API Reference

API v1 - current

Getting started with the API

Every step on verifiedinbox.ai is backed by our REST API. Free checks and anonymous drafts work without an account; signed-in accounts and API keys unlock paid verification, DNS checks, and certificate management.

Base URL & conventions

All version 1 REST endpoints are served over HTTPS from a single base URL:

https://api.verifiedinbox.ai/v1

JSON everywhere: Send request bodies with Content-Type: application/json (UTF-8).
Timestamps & money: All dates and timestamps use RFC 3339 in UTC (for example 2026-10-31T12:00:00Z). Monetary amounts are integer USD cents (for example 149900 is $1,499.00).
Backward compatibility: Within v1, changes are strictly additive. Your client should ignore unfamiliar fields and tolerate new enum values.
Idempotency: Checkout and certificate mutations require an Idempotency-Key header (up to 255 characters) so network retries never charge or submit an order twice.
Machine-readable OpenAPI 3.1 contract: https://verifiedinbox.ai/openapi.json

Security & authentication

Each endpoint declares its required access level. Inaccessible resources always return 404 Not Found (never 403) so private domain applications cannot be enumerated.

Credential	Header	Used for
Public	None	Public domain & email security checks, starting a new application, glossary, and metadata.
Guest token	VI-Guest-Token: vi_guest_…	Continuing an anonymous verification through the 5 free check steps (valid 30 days, sliding).
API key	Authorization: Bearer vi_live_…	Server and agent integrations bound to one organization and environment (`vi_live_…` or `vi_test_…`).
OAuth token	Authorization: Bearer <JWT>	MCP clients signed in as a user via WorkOS AuthKit.

Top 3 most important sections

Most integrations only need these three groups of endpoints to take a domain from initial check to an active certificate:

1. Domain & Email Checks

Run free, repeatable domain and SPF/DKIM/DMARC/BIMI checks for any domain without an account.

2. Applications & Wizard Steps

Start a verification, inspect the 11 wizard steps and separate outcomes, and advance steps as requirements are met.

3. Certificates & Renewals

Check order prerequisites, run the comprehensive pre-order re-check, and order, renew, reissue, or revoke certificates.

Browse all API sections

Free, repeatable public checks of any domain.

Open Check Domain

Applications11 ops

The server-side state of one domain's journey.

Open Create Application

Email security5 ops

SPF, DKIM, DMARC and BIMI for an application.

Open Get Email Security

Logo intake, SVG Tiny P/S conversion and approval.

Open Submit Logo

USPTO trademark search and verification.

Open Get Trademark

Eligibility3 ops

VMC / CMC / not-yet-eligible outcome and price estimate.

Open Get Eligibility

Guest sessions3 ops

Anonymous credentials and resume links.

Open Create Guest Session

Contact a human, feedback and feature requests.

Open Create Support Request

Plain-English definitions of every term we use.

Open List Glossary

Public logo and certificate files referenced by BIMI records.

Open Get Hosted Asset

Stripe hosted checkout (agents create links; people pay).

Open Create Checkout

Legal company verification.

Open Get Business

The DNS records to add, with live status.

Open Verify DNS

Certificate6 ops

Certificate order, status, reissue, renewal and revocation.

Open Get Certificate

Test messages2 ops

Authentication results on a real email.

Open Create Test Message

BIMI publication and display confirmation.

Open Get Go Live

Profile, organizations, environment, API keys, orders.

Sandbox helpers (no real payments).

Open Complete Mock Checkout

Service metadata, health and this contract.

Open Get Open API

Model Context Protocol endpoint and OAuth discovery.

Was it helpful?