
        "severity": "high",
        "delta": -65,
        "detail": "Domain 'mailinator.com' is a known disposable email provider"
      },
      {
        "id": "plus_alias",
        "severity": "low",
        "delta": -10,
        "detail": "Email uses '+' subaddressing"
      }
    ]
  },
  "meta": {
    "request_id": "req_sf_01",
    "ms": 2
  }
}

Get API Key on RapidAPI Get API Key on Zyla Hub Download OpenAPI 3.0.3 Spec

2. Quickstart Code Examples

Full TypeScript & Python SDK →

curl -X POST "https://api.tinplate.dev/v1/signup-fraud" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY" \
  -d '{"email":"j.o.h.n.d.o.e+promo99@mailinator.com"}'

import { TinplateClient } from "@tinplate/sdk"; // npm install @tinplate/sdk

const tinplate = new TinplateClient({
  rapidApiKey: process.env.RAPIDAPI_KEY!,
});

const { data, meta } = await tinplate.call("/v1/signup-fraud", {
  "email": "j.o.h.n.d.o.e+promo99@mailinator.com"
});
console.log(`[${meta.ms} ms]`, data);

import requests

response = requests.post(
    "https://api.tinplate.dev/v1/signup-fraud",
    headers={
        "Content-Type": "application/json",
        "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
    },
    json={
  "email": "j.o.h.n.d.o.e+promo99@mailinator.com"
}
)
print(response.json())

const response = await fetch("https://api.tinplate.dev/v1/signup-fraud", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
  },
  body: JSON.stringify({
  "email": "j.o.h.n.d.o.e+promo99@mailinator.com"
}),
});
const result = await response.json();
console.log(result);

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "tinplate_signup_fraud",
    "arguments": {
      "email": "j.o.h.n.d.o.e+promo99@mailinator.com"
    }
  }
}

OpenAPI 3.0.3 Schema Contract

Request Parameters & Response Schema Reference

Request Body Parameters (`POST /v1/signup-fraud`)

Parameter	Type & Constraints	Description
`email`required	`string` minLen: 3, maxLen: 320	Signup email address to evaluate.
`ip`optional	`string` maxLen: 64	End-user IPv4/IPv6 address (explicit input; never inferred from request.cf).
`user_agent`optional	`string` maxLen: 2048	End-user HTTP User-Agent string.
`check_mx`optional	`boolean`	Verify domain MX records via DNS-over-HTTPS (default true).

Response `data` Object Fields (`200 OK`)

Field	Type	Description
`trust_score`	`integer`	Field 'trust_score'
`risk_level`	`"low" \| "medium" \| "high"`	Field 'risk_level'
`verdict`	`"allow" \| "challenge" \| "block"`	Field 'verdict'
`email_analysis`	`object`	Field 'email_analysis'
`ip_analysis`	`object \| null`	Field 'ip_analysis'
`ua_analysis`	`object \| null`	Field 'ua_analysis'
`signals`	`object[]`	Field 'signals'

3. What Signup Fraud & Disposable Email Scorer API Detects & Validates

Checks against curated disposable/throwaway email providers + live KV blocklist updates
Canonicalizes Gmail/Googlemail dot-aliasing, Outlook/Fastmail/Proton subaddressing (+tag), and Yahoo hyphens
Shannon entropy and consonant-cluster detection for automated gibberish local-parts (e.g. xk92jf81q@...)
Identifies role accounts (admin@, billing@, security@) and free webmail vs corporate domains

Honest Engineering Boundaries

4. Known Limitations & Test Verification

Release Version: v1.0.7 · Last Verified / Benchmarked: 14 November 2026 · Latency Note: Sub-millisecond figures measure in-Worker V8 compute time (typical client HTTPS network RTT to the nearest Cloudflare PoP is 15–65 ms) · See Full Portfolio Benchmarks & Corpora →

Brand-new custom domains registered minutes ago for a single campaign may pass disposable domain lists if they have valid MX records.
Tested v1.0.4 (14 November 2026).

5. Marketplace Plans & Payload Quotas

Plan	Monthly Price	Included Requests	Rate Limit	Max Request Payload	Best For
BASIC	$0.00 / month	500 / month (hard limit)	10 req / min	64 KB	Evaluation, local development & CI smoke tests
PRO	$9.99 / month	15,000 / month	60 req / min	128 KB	Solo developers & production apps
ULTRA	$29.99 / month	100,000 / month	300 req / min	256 KB	Growing SaaS & multi-agent pipelines
MEGA	$79.99 / month	500,000 / month	1,000 req / min	256 KB	High-volume enterprise workloads

Subscribe on RapidAPI Subscribe on Zyla Hub Full Pricing Details

6. Frequently Asked Questions

How does canonical email normalization prevent multi-accounting?

Users often register j.ohn+1@gmail.com and jo.hn+2@gmail.com to abuse free tiers. The API returns the canonical address (john@gmail.com) so you can enforce one trial per person.

How often is the disposable email domain list updated?

A scheduled Worker refreshes the disposable domain dataset from upstream sources into Cloudflare KV.

Does it store user emails?

Never. Evaluation is 100% stateless.

Zero Payload Logging

7. Data Handling, Privacy & Marketplace Proxy Disclosure

Email addresses are evaluated in memory and never stored, logged, or added to any marketing database.

Worker Zero-Logging Guarantee: Cloudflare Workers Observability and invocation logging are disabled in configuration (observability.enabled = false, head_sampling_rate = 0, invocation_logs = false). Payloads are processed strictly in volatile V8 memory and never logged or stored by Tinplate.

Marketplace Proxies vs. Direct Bearer Key: Requests sent via RapidAPI or Zyla API Hub pass through those marketplaces' proxy infrastructure (subject to their respective privacy policies). Security-sensitive workloads requiring end-to-end zero-intermediary processing can connect directly to https://api.tinplate.dev using a Direct Bearer Key (Authorization: Bearer <API_KEY>). Read our full Privacy Notice and OpenAPI 3.0.3 JSON Schema.