IntelBase APIintelbase.is ↗
Query any email address for data breaches, infostealer logs, account registrations, and service validation via the IntelBase API. 2 endpoints.
What is the IntelBase API?
The IntelBase API gives developers structured email intelligence across 2 endpoints, returning breach records, infostealer log exposure, and account registration status for any queried email address. The lookup_email endpoint consolidates up to 50 breach results alongside stealer log counts, a timeline of activity, and a validator object that separates confirmed registered services from unregistered ones. The list_modules endpoint returns the full catalog of services IntelBase checks, including each module's id, name, domain, and type.
No input parameters required.
curl -X GET 'https://api.parse.bot/scraper/21b5335e-1870-4008-87c7-0ff780888935/list_modules' \ -H 'X-API-Key: $PARSE_API_KEY'
Typed, relational, agent-ready
A generated client with real types, enums, and the links between objects — the structure a flat JSON response can't carry. Autocompletes in your editor and reads cleanly to coding agents.
- Fully typed · autocompletes
- Objects link to objects
- Typed errors & pagination
Typed Python client. Set up the SDK in your uv project, then pull this API’s typed client:
uv add parse-sdk uv run parse init uv run parse add --marketplace intelbase-is-api
uv run parse add --marketplace pulls a pinned snapshot of this canonical API — it won’t change underneath you. To customize it, subscribe and swap to your own copy.
"""Walkthrough: IntelBase SDK - bounded, re-runnable; every call capped."""
from parse_apis.intelbase_is_api import IntelBase, RateLimitError
client = IntelBase()
# List available intelligence modules (services checked during lookup)
for module in client.modules.list(limit=3):
print(module.name_formatted, module.domain, module.type_name)
# Look up an email address for breach and account intelligence
try:
report = client.email_reports.get(email="[email protected]")
print(report.email, report.meta.first_seen, report.meta.last_seen)
print("Breaches:", report.data_breaches.amount)
for breach in report.data_breaches.results[:3]:
print(" ", breach.source.name, breach.source.date, breach.password)
print("Registered services:", len(report.validator.registered))
for svc in report.validator.registered[:3]:
print(" ", svc.name_formatted, svc.domain)
print("Accounts found:", len(report.accounts))
for acct in report.accounts[:2]:
print(" ", acct.module.name_formatted, [f.key for f in acct.data.fields])
except RateLimitError as e:
print("rate limited:", e)
print("exercised: modules.list, email_reports.get")
Returns the complete catalog of services and platforms that IntelBase checks during an email lookup. Each module represents a site whose registration or account status can be verified. Results are not paginated - the full list is returned in one call.
No input parameters required.
{
"type": "object",
"fields": {
"total": "total number of modules available",
"modules": "array of supported service modules with id, name, domain, and type"
},
"sample": {
"data": {
"total": 98,
"modules": [
{
"id": "6a1a5c74b026034d73e0df62",
"name": "chess.com",
"type": 0,
"domain": "chess.com",
"type_name": "account",
"name_formatted": "Chess.com"
},
{
"id": "6a1a5c75b026034d73e0df65",
"name": "dropbox",
"type": 0,
"domain": "dropbox.com",
"type_name": "account",
"name_formatted": "Dropbox"
}
]
},
"status": "success"
}
}About the IntelBase API
What the API Returns
The lookup_email endpoint accepts a single required parameter — email — and returns a structured response covering four distinct intelligence dimensions. The data_breaches object includes an amount field with the total breach count and a results array capped at 50 entries, each representing a known breach event. The stealer_logs object reports a compromised boolean, a count, and a results array of infostealer log entries tied to the email. The accounts array lists identified accounts with module metadata and extracted field values. The validator object splits service checks into registered and unregistered arrays so you can see exactly which platforms confirmed or rejected the email.
Meta and Timeline Data
The meta object inside a lookup_email response includes first_seen and last_seen timestamps, a cloaked flag, and a timeline array that tracks activity chronologically. These fields are useful for gauging how long an email has been active in known datasets and whether it has been obscured in any way.
Module Catalog
The list_modules endpoint takes no inputs and returns the complete set of services IntelBase checks. The response includes a total count and a modules array where each entry has an id, name, domain, and type. This is useful for understanding the scope of the validator checks returned by lookup_email and for building UI labels or filtering logic around specific services.
The IntelBase API is a managed, monitored endpoint for intelbase.is — not a raw scraper you maintain. Every endpoint is automatically health-checked on a schedule, and when intelbase.is changes and a check fails, the API is automatically queued for repair and re-verified. It is built to keep working as the site underneath it changes.
This isn't an official intelbase.is API — it's an independent, maintained REST wrapper over public data. Where the source has no official API (or only a limited one), Parse gives you a stable contract over a source that never promised one, and keeps it current. Need a new endpoint or field? You can revise it yourself in plain English and the agent rebuilds it against the live site in minutes — contributing the change back to the shared API is free.
Will this API break when the source site changes?+
Is this an official API from the source site?+
Can I fix or extend this API myself if I need a new endpoint or field?+
What happens if I call an endpoint that has an issue?+
- Automated account takeover risk assessment using the stealer_logs compromised flag and count per email
- Breach notification pipelines that check data_breaches.amount before alerting affected users
- Onboarding fraud checks that verify whether a submitted email appears in known infostealer logs
- Building a service exposure map by cross-referencing the accounts array with the list_modules catalog
- Security research workflows that track first_seen and last_seen timestamps to date email exposure windows
- Identity investigation tools that enumerate confirmed registered services from the validator.registered array
- Threat intelligence dashboards that surface cloaked email flags alongside breach and stealer log counts
| Tier | Price | Credits/month | Rate limit |
|---|---|---|---|
| Free | $0/mo | 100 | 5 req/min |
| Hobby | $30/mo | 1,000 | 20 req/min |
| Developer | $100/mo | 5,000 | 100 req/min |
One credit = one API call regardless of which marketplace API you call. Exceeding the rate limit returns a 429 response. Authenticate with the X-API-Key header.