osintabuse documentation

One identifier.
A structured response.

Use the workspace to search indexed records and inspect their source metadata, chronology and categories.

Authentication

Open a workspace first. The browser uses an HttpOnly session cookie. Mutating requests require the exact application origin and the session’s CSRF token in the X-CSRF-Token header.

The session endpoint returns the current workspace state and its CSRF token. Keep session credentials private.

Search

Submit one email address and select a purpose: self or authorized. Accept the research terms before your first check. Live results are fetched when you submit the search.

{
  "query": "alex@example.com",
  "purpose": "self",
  "searchType": "records"
}

The search type selects indexed records or a breach check. Unavailable search services return an error and refund the credit.

Read the response

{
  "result": {
    "mode": "live",
    "engine": "search",
    "masked": "al•••@example.com",
    "counts": {
      "matched": 12,
      "records": 12,
      "buckets": 2
    },
    "censored": true,
    "partial": false
  },
  "creditsCharged": 1
}

Matching a document does not confirm a breach. File contents, passwords and session tokens are excluded from the displayed response.

Limits & errors

Workspaces start with 5 welcome credits. A successful live search costs one credit and failures are refunded. Free account identifiers and document details are censored on the server. The interface displays 25 records at a time and supports up to 1,000 metadata records per search. A partial result is labeled explicitly.