Response Fields

The Lookup API returns a rich profile object across identity, work, education, social, company, and security categories. You can request specific fields using the fields parameter, or omit it to get everything.

In the Sandbox, hover over any field name to see a short description. This page provides the full reference.

How field selection works

Pass a fields array in your request body to receive only the data you need. This reduces response size and speeds up processing.

{
  "email": "satya@microsoft.com",
  "fields": ["first_name", "last_name", "company", "job_role", "breach_info"]
}

If fields is omitted or empty, all fields are returned.

Data sources

Encrata aggregates data from multiple sources in a single API call:

Source	Fields powered	Description
Profile Enrichment	Name, bio, company, job role, education, `company_info`	Structured profile data aggregated from multiple public sources
Professional Networks	Name, job role, company, industry, socials, education	Professional profile enrichment
Email Validity	`validity`	Real-time mailbox verification
Breach Database	`breach_info`	Breach history from breach databases
Account Detection	`registered_services`	Probes 219+ platforms to detect where the email is registered

Person fields

Core identity and demographic data about the person.

Field	Type	Description	Example
`first_name`	string	Person’s first/given name	`"Satya"`
`middle_name`	string	Middle name, if available	`"Narayana"`
`last_name`	string	Last/family name	`"Nadella"`
`age`	string	Estimated age (derived from public records)	`"57"`
`gender`	string	Gender `Male`, `Female`, or empty if unknown	`"Male"`
`ethnicity`	string	Predicted ethnic background	`"South Asian"`
`nationality`	string	Country of citizenship	`"American"`
`country`	string	Country where the person is currently based	`"United States"`
`city`	string	City where the person is currently based	`"Redmond"`
`birthplace`	string	City/country where the person was born	`"Hyderabad, India"`
`current_location`	string	Full current location string	`"Redmond, WA, US"`
`bio`	string	Short biography or description	`"Chairman and CEO of Microsoft..."`
`photo_url`	string	URL to the person’s profile photo	`"https://..."`
`interests`	string	Known hobbies, interests, or topics (comma-separated)	`"Cloud Computing, AI, Cricket"`

Work fields

Professional and career information.

Field	Type	Description	Example
`company`	string	Current employer or company name	`"Microsoft"`
`job_role`	string	Current job title or position	`"Chairman and CEO of Microsoft"`
`industry`	string	Industry sector	`"Technology"`
`website`	string	Personal website or portfolio URL	`"https://microsoft.com"`

Education fields

Academic background.

Field	Type	Description	Example
`education`	string	Comma-separated list of institutions attended	`"University of Wisconsin-Milwaukee, Manipal Institute of Technology"`
`education_level`	string	Highest education level achieved	`"Master's"`
`university`	string	Primary university or college	`"University of Wisconsin-Milwaukee"`
`field_of_study`	string	Major or area of study	`"Computer Science"`

Links to social media profiles. These are nested at person.socials.<field>. There are no top-level social fields. Empty string if not found.

Field	Type	Description	Example
`person.socials.linkedin`	string	LinkedIn profile URL	`"https://linkedin.com/in/satyanadella"`
`person.socials.twitter`	string	Twitter/X profile URL	`"https://twitter.com/satyanadella"`
`person.socials.instagram`	string	Instagram profile URL	`""`
`person.socials.facebook`	string	Facebook profile URL	`""`
`person.socials.github`	string	GitHub profile URL	`""`

Company fields

Structured data about the person’s employer, nested at person.company_info.<field>. There are no flat company_* fields.

Field	Type	Description	Example
`person.company_info.name`	string	Official registered company name	`"Microsoft Corporation"`
`person.company_info.phone`	string	Company phone number	`"+1-425-882-8080"`
`person.company_info.address`	string	Company physical address	`"One Microsoft Way, Redmond, WA 98052"`
`person.company_info.website`	string	Company website URL	`"https://microsoft.com"`
`person.company_info.category`	string	Business category classification	`"Technology company"`
`person.company_info.rating`	number	Average star rating (1.0-5.0)	`4.1`
`person.company_info.rating_count`	integer	Total number of reviews	`25000`
`person.company_info.price_level`	string	Price level indicator	`"$$"`
`person.company_info.latitude`	number	Company HQ latitude coordinate	`47.6396`
`person.company_info.longitude`	number	Company HQ longitude coordinate	`-122.1283`
`person.company_info.attributes`	object	Key-value pairs with extra info	`{"Founded": "1975"}`

Security fields

Email security, breach exposure, and account detection.

