Intelx APIintelx.io ↗
Search the Intelligence X index via API. Query by domain, email, IP, CIDR, Bitcoin address, and more across darknet, pastes, and data leaks.
What is the Intelx API?
The Intelligence X API exposes 1 endpoint — search — that queries the intelx.io index across the public web, darknet (Tor/I2P), paste sites, and data leaks. A single call accepts selectors like email addresses, domains, IPs, CIDR ranges, Bitcoin addresses, or free-text terms and returns up to 100 matching records, each carrying metadata including file name, date, media type, and source bucket.
curl -X GET 'https://api.parse.bot/scraper/1eefacdd-5c4c-4775-bfdd-9989f6995701/search?sort=most_relevant&term=example.com&media=paste' \ -H 'X-API-Key: $PARSE_API_KEY'
Typed, relational, agent-ready
A generated client with real types, enums, and the links between objects — the structure a flat JSON response can't carry. Autocompletes in your editor and reads cleanly to coding agents.
- Fully typed · autocompletes
- Objects link to objects
- Typed errors & pagination
Typed Python client. Set up the SDK in your uv project, then pull this API’s typed client:
uv add parse-sdk uv run parse init uv run parse add --marketplace intelx-io-api
uv run parse add --marketplace pulls a pinned snapshot of this canonical API — it won’t change underneath you. To customize it, subscribe and swap to your own copy.
"""Walkthrough: Intelligence X SDK — search indexed content, filter by media type."""
from parse_apis.intelx_io_api import IntelX, Sort, MediaType, InputFormatInvalid
client = IntelX()
# Search for paste records mentioning a domain, sorted by newest first.
for record in client.records.search(term="example.com", sort=Sort.NEWEST, media=MediaType.PASTE, limit=5):
print(record.date, record.media_type, record.bucket, f"score={record.score}")
# Drill into the first result from a broader search to inspect its fields.
hit = client.records.search(term="example.com", sort=Sort.MOST_RELEVANT, limit=1).first()
if hit is not None:
print(hit.system_id, hit.name or "(untitled)", hit.size, "bytes")
# Date-bounded search with error handling for malformed input.
try:
for record in client.records.search(
term="[email protected]",
date_from="2023-01-01",
date_to="2024-12-31",
max_results=20,
limit=10,
):
print(record.date, record.type, record.access_level)
except InputFormatInvalid as e:
print("Bad input:", e.message)
print("exercised: records.search (paginated, filtered, date-bounded, error-handled)")
Search the Intelligence X index for records matching a term (domain, URL, email, IP, CIDR, Bitcoin address, etc.). Internally initiates an async search and polls for results. Returns metadata about matching files and documents including name, date, media type, source bucket, and relevance score. Each call makes two sequential upstream requests (initiate + fetch), so latency is ~3 seconds. Results are capped at 100 per call.
| Param | Type | Description |
|---|---|---|
| sort | string | Sort order for results. |
| termrequired | string | Search selector: a domain, URL, email address, IP address, CIDR range, Bitcoin address, or free-text keyword. |
| media | string | Filter results by media/file type. Omitted or empty returns all types. |
| date_to | string | Filter results to items dated on or before this date. ISO 8601 format YYYY-MM-DD (e.g. 2024-12-31). |
| date_from | string | Filter results to items dated on or after this date. ISO 8601 format YYYY-MM-DD (e.g. 2023-01-01). |
| max_results | integer | Maximum number of results to return (1-100). |
{
"type": "object",
"fields": {
"status": "Search status code (0 = complete)",
"records": "Array of matching records with metadata",
"search_id": "Unique identifier for this search session (UUID string)",
"total_found": "Number of records returned in this response"
},
"sample": {
"data": {
"status": 0,
"records": [
{
"date": "2026-08-13T00:06:24.958547Z",
"name": "https://yagiz.co/release-of-ada-v3",
"size": 25711,
"type": "Text",
"added": "2026-08-13T00:06:24.98647Z",
"score": 49,
"bucket": "Web » Public » Americas",
"system_id": "727575dc-805b-4579-a513-e90a343ec87b",
"media_type": "Website HTML",
"storage_id": "REDACTED_SECRET",
"description": "",
"access_level": "Public"
}
],
"search_id": "09c715df-a2a7-4461-8bd5-82b6c13ceebd",
"total_found": 1
},
"status": "success"
}
}About the Intelx API
What the search endpoint returns
The search endpoint accepts a term parameter — a domain, URL, email address, IP address, CIDR range, Bitcoin address, or keyword — and returns an array of matching records. Each record includes metadata such as the document name, date, media type, and the source bucket (e.g., a paste site, darknet node, or leak dataset). The response also includes a search_id (UUID), a status code (0 = complete), and total_found indicating how many records are in the current response.
