The email deliverability API.

Run the same spam tests, inbox placement, client previews, email verification, DMARC reports and automatic tests as the dashboard, from your own code.

One API for every test Unspam runs.

Pick a job to see the call. Each one starts the work, hands you an id, and returns the result as JSON.

Score an email before it ships

Start a test, send your real email to the address it returns, and read the score with every authentication and content check. The same id returns screenshots on desktop, tablet and mobile, plus attention and focus heatmaps.

Spam checker API
POST /spam-check
curl -X POST https://api.unspam.email/ext/v2/spam-check \
  -H "Authorization: Bearer $UNSPAM_TOKEN"
# returns the test id and the address to send to
{
  "id": "2Bl8rzTFN6VV",
  "inbox_address": "test-xyz@check.unspam.email"
}

# send your email to that address, then read the result
curl https://api.unspam.email/ext/v2/spam-check/2Bl8rzTFN6VV \
  -H "Authorization: Bearer $UNSPAM_TOKEN"

# response (200)
{
  "status": "completed",
  "score": 84,
  "results": [
    { "id": "spf", ... },
    { "id": "dkim", ... }
  ]
}
Endpoints
44
API areas
8
Authentication
Bearer token
Rate limit
100 a minute

What you can build with it.

CI and deploy pipelines

Run a spam check as a build step and fail the deploy when the score drops, so a template edit cannot quietly cost you the inbox.

Your sending stack

The test receives a real message from your real path: SES, Postmark, SendGrid, Mailgun or your own SMTP, whatever already sends your email.

Internal dashboards

Scores, placement and authentication results come back as JSON, so they land in the dashboard your team already watches.

Alerting and on-call

Poll scheduled test runs from a cron job and alert whoever is on call when placement drops, before the open rate does.

Products that send email

Build every test into your own product on the Custom plan: an email builder or an agency platform can resell spam tests, inbox placement and previews under its own brand.

AI assistants

Over MCP, the same jobs are tools an assistant can call, so a check can run in the middle of a conversation with no client code written.

Build Unspam into your own product.

The Custom plan lets you put every Unspam test inside your own software and resell it to your clients under your own brand. You buy it online, and the volume grows with you.

Build your plan
  • Your interface, your brand.

    Results arrive as JSON, so your clients see your product, your name and your design. Reselling is allowed on the Custom plan.

  • Every test, one integration.

    Spam tests, inbox placement, device previews, heatmaps, DMARC reports and email verification run through the same API and the same MCP server.

  • Bought online, sized by you.

    Pick your monthly volume on the pricing page from a $5 minimum. Rates drop as you grow, annual billing takes 15% off, and every paid plan has a 14-day refund.

  • Questions go to support.

    Higher rate limits, invoicing or an integration question: open a support ticket and we answer there.

How access works.

One token per integration, a small set of status codes, and the same jobs available to AI clients over MCP.

Tokens you can revoke one at a time

Every request carries a bearer token in the Authorization header. Tokens are created in your account, one per integration, and revoking one leaves the others working.

A missing, malformed or revoked token answers 401. A valid token on an account that may not make the call answers 403, and the body names the reason, so a billing problem is never mistaken for a broken integration.

Ids you poll, not webhooks you host

A call that starts work answers with an id. You poll that id until the result is ready, which keeps the integration to plain outbound HTTP with nothing of yours exposed publicly.

A 422 means the request parsed and the values were rejected, with the fields named, so a bad payload never looks like a rejected account. Past the rate limit the API answers 429.

The same jobs over MCP

AI clients reach the same work over the MCP server, as JSON-RPC 2.0 to a single endpoint, so an assistant can run a spam check and read the result without anyone writing a client for it.

MCP authenticates with OAuth 2.1 and there is no token to paste: the client runs the flow when you add the server. The bearer token above is for the REST API only.

From token to result in four steps.

The spam check is the shortest path through the API. Inbox placement and previews follow the same shape: start something, take the id, read the result.

  1. 01

    Create a token

    In your account, one token per integration, each revocable on its own.

  2. 02

    Start a test

    POST to the spam check endpoint. The response carries the test id and the address to send your email to.

  3. 03

    Send the email

    From the platform you really send with, to the address the API returned, so the test measures your actual sending setup rather than a copy of it.

  4. 04

    Read the result

    GET the test by its id for the score and the authentication results, then ask for its heatmap and screenshots on the same id, or create client previews from it.

Every endpoint, listed.

