Look up contacts by email

POST/api/v1/contacts/lookup

Up to 100 addresses in one call. The response has the contacts that exist (all statuses, including deleted).

The addresses are sent in the body so that they do not end up in logs. An address can give two matches: a contact of your own and a shared one from a level above.

Scope

contacts:read Read contacts – the person behind the key must be all members.

Body

JSON, Content-Type: application/json. Unknown fields return 422.

emailsarray<string>required: Up to 100 addresses.at least 1 · at most 100

Retrying a request

Feel free to send the Idempotency-Key header (e.g. a UUID). If the same request is sent again with the same key within 24 hours, the first response is returned, without anything being done twice. Batch and idempotency

Response

200 The contacts that exist.

dataarray<object>required
data[].idstringrequired: The contact's ID.
data[].emailstringrequired: The email address (lower case). Never changes: consents and suppressions apply to the address.
data[].first_namestring | nullrequired
data[].last_namestring | nullrequired
data[].companystring | nullrequired
data[].phonestring | nullrequired: In international format (E.164), e.g. +46701234567.
data[].statusstringrequired: active: can receive mailings · unsubscribed: has unsubscribed from everything · bounced: the address bounces · complained: has reported spam · deleted: erased (GDPR), the personal data is gone.activeunsubscribedbouncedcomplaineddeleted
data[].fieldsobject<string | number | boolean>required: Custom fields by key (see GET /fields). Sensitive fields, such as personal identity numbers, are never sent out.
data[].tagsarray<string>required
data[].sourcestringrequired: How the contact was added: manual, import, form, api …
data[].consentobjectrequired
data[].consent.atstring (time, ISO 8601) | nullrequired: When consent was given.
data[].consent.sourcestring | nullrequired: How the person consented, in your own words.
data[].suppressionobject | nullrequired: The workspace's suppression of the address. A suppressed address never receives mailings, regardless of status.
data[].suppression.reasonstringrequired: unsubscribed, bounced, complained, manual or imported.
data[].suppression.created_atstring (time, ISO 8601)required: When the address was suppressed.
data[].sharedbooleanrequired: Shared from a level above in the organisation: can be read and receive mailings from here, but can only be changed where it belongs.
data[].created_atstring (time, ISO 8601)required: When the contact was created.
data[].updated_atstring (time, ISO 8601)required: When the contact was last changed.
data[].unsubscribed_atstring (time, ISO 8601) | nullrequired: When the person unsubscribed.

Errors

400: bad_request
401: unauthenticated invalid_key key_revoked key_expired key_inactive
402: payment_required
403: insufficient_scope forbidden workspace_suspended
409: idempotency_in_progress
415: unsupported_media_type
422: validation_failed idempotency_key_reused
429: rate_limited
500: internal_error

Request

curl -X POST 'https://newsletter.qrona.se/api/v1/contacts/lookup' \
  -H "Authorization: Bearer $QRONA_NEWSLETTER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"emails":["anna@example.se","bo@example.se"]}'

Response 200

{
  "data": [
    {
      "id": "1042",
      "email": "anna@example.se",
      "first_name": "Anna",
      "last_name": "Svensson",
      "company": "Example Ltd",
      "phone": "+46701234567",
      "status": "active",
      "fields": {
        "kundnummer": "K-2041",
        "ort": "Göteborg"
      },
      "tags": [
        "kund",
        "vip"
      ],
      "source": "api",
      "consent": {
        "at": "2026-10-19T08:30:00.000Z",
        "source": "Ticked the box at checkout on butik.se"
      },
      "suppression": null,
      "shared": false,
      "created_at": "2026-10-19T08:30:00.000Z",
      "updated_at": "2026-10-19T08:30:00.000Z",
      "unsubscribed_at": null
    }
  ]
}