Find social media accounts linked to an email address

How to find social media accounts by email with one request

Send the address to POST /v1/lookup. The response is a list of platforms, and for each one a single fact: an account exists for this address (registered: true), or the platform answered and none does (registered: false). Every entry carries checkedAt, the real moment that fact was established, and method, how it was established. Social hits are counted separately in socialMatches, so a mailbox provider that comes with the address never inflates the number you score on.

curl -X POST "https://api.digifootprint.dev/v1/lookup?wait=true" \
  -H "Authorization: Bearer dfp_your_key" \
  -H "Content-Type: application/json" \
  -d '{"query": "someone@example.com"}'

{
  "query": "someone@example.com",
  "platformsChecked": 887,
  "matches": 4,
  "socialMatches": 3,
  "derivedMatches": 1,
  "servedFromCache": false,
  "results": [
    { "platform": "instagram", "registered": true,  "method": "public_api", "checkedAt": "2026-08-30T09:12:04.118Z" },
    { "platform": "spotify",   "registered": true,  "method": "public_api", "checkedAt": "2026-08-30T09:12:04.201Z" },
    { "platform": "github",    "registered": true,  "method": "public_api", "checkedAt": "2026-08-30T09:12:04.377Z" },
    { "platform": "reddit",    "registered": true,  "method": "public_api", "checkedAt": "2026-08-30T09:12:04.610Z", "derivedFrom": "email_local_part" },
    { "platform": "twitter",   "registered": false, "method": "public_api", "checkedAt": "2026-08-30T09:12:04.402Z" }
  ],
  "breaches": [],
  "webMentions": [],
  "phoneDetails": null
}

The address in the example is registered on Instagram, Spotify and GitHub, is not registered on Twitter, and its handle turned up a Reddit account. Breach history and public web mentions ride along in the same response: an empty array means checked and nothing found, while null means that source is not enabled for your account. The full field list is in the lookup reference.

Which accounts an email address can reach

An email address reaches 27 platforms directly - the ones where an account is keyed on the address itself, including Instagram, Spotify, GitHub, TikTok and Discord. 25 of those sit in the instant tier and answer in around half a second. That direct set is deliberately small: it holds only the platforms that can confirm an address without guesswork, which is a shorter list than the platforms people use.

The rest of the footprint comes from the handle. The part of the address before the @ is tried as a username against the 864 platforms keyed on a handle - most of the social category. A hit from that pass is labelled derivedFrom: "email_local_part" and counted in derivedMatches, never folded into the direct count. Organisational local parts such as info or support are not tried at all, and a derived miss is not reported, because “no one called jane on Reddit” says nothing about jane@example.com.

What the response leaves out, and why

No profile contents. A lookup here is a registration check, not a profile read: it never returns names, photos, bios, posts, follower counts, locations or messages. That boundary is what lets the same call run at signup and in regulated onboarding, and it is the answer to the consumer-phrased version of this search. If you want to read someone’s profiles, this is not the tool; if you want to know whether an address has a life on the platforms a real person uses, it is.

Omitted is not “not registered”. A platform that blocked the check, timed out, or returned something we could not interpret is left out of results entirely rather than reported as false. So a response that names 40 platforms out of 887 is telling you about 40, and staying silent on the rest. Nothing in a response is inferred - verified or omitted, never guessed.

Reading an email footprint as a signal

An address registered on a handful of unrelated platforms over several years is expensive to fake. An address that exists nowhere - no social accounts, no breach history, no web mentions - is what a freshly minted disposable address looks like, and also what a privacy-conscious person looks like, which is why a thin footprint should raise a score, not block on its own. Use socialMatches rather than matches for that score, and treat derived hits as corroboration rather than proof.

Results are cached, and the response says so: servedFromCache tells you whether anything was reused, and each checkedAt is the real time the fact was established, so a week-old answer is never dressed up as a fresh one. How long each kind of answer is trusted is on the caching page.

Who finds social media accounts by email, and for what

Fraud teams run it at signup and checkout to separate a real person from a throwaway address. KYC and AML teams use it as a low-friction first pass before asking for documents. Investigators use it to establish which platforms an address is registered with before requesting anything through formal channels. All three want the same thing: which accounts exist, not what is in them. The same check works from a username or, with much narrower coverage, a phone number; the wider picture is on the reverse email lookup guide. Free lookups to start - see pricing.