Skip to main content
The OsintCat API gives you the lookups of the OsintCat dashboard over HTTPS, with JSON responses.

​
Base URL

Every endpoint answers GET (most also accept POST); parameters always go in the query string.

​
Authentication

Send your API key in the X-API-KEY header with every request:
Create keys in your account under Settings → Developer. A key is shown once, when you create it: store it then. Keys start with cat_; your account’s CatID is not an API key. When you create a key you choose when it expires: in 7, 30 or 90 days, in a year, never, or on a date you pick. An expired key is refused like a revoked one (403); keys are not renewed, so create a new key and delete the old one. You can rename a key at any time.
Treat a key like a password. Keep it on your server, never in a website, app or public repository. If a key may have leaked, revoke it in Settings → Developer and create a new one.

​
Scopes

Each key carries one or more scopes: A request outside the key’s scopes is refused with 403 insufficient_scope.

​
Allowed IP addresses

In Settings → Developer you can list the IP addresses your requests come from. With a list set, requests from any other address are refused with 403 IP_UNAUTHORIZED. Leave the list empty to allow every address (for example for serverless platforms whose addresses change). A list holds up to 1 address on Researcher, 3 on Investigator and 10 on Max.

​
Plans and daily allowance

API access is part of these plans: Free and Starter plans have no API access (403 UPGRADE_REQUIRED). Prices are on the pricing page.
  • Each lookup counts once against the daily allowance, including answers served from a cache.
  • The allowance resets at 00:00 UTC. Account shows what is left; many lookups also return it in _meta.lookups_left.
  • Account, Modules and polling a task do not count.

​
When the allowance is used up

Most lookups continue at a per-lookup price charged to your account balance; the module’s page in the dashboard shows the price. You are charged only when the lookup finds something, and never for a lookup that fails. Without enough balance the request is refused with 402 INSUFFICIENT_BALANCE. Lookups that have no per-lookup price are refused with 429 LIMIT_REACHED until the allowance resets. Each endpoint’s page says how it is counted under Usage.

​
Rate limits

  • 3 requests per second per account, across all endpoints.
  • 5,000 requests per hour per endpoint from one IP address.
Over a limit, the request is refused with 429 rate_limit; the Retry-After header says how many seconds to wait. Keep well inside the limits: repeatedly exceeding them can pause API access for your account for a while.

​
Responses

Responses are JSON. A successful lookup answers 200 even when nothing was found; the endpoint’s page shows how an empty result looks. Errors carry an error field, usually with a message, and every error answer names its request_id. A server error (5xx) also names an error_id. Quote them to support so we can find the request; the X-Request-Id header carries the request id on every response, successful ones included.

​
Errors

​
Endpoints

Account

Plan and today’s allowance

Modules

Which lookups your plan includes

Breach Lookup

Breach and leak indexes

Database Search

Stealer logs and combo lists

Email OSINT

Where an address is registered

Phone OSINT

Carrier, line type, risk

Machine Viewer

Infected machine records

IP Lookup

Services and location of an IP
The navigation lists every endpoint.

​
Responsible use

Use the API only for lawful purposes such as security research, fraud prevention and investigations you are entitled to carry out, and in line with the Terms of Service and the data protection law that applies to you.