intelx.io APIintelx.io ↗
Query the Intelligence X archive across Tor, I2P, data leaks, and paste sites. Search by email, domain, IP, or URL and retrieve full file content or previews.
curl -X POST 'https://api.parse.bot/scraper/0e82f82a-ca40-42ed-9c8b-3ecf8a7aaa51/search' \
-H 'X-API-Key: $PARSE_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"term": "example.com",
"limit": "2"
}'Initiates an intelligent search and returns initial results plus a search ID. The search ID can be used with get_results and get_stats endpoints. Search IDs expire within minutes, so downstream calls should be made promptly.
| Param | Type | Description |
|---|---|---|
| sort | integer | Sort order: 0 (most relevant), 1 (least relevant), 2 (newest), 3 (oldest) |
| termrequired | string | Search query (email, domain, IP, URL, etc.) |
| limit | integer | Max results in the initial poll response |
| api_key | string | Intelligence X API key. Uses the public guest key if not provided. |
| date_to | string | Date filter end in format YYYY-MM-DD HH:MM:SS |
| date_from | string | Date filter start in format YYYY-MM-DD HH:MM:SS |
| max_results | integer | Max total results for the search job |
{
"type": "object",
"fields": {
"status": "integer indicating search status (0=success, 1=still running, 2=done/expired)",
"records": "array of result objects containing storageid, bucket, name, date, media type, and other metadata",
"search_id": "string UUID identifying this search job, used with get_results and get_stats"
},
"sample": {
"data": {
"status": 0,
"records": [
{
"date": "2019-01-18T01:32:37Z",
"name": "Collection #3_OLD LEAK.tar.gz/mybb_users.sql [Part 2 of 12]",
"size": 4194226,
"typeh": "Text",
"bucket": "leaks.private.general",
"mediah": "Database File",
"systemid": "3635335e-aaa4-49c2-a573-b1863384a4f9",
"storageid": "REDACTED_SECRET"
}
],
"search_id": "27ba1d16-360f-4553-a08f-c25e6a3802d8"
},
"status": "success"
}
}About the intelx.io API
The Intelligence X API exposes 5 endpoints for searching and retrieving archived content from data leaks, Tor, I2P, and public web sources. Starting with the search endpoint, you can query by email address, domain, IP, or URL and receive structured result records—including storageid, bucket, name, date, and media type—along with a search_id UUID that feeds directly into result polling, file retrieval, and statistical breakdown endpoints.
Search and Result Retrieval
The search endpoint accepts a term string (email, domain, IP, URL, or similar identifier) and returns an array of records, each carrying a storageid, bucket, name, date, and media type metadata. It also returns a status integer (0 = success, 1 = still running, 2 = done/expired) and a search_id UUID. Results can be sorted by relevance or date via the sort parameter, and date-range filtering is available through date_from and date_to in YYYY-MM-DD HH:MM:SS format. The max_results parameter caps the total job size; limit controls how many records appear in the initial response.
The get_results endpoint takes a search_id and returns the same status and records structure, making it suitable for pagination or polling a job that was still running at search time. Search IDs expire within minutes of creation, so both get_results and get_stats calls must follow the initial search call promptly.
File Content and Previews
Once you have a record's storageid and bucket values, get_file returns the full text content of that item, while get_preview returns only the first 8 lines as a preview string. Both endpoints require the same pair of inputs, making it straightforward to triage records—check the preview first to assess relevance before fetching the full content.
Search Statistics
The get_stats endpoint accepts a search_id and returns four breakdown arrays: date (day-level counts with ISO timestamps), type (content type IDs with human-readable typeh labels and counts), media (media type IDs with mediah labels, counts, and filter flags), and bucket (source bucket names with bucketh labels, counts, and filter flags). This lets you understand the temporal distribution and source composition of results for a given query without fetching every record individually.
- Check whether a corporate email domain appears in known data breach records by querying it as a
term - Investigate exposure of a specific IP address across Tor and paste site archives
- Retrieve the full content of a leaked credential file using
get_filewithstorageidandbucket - Triage large result sets by calling
get_previewto inspect the first 8 lines before committing to full retrieval - Analyze the temporal spread of breach records for a domain using the
datearray fromget_stats - Identify which source buckets (e.g., paste sites vs. darknet markets) dominate results for a given query via the
bucketdistribution inget_stats - Build a monitoring pipeline that polls
get_resultsagainst a freshsearch_idfor recurring threat intelligence queries
| Tier | Price | Credits/month | Rate limit |
|---|---|---|---|
| Free | $0/mo | 100 | 5 req/min |
| Hobby | $30/mo | 1,000 | 20 req/min |
| Developer | $100/mo | 5,000 | 250 req/min |
One credit = one API call regardless of which marketplace API you call. Exceeding the rate limit returns a 429 response. Authenticate with the X-API-Key header.
Does Intelligence X have an official developer API?+
api_key parameter.What does `get_stats` actually return, and is it different from `get_results`?+
get_stats returns aggregate distributions—date (count per day), type (content type breakdown with human labels), media (media type breakdown), and bucket (source breakdown)—for a given search_id. It does not return individual records. get_results returns the actual records array with per-item metadata like storageid, name, and date. The two endpoints serve distinct purposes: statistics vs. record enumeration.Why do search IDs expire so quickly, and what should I do about it?+
search call. If you need get_results or get_stats data, make those calls immediately after search. If the status field returns 2 (done/expired), you will need to re-issue a search request to obtain a fresh search_id.Does the API support querying for phone numbers or cryptocurrency wallet addresses?+
term field is a free-form string, so you can submit a phone number or wallet address as a search term. However, the response records do not include structured fields specifically parsed for those entity types—results come back with generic metadata (storageid, bucket, name, date, media type). Structured extraction for those entity types is not currently part of the API. You can fork this API on Parse and revise it to add an endpoint that post-processes record content for specific entity types.Can I retrieve binary files (images, archives) through `get_file`?+
get_file endpoint returns content as text. Non-text file formats are not currently returned as raw binary data through this API. It covers text-representable content from the archive. You can fork this API on Parse and revise it to add binary retrieval if the underlying storage IDs correspond to binary objects you need.