Email — entry 009 of 19
Kickbox
Kickbox's free, keyless Open API endpoint answers a single question — whether an email domain is disposable — a common building block for lightweight signup-form validation. It's a separate, fully free offering from Kickbox's metered full verification product, which is where catch-all (accept-all) detection lives; a live probe found no catch-all surface on the open endpoint at all.
Kickbox's Open API is a small, free, keyless sibling to Kickbox's metered full email-verification product -- it answers exactly one question, whether an email's domain is disposable, with no signup. A live GET this run against `/disposable/test@mailinator.com` returned `{"disposable":true}`, a single field and the only one any response carried this run, and the same route also accepts a bare domain: a live GET against `/disposable/gmail.com` returned `{"disposable":false}`. Catch-all (accept-all) detection is part of the paid product, not this endpoint -- see the gotchas.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/kickbox/"><img src="https://greatapis.com/badge/kickbox.svg" alt="Scored 74 on greatapis.com"></a>Auth quickstart
- No API key, signup, or credit card required for the Open API -- a live GET this run against `/disposable/test@mailinator.com` returned a genuine verdict with zero credentials. This is a distinct product from Kickbox's paid, metered verification API; nothing here unlocks or counts against that one.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Check whether an email's domain is disposable
GEThttps://open.kickbox.com/v1/disposable/test@mailinator.com
{"disposable":true}The same endpoint also accepts a bare domain in place of a full address -- a live GET this run against `/disposable/gmail.com` returned `{"disposable":false}`, the identical single-field shape.
Try it
Developer reference
https://open.kickbox.com/v1- GET/disposable/{email}
Gotchas & limits
- `Access-Control-Allow-Origin` is a **reflected Origin, not a wildcard** -- confirmed live this run: a request sent with `Origin: https://example.com` got back `access-control-allow-origin: https://example.com`, while a plain request with no `Origin` header got back the same header present but set to an **empty string**. Don't assume a `*` like Disify's; check the header is non-empty for your actual origin.
- There are **no rate-limit headers at all** on the keyless tier -- confirmed across every response this run (no `x-ratelimit-limit`, `retry-after`, or similar), unlike Disify's `x-ratelimit-limit: 30`. There's no visible signal for how much headroom is left before throttling kicks in.
- A syntactically invalid string like `notanemail` is still **HTTP 200 with `{"disposable":false}`**, not an error -- confirmed live this run. Unlike Disify, there's no `format` field to tell you the input wasn't parsed as an email or domain at all; a typo and a genuine non-disposable result look identical.
- **There is no catch-all/accept-all surface on the Open API**, despite what a general description of Kickbox might suggest -- confirmed live this run: `/accept-all/mailinator.com` and `/catch-all/mailinator.com` each 301-redirect to `https://docs.kickbox.com/`, exactly as a made-up path (`/bogus-nonexistent-path/mailinator.com`) does, and appending `?catchall=true` to the working route changed nothing (`{"disposable":true}`, unchanged). Kickbox's own open.kickbox.com landing page advertises its ACCEPT-ALL detector under the heading "Go beyond just checking for disposable email addresses" -- i.e. as a feature of the paid Email Verification API, not this free one.