Copy page

Email verifiers

Migrate from BounceBan

This guide maps the BounceBan v1 API (single verification, status polling, bulk tasks, and account) to the Tomba Email Verifier and bulk verifier jobs. BounceBan API behavior checked on 2026-09-29 against the BounceBan API reference.

Before you begin

• Get your API key (ta_…) and secret (ts_…); see Authentication.
• Check what a verification costs in Credit costs and your plan's throttling in Limits by plan.
• Set your HTTP client timeout to at least 180 seconds. Tomba returns the finished result in the response to the first request.

Endpoint mapping

Replace the host api.bounceban.com (and api-waterfall.bounceban.com) with api.tomba.io.

Authentication changes

BounceBan reads the key from the Authorization header. Tomba needs two headers, X-Tomba-Key and X-Tomba-Secret:

Code
# BounceBan
curl "https://api.bounceban.com/v1/verify/single?email=jane.doe@stripe.com" \
  -H "Authorization: $BOUNCEBAN_API_KEY"

# Tomba
curl "https://api.tomba.io/v1/email-verifier?email=jane.doe@stripe.com" \
  -H "X-Tomba-Key: $TOMBA_API_KEY" \
  -H "X-Tomba-Secret: $TOMBA_SECRET_KEY"

Tomba API keys expire; plan their rotation with Key expiry.

Parameter mapping

Response field mapping

BounceBan returns a flat object. Tomba nests the checks in data.email and lists the public pages where the address appears in data.sources. Field definitions are in Email verifier response.

Tomba also returns block, greylisted, gibberish, regex, smtp_check, and whois, which have no BounceBan counterpart.

Status mapping

Branch on status, not result: Tomba's unknown status carries the result risky, and a disposable address has an empty result. Compare status case-insensitively. Each value is defined in Status values.

Error mapping

Error responses don't consume credits. Every type is listed in Errors.

Bulk and async jobs

Tomba answers a single verification synchronously, so remove any polling of /v1/verify/single/status. For lists, run a bulk job of type verifier:

Code
curl -X POST "https://api.tomba.io/v1/bulk/verifier" \
  -H "X-Tomba-Key: $TOMBA_API_KEY" \
  -H "X-Tomba-Secret: $TOMBA_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Newsletter list", "list": "jane.doe@stripe.com\njohn.smith@shopify.com"}'

The launch, progress, and download requests are shown in Lifecycle. Row limits and daily job limits are in Limits, and a job is charged when you first download its results; see Billing.

Code example

This function verifies one address with Tomba and returns it in BounceBan's shape, so code that reads BounceBan results keeps working. It needs Node.js 18 or later.

Code
const TOMBA_HEADERS = {
    "X-Tomba-Key": process.env.TOMBA_API_KEY,
    "X-Tomba-Secret": process.env.TOMBA_SECRET_KEY,
};

// Tomba status -> BounceBan result. Disposable addresses count as undeliverable.
const RESULTS = {
    valid: "deliverable",
    accept_all: "risky",
    invalid: "undeliverable",
    unknown: "unknown",
    disposable: "undeliverable",
};

async function verify(email) {
    const url = new URL("https://api.tomba.io/v1/email-verifier");
    url.searchParams.set("email", email);
    const res = await fetch(url, { headers: TOMBA_HEADERS });
    const body = await res.json();
    if (body.errors) {
        throw new Error(
            `${res.status} ${body.errors.type}: ${body.errors.message}`,
        );
    }
    const check = body.data.email;
    return {
        email: check.email || email,
        result: RESULTS[check.status.toLowerCase()] ?? "unknown",
        score: check.score,
        is_disposable: check.disposable,
        is_accept_all: check.accept_all,
        is_free: check.webmail,
        mx_records: check.mx?.records ?? [],
        smtp_provider: check.smtp_provider,
    };
}

console.log(await verify("jane.doe@stripe.com"));

Cutover checklist

1. Store the Tomba key and secret as TOMBA_API_KEY and TOMBA_SECRET_KEY, and send them as X-Tomba-Key and X-Tomba-Secret instead of Authorization.
2. Point single verifications at GET https://api.tomba.io/v1/email-verifier and remove status polling and try_again_at handling.
3. Read results from data.email and translate them with the status mapping, comparing status case-insensitively.
4. Handle 402 where you handled 403, retry 429 after Retry-After, and drop addresses that return 451.
5. Replace bulk tasks with verifier jobs: create, launch, poll /progress, and download the CSV. Send email_column as email_field_index.
6. Verify the same sample list with both services and compare the mapped results before you switch production traffic.