# IntelBase API

> IntelBase looks up an email address or username and shows the accounts registered to it across hundreds of sites, with the profile details each site shows. Email lookups also cover data breaches and infostealer logs. It is used for fraud prevention, threat investigation, due diligence and digital forensics. People can use it in the web dashboard, through a REST API, or from an AI assistant through a remote MCP server.

- Base URL: https://api.intelbase.is
- Authentication: send your API key in the `x-api-key` header. It's on the account page: https://intelbase.is/dashboard/account
- Plan: a paid plan with API access is required (https://intelbase.is/pricing).
- IP whitelisting: requests must come from an IP whitelisted on the account or team. `GET /account/ip` shows the IP the server sees.
- Full reference: https://intelbase.is/docs

## For AI agents writing code against this API

Read the API key from an environment variable or secret store, and never put it in code or ask a person to paste it into a chat. If every request returns 401 "Your IP is not whitelisted", have them call `GET /account/ip` from the machine making the calls and whitelist that exact address. Cloud functions and AI sandboxes often have no fixed IP, which is what the MCP server is for: https://intelbase.is/mcp.md

## POST /lookup/email

Looks up an email address.

| Parameter | Type | Default | Description |
| --- | --- | --- | --- |
| `email` | string | required | The email address to look up. |
| `timeout_ms` | integer | 10000 | Max wait in milliseconds (100 to 120000). Modules still running when it expires are dropped. Under 5000 skips slower modules. |
| `include_data_breaches` | boolean | true | Search data breaches and stealer logs. Visibility also depends on the plan. |
| `include_stealer_logs` | boolean | true | Include infostealer log results and enrichment. Access also depends on the plan. |
| `include_ai` | boolean | false | Run the AI steps: ownership check, picture matching and ranked suggestions. Adds time, and needs a plan with AI features. |
| `exclude_modules` | string[] | [] | Module names to skip. Can't be combined with `include_modules`. |
| `include_modules` | string[] | [] | Run only these modules. Can't be combined with `exclude_modules`. |

```sh
curl -X POST https://api.intelbase.is/lookup/email \
  -H "x-api-key: $INTELBASE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "someone@example.com"}'
```

Response sections: `identifier.accounts`, `validator.registered`, `validator.unregistered`, `data_breaches`, `stealer_logs`, `stealer_enrichment`, `suggestions`, `insights`, and `identity` when available. See https://intelbase.is/docs#response for each field.

## POST /lookup/username

Finds where a username is registered.

| Parameter | Type | Default | Description |
| --- | --- | --- | --- |
| `username` | string | required | No leading @. Letters, digits, dot, underscore and hyphen; starts with a letter or digit; up to 65 characters. |
| `timeout_ms` | integer | 15000 | Max wait in milliseconds (100 to 120000). Sites still running when it expires are dropped. |
| `include_ai` | boolean | false | Run AI identity grouping and picture matching. Needs a plan with AI features. |
| `exclude_modules` | string[] | [] | Site modules to skip. Can't be combined with `include_modules`. |
| `include_modules` | string[] | [] | Check only these site modules. Can't be combined with `exclude_modules`. |

```sh
curl -X POST https://api.intelbase.is/lookup/username \
  -H "x-api-key: $INTELBASE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"username": "somehandle"}'
```

See https://intelbase.is/docs#username-response for the response.

## GET /lookup/modules

Lists the available modules, for use with `include_modules` and `exclude_modules`. Requires the API key. See https://intelbase.is/docs#modules.

## GET /account/ip

Returns the IP the server sees, as `{ "ip": "203.0.113.24" }`. No key needed.

## Errors

Errors use the HTTP status and, where applicable, a body of `{ "error": "message" }`.

| Status | Meaning |
| --- | --- |
| 400 | Malformed JSON, an invalid email or username, or both `exclude_modules` and `include_modules`. |
| 401 | Missing or invalid key, a free plan, a plan without API access, an IP that isn't whitelisted, or the daily limit was reached. Read the `error` message to tell which. |
| 403 | The email or username has been removed from search at its owner's request. |
| 429 | The plan's per-minute rate limit was exceeded. |
| 500 | An unexpected error while running the lookup. |

## Limits

Both come from the plan and are shared across lookup types: a per-minute rate limit (429 when exceeded), and a daily lookup quota (401 when reached, shared across a team). Each completed lookup counts as one.