Tomba

The Tomba API provides programmatic access to email discovery, verification, enrichment, and company intelligence workflows. Find professional emails, validate deliverability, retrieve sources, and automate prospecting at scale using simple REST endpoints.

Getting Started

To begin, send authenticated requests using your API credentials in the request headers. Start with domain search or email finder, then verify addresses and enrich contacts as needed for your workflow.

Code
curl -X GET 'https://api.tomba.io/v1/email-finder?domain=tomba.io&first_name=emily&last_name=harris' \
  -H "X-Tomba-Key: your_api_key" \
  -H "X-Tomba-Secret: your_api_secret"

Rate Limits

Rate limits are enforced per endpoint and per plan across three dimensions: per-second (rps), per-minute (rpm), and per-day. Your daily limit equals your monthly credits divided by 5.

Plan	Per Second	Per Minute	Per Day
Free	1	2	5
Basic	3	50	500
Growth	5	80	1,000
Pro	8	150	4,000
Pro Plus	10	200	10,000
Scale	15	300	20,000–60,000

Full details at Rate Limits. Upgrade your plan for higher throughput.

Rate Limit Headers

Each API response includes these headers:

• RateLimit-Policy: Rate limit policies with quota and window (e.g. "rps";q=8;w=1, "daily";q=4000;w=86400)
• RateLimit: Remaining quota and time until reset (e.g. "rps";r=7;t=1, "daily";r=3842;t=64802)
• x-second-rate-limit: Total per-second request limit
• x-minute-rate-limit: Total per-minute request limit
• x-daily-rate-limit: Total daily request limit
• x-minute-request-left: Remaining requests for the minute
• x-daily-request-left: Remaining requests for the day
• x-minute-reset-seconds: Seconds until minute limit resets
• x-daily-reset-seconds: Seconds until daily limit resets
• Retry-After: Seconds to wait (on 429 responses only)

When any limit is exceeded, the API returns 429 Too Many Requests with a Retry-After header.

Check Your Usage

Use GET /v1/rate-limits to see your current usage per endpoint.

Authentication

All endpoints require both authentication headers: X-Tomba-Key and X-Tomba-Secret. Requests without valid credentials return unauthorized errors.

Versioning

The current stable API base URL is https://api.tomba.io/v1. Backward-compatible improvements may be released without changing the major version path.

Support

For questions, troubleshooting, or integration help, contact support at info@tomba.io or visit the documentation at https://docs.tomba.io.