An email enrichment API returns what is verifiably known about an email address. This one answers in a single request: which of 888 platforms the address is registered on, every breach it has appeared in, and where it is mentioned on the public web - each fact stamped with how and when it was established, and anything unconfirmed left out rather than guessed.
Send the address. The type is detected for you, so the same endpoint handles an email search, a phone number or a username without a different code path. Add ?wait=true and the answer returns on the same request.
curl -X POST "https://api.digifootprint.dev/v1/lookup?wait=true" \
-H "Authorization: Bearer dfp_your_key" \
-H "Content-Type: application/json" \
-d '{"query": "someone@example.com"}'{
"query": "someone@example.com",
"queryType": "email",
"platformsChecked": 888,
"matches": 4,
"socialMatches": 3,
"servedFromCache": false,
"results": [
{ "platform": "github", "registered": true, "method": "public_api", "checkedAt": "2026-08-31T09:12:04.377Z" },
{ "platform": "spotify", "registered": true, "method": "public_api", "checkedAt": "2026-08-31T09:12:04.201Z" },
{ "platform": "instagram", "registered": true, "method": "public_api", "checkedAt": "2026-08-31T09:12:04.118Z" },
{ "platform": "duolingo", "registered": true, "method": "public_api", "checkedAt": "2026-08-31T09:12:04.512Z" },
{ "platform": "twitter", "registered": false, "method": "public_api", "checkedAt": "2026-08-31T09:12:04.402Z" }
],
"breaches": [
{ "name": "Collection1", "breachDate": "2019-01-07" },
{ "name": "LinkedIn", "breachDate": "2012-05-05" }
],
"webMentions": [
{ "title": "someone (GitHub)", "url": "https://github.com/someone" }
]
}These three names describe the same operation and this API serves all of them: start from an email address, find out where it exists. An email search across platforms and an email enrichment call are the same request here - what differs is only what you intend to do with the answer.
Of the 888 platforms in the registry, 27 accept an email address as input; the rest are keyed on a username. That asymmetry is a property of the platforms, not of this API, and it is why a username reaches further than an address does. See username search when you have a handle rather than an address, and coverage and accuracy for the exact counts by input type.
Most enrichment products return a name, a job title, a company and a confidence score. This one returns none of those, because none of them can be confirmed from an email address - they are inferred, and an inference presented beside a verified fact is indistinguishable from it once it reaches a risk model.
What comes back instead is narrow and checkable: registration exists or it does not, this breach contains the address or it does not, this page mentions it or it does not. Every entry carries its method and checkedAt. Where a source is not configured, breaches and webMentions are null rather than an empty array, so “we did not look” never reads as “we looked and found nothing”.
At signup, the count of platforms an address is registered on separates an established person from an address created minutes ago - see fraud prevention and thin digital footprints.
In regulated onboarding, breach dates give a demonstrable lower bound on how long an address has existed, which is difficult to fabricate - see AML compliance and KYC. In trust and safety, an address registered nowhere else is among the cheapest fake-account signals available - see fake account detection.
15 free lookups to start, shared across your company domain, no card required. Then pay as you go at $0.06 per lookup (top up from $19), or Growth at $39 a month for 1,000 lookups. Full details on the pricing page.