Filtering results
Results can be scoped with optional parameters. Use date_from and date_to (ISO 8601 format YYYY-MM-DD) to restrict records to a specific time window. The media parameter filters by file or content type; omitting it returns all types. sort controls result ordering, and max_results caps the response at between 1 and 100 records.
Coverage scope
Intelligence X indexes content from sources that are often excluded from conventional search: Tor and I2P sites, paste services, data breach dumps, and archived public web content. This makes the search endpoint particularly relevant for OSINT investigations, credential exposure monitoring, and domain or IP footprint analysis. Selector support is broad — Bitcoin addresses let analysts trace wallet references across indexed documents, while CIDR ranges allow network-level lookups.
The Intelx API is a managed, monitored endpoint for intelx.io — not a raw scraper you maintain. Every endpoint is automatically health-checked on a schedule, and when intelx.io changes and a check fails, the API is automatically queued for repair and re-verified. It is built to keep working as the site underneath it changes.
This isn't an official intelx.io API — it's an independent, maintained REST wrapper over public data. Where the source has no official API (or only a limited one), Parse gives you a stable contract over a source that never promised one, and keeps it current. Need a new endpoint or field? You can revise it yourself in plain English and the agent rebuilds it against the live site in minutes — contributing the change back to the shared API is free.
Will this API break when the source site changes?+
Is this an official API from the source site?+
Can I fix or extend this API myself if I need a new endpoint or field?+
What happens if I call an endpoint that has an issue?+
- Check whether a corporate domain appears in indexed data leak or breach documents
- Look up whether a specific email address is referenced in paste sites or darknet content
- Trace Bitcoin wallet addresses mentioned across indexed dark web and leak datasets
- Scope the exposure footprint of an IP range using CIDR-based queries
- Identify indexed paste or leak records referencing a specific URL or subdomain
- Monitor when new records matching a keyword or selector appear in the Intelligence X index
- Filter data leak records by date range to investigate incidents within a known time window
| Tier | Price | Credits/month | Rate limit |
|---|---|---|---|
| Free | $0/mo | 200 | 5 req/min |
| Hobby | $30/mo | 1,000 | 20 req/min |
| Developer | $100/mo | 5,000 | 100 req/min |
| Team | $300/mo | 20,000 | 300 req/min |
| Company | $1,000/mo | 100,000 | 500 req/min |
Each endpoint has a fixed posted price per successful call — most fall between 1 and 10 credits — shown on this API's page before you run it. Exceeding the rate limit returns a 429 response. Authenticate with the X-API-Key header.
Does Intelligence X have an official developer API?+
What does the search response actually contain — does it return document content or just metadata?+
search endpoint returns metadata only: document name, date, media type, source bucket, and the record identifiers. It does not return the full text or binary content of matched documents. The total_found field tells you how many records matched, and status confirms whether the result set is complete.Is there a way to retrieve the actual content of a matched document?+
Are there limitations on what selectors the search endpoint recognizes?+
term parameter accepts domains, URLs, email addresses, IPs, CIDR ranges, Bitcoin addresses, and free-text keywords. Selector types outside this list (for example, phone numbers or cryptocurrency addresses for chains other than Bitcoin) are not formally supported, and results for unsupported formats may be empty. You can fork the API on Parse and revise it to add explicit support for additional selector types.How fresh is the data returned by the search endpoint?+
date_from and date_to filter parameters let you narrow results to a known time window, but the API does not expose an index-lag or last-crawled field for individual records.