Token lifecycle
A team can keep up to 10 active tokens, label each for production, staging, or development, assign validate and usage scopes, and revoke a token individually.
Connect Soryxa validation decisions to other systems with scoped API tokens, inbound validation webhooks, outbound event delivery, OpenAPI, and Postman assets.
Integration model
Create separate production, staging, and development tokens where useful. New tokens should use the smallest scope set that covers the endpoints they call.
| Scope | Access |
|---|---|
| validate | POST /api/v1/validate and all /api/v1/batch endpoints. |
| usage | GET /api/v1/usage for current usage and remaining validation allowance. |
| Empty scopes | Legacy full-access tokens. Prefer explicit scopes for new production tokens. |
A team can keep up to 10 active tokens, label each for production, staging, or development, assign validate and usage scopes, and revoke a token individually.
A new token value is displayed once and masked after you leave or refresh. Optional controls set a per-token requests-per-minute limit and a rotation reminder from 1 to 365 days.
Send GET /api/v1/usage with a bearer token carrying the usage scope to read current plan usage without consuming a validation credit.
Inbound connector webhooks use the integration slug and team public UUID. They can validate a direct email field or a nested action/data payload, and signed connectors are verified before work is queued.
POST /api/v1/integrations/webhook/{teamPublicUuid}/{slug}
Content-Type: application/json
{
"action": "validate",
"data": {
"email": "user@example.com"
}
}
Direct payloads with email or email_address are also accepted by connector-specific handlers where supported.
Store event IDs in receiving systems so duplicate deliveries can be handled safely. Inbound validate actions require an active outbound or bidirectional connector with read_results to receive results.
{
"event": "validation.completed",
"data": {
"email": "user@example.com",
"decision": "allow",
"reason_code": "CLASSIFICATION_VALID",
"score": 96
}
}
Webhook receivers should verify the sender, parse event type, and keep validation decisions separate from delivery failures. Failed outbound deliveries are tracked for retry and dead-letter handling.
Configured outbound connectors receive a completed validation decision.
Configured outbound connectors receive a validation failure that needs fallback handling.
Configured outbound connectors receive a completed batch summary.
Connectors with the review_decisions scope receive an approved review outcome.
Connectors with the review_decisions scope receive a rejected review outcome.
Connector scopes are separate from API token scopes. Choose scopes based on whether the connector receives events, triggers validation, or both.
| Connector scope | Access |
|---|---|
| validate | Allows inbound or bidirectional connectors to trigger Soryxa validation. |
| read_results | Allows outbound connectors to receive validation result data where supported. |
| read_usage | Allows connectors to read usage and allowance information where supported. |
| review_decisions | Allows outbound connectors to receive review queue decision events where supported. |
Connector availability may depend on account configuration and provider setup. Custom webhook is the most direct pattern for systems that can receive HTTPS JSON events.
Trigger no-code workflows from Soryxa validation and batch events.
Connect Soryxa events to Make scenarios for routing, alerts, and record updates.
Use Soryxa decisions inside self-hosted or managed n8n workflows.
Use email-quality decisions in identity and signup-related workflows where configured.
Use Soryxa validation from Clerk webhook or server-side signup handlers.
Use Soryxa validation with Supabase Auth signup or auth-hook workflows.
Use Soryxa validation with Firebase authentication workflows.
Use Soryxa validation in NextAuth or Auth.js server-side signup flows.
Use Soryxa validation in Laravel app signup and account intake flows.
Send Soryxa events to any HTTPS endpoint that can verify the request and process JSON payloads.
Use the OpenAPI file to generate clients or review response schemas. Use the Postman collection, workspace manifest, and environment file for a quick authenticated request from a local workspace. These four asset URLs require an authenticated Soryxa browser session.
The Postman collection includes runnable requests named Validate Email, Get Usage, Create Batch, List Batch Jobs, Get Batch Status, Get Batch Results, Export Batch Results, Get Batch Credits, Cancel Batch, and Trigger Integration Webhook.
The activation screen tracks six setup steps: API token, published policy, playground decision, usage-log verification, Postman collection, and protected form proxy.
elvesora/soryxa-laravel
composer require elvesora/soryxa-laravel
elvesora/soryxa-php
composer require elvesora/soryxa-php
Soryxa sign-in required
https://soryxa.elvesora.com/integrations/openapi.yaml
Soryxa sign-in required
https://soryxa.elvesora.com/integrations/postman-collection.json
Soryxa sign-in required
https://soryxa.elvesora.com/integrations/postman-workspace.json
Soryxa sign-in required
https://soryxa.elvesora.com/integrations/postman-environment.json