44 endpoints in 8 groups, the way the API groups them. The OpenAPI document has every parameter and response code.

OpenAPI document
Client Previews 4 calls
  • GET /client-preview-devices
  • GET /client-previews
  • POST /client-previews
  • GET /client-previews/{id}
DMARC Reports 10 calls
  • GET /dmarc/domains
  • POST /dmarc/domains
  • GET /dmarc/domains/{id}
  • GET /dmarc/domains/{id}/dns-instructions
  • GET /dmarc/domains/{id}/ips
  • GET /dmarc/domains/{id}/ips/{ip}
  • GET /dmarc/domains/{id}/reports
  • POST /dmarc/domains/{id}/verify
  • GET /dmarc/reports/{id}
  • GET /dmarc/reports/{id}/records
Email Verification 5 calls
  • POST /email-verification/instant-checks
  • GET /email-verification/instant-checks/{id}
  • POST /email-verification/list-checks
  • GET /email-verification/list-checks/{id}
  • GET /email-verification/list-checks/{id}/results
Inbox Placement 4 calls
  • GET /inbox-placement
  • POST /inbox-placement
  • GET /inbox-placement/mailboxes
  • GET /inbox-placement/{id}
Automatic Testing: Senders 6 calls
  • GET /scheduled-test-senders
  • POST /scheduled-test-senders
  • GET /scheduled-test-senders/{id}
  • PUT /scheduled-test-senders/{id}
  • DELETE /scheduled-test-senders/{id}
  • POST /scheduled-test-senders/{id}/test-connection
Automatic Testing: Tests 9 calls
  • GET /scheduled-tests
  • POST /scheduled-tests
  • GET /scheduled-tests/{id}
  • PUT /scheduled-tests/{id}
  • PATCH /scheduled-tests/{id}
  • DELETE /scheduled-tests/{id}
  • POST /scheduled-tests/{id}/dispatch-now
  • GET /scheduled-tests/{id}/runs
  • GET /scheduled-tests/{id}/runs/{runId}
Spam Check 5 calls
  • GET /spam-check
  • POST /spam-check
  • GET /spam-check/{id}
  • GET /spam-check/{id}/heatmap
  • GET /spam-check/{id}/screenshots
Account 1 call
  • GET /status

Frequently asked questions about the API.

Plans, limits, where the reference lives, and what a 403 is telling you.

Which plan includes API access?
API access is included with the Custom plan, which you buy online: pick the monthly volume of each test on the pricing page, from a $5 minimum, and the rates drop as you grow. You can build it into your own product and resell it under your own brand. For anything else, open a support ticket.
Is there a reference with every parameter?
Yes. The OpenAPI document is the reference, and it is generated from the API itself, so it cannot describe a call the service does not answer. It is linked at the top of this page.
What are the rate limits?
All endpoints are rate-limited to 100 requests per minute: per IP address for public endpoints, per account once you authenticate. Past the limit the API answers 429 Too Many Requests, so back off and retry instead of assuming a bigger budget. The MCP server limits requests per account the same way. If you need a higher limit, open a support ticket with your expected throughput.
What does a 403 mean?
The token is valid and the account may not make that call. The body carries a reason: the account email is not confirmed yet, the plan allowance for that call is spent for the period, or the plan does not include API access.
Can an AI assistant use it?
Yes, over MCP rather than REST. The MCP server exposes the same jobs as tools an assistant can call, with OAuth 2.1 in place of a bearer token.
Does it need access to my email platform?
Not for a spam check or a preview. You send a message to an address the API gives you, from whatever you already send with, and the API reads what arrived. Recurring automatic tests are different, because something has to send them on a schedule, so a sender is connected over SMTP for those.
Can I collect DMARC reports through the API?
Yes. Register your domain, publish the TXT record the response returns (it merges with an existing DMARC record rather than replacing it), and verify it with a live DNS check. Aggregate reports usually start arriving within 24 to 48 hours; you can then list them per domain and read each report down to its per-source records. Only reports from vetted reporting organizations are included.
Can I verify email addresses through the API?
Yes, on the Custom plan. Verify one address or a list of up to 100,000: start a check, take the id, then read each result with its status, reason and action. Unknown results are not charged. The email verification API page walks through every endpoint.
How do I check what my plan has left?
Call GET /status. It returns your plan name, price, next payment date and the remaining monthly limit for each kind of test.

Ready to wire deliverability into your own stack?

API access is included with the Custom plan, bought online from a $5 monthly minimum. Build it into your own product and resell it under your own brand.