`validity`

Email deliverability status. Returns a single string value.

Value	Meaning
`valid`	Mailbox exists and accepts mail
`invalid`	Mailbox does not exist or rejects mail
`catch-all`	Domain accepts any address; existence is unconfirmed
`risky`	Ambiguous or temporary - the provider produced no verifiable result

`breach_info`

Data breach history from aggregated breach databases. Returns an object.

Sub-field	Type	Description
`breach_count`	integer	Total number of breaches the email appears in
`services`	array	List of breached services (`name`, `domain`, `breach_date`, `data_types`)
`interests`	array	Inferred interest categories based on breach sources (e.g., Gaming sites → `{"category": "Gaming", "signal": 3}`)
`exposed_data`	array	All unique data types leaked across all breaches (e.g., `["Passwords", "Email addresses", "IP addresses"]`)

Each item in services:

Sub-field	Type	Description
`name`	string	Breach name (e.g., “LinkedIn”, “Adobe”)
`domain`	string	Domain of the breached service
`breach_date`	string	Date the breach occurred
`data_types`	array	Types of data exposed in this specific breach

`registered_services`

Detects which online services the email is registered on by probing login, registration, and password-reset flows across 219+ platforms (GitHub, Spotify, Netflix, Adobe, etc.).

Sub-field	Type	Description
`total_checked`	integer	Number of platforms probed
`registered_count`	integer	Number of platforms where the email is registered
`services`	array	Registered services as objects, each `{ name }` plus optional `recovery_email` and `recovery_phone`. Not a list of plain strings

Recovery data (partial emails/phones like s***a@outlook.com or +1***456) may be exposed by platforms during password reset flows. This is public information but should be handled carefully.

Dedicated endpoint responses

The fields above describe the full identity lookup (POST /api/lookup/email/identity), which returns everything in one call. Encrata also exposes focused, single-purpose endpoints that return only their own compact response. Use these when you need one signal quickly and cheaply. Each endpoint’s full response schema lives on its reference page, linked below.

Endpoint	Route	Returns
Email Validity	`POST /api/lookup/email/validity`	Deliverability verdict plus domain and MX enrichment
Email Gender	`POST /api/lookup/email/gender`	Likely gender and country behind an address
Email Breaches	`POST /api/lookup/email/breaches`	Breach exposure for the address
Email Compliance	`POST /api/lookup/email/compliance`	Send-legality guidance and applicable laws
Password Breaches	`POST /api/lookup/email/password/breaches`	Whether a password appears in known breaches (k-anonymity)
GitHub Leaks	`POST /api/lookup/breaches/github`	Secrets leaked in a public GitHub repository

Every endpoint bills 1 credit on the first lookup of an address, then serves free repeats within the charge window. credits reports what the call actually billed (0 on a free repeat). cached is a separate performance signal: a cached result is still billed on your first lookup of that address.

Email Validity

POST /api/lookup/email/validity verifies whether an address can receive mail and enriches the domain behind it.

Field	Type	Description	Example
`email`	string	The queried address	`"satya@microsoft.com"`
`status`	string	Deliverability verdict: `valid`, `invalid`, `catch-all`, `risky`	`"valid"`
`reason`	string	Why that verdict was reached	`"deliverable"`
`disposable`	boolean	True for throwaway / temporary providers	`false`
`confidence`	string	Confidence in the verdict	`"high"`
`role`	boolean	True if a role address (info@, support@)	`false`
`role_name`	string	The matched role, if any	`"support"`
`did_you_mean`	string	Suggested correction for a likely typo	`"user@gmail.com"`
`free_provider`	boolean	True for free consumer mailboxes (Gmail, Outlook)	`false`
`domain`	string	Domain portion of the address	`"microsoft.com"`
`provider`	string	Mailbox provider	`"microsoft"`
`mx`	array	MX hostnames serving the domain	`["mx.microsoft.com"]`
`canonical`	string	Canonicalized address (Gmail dot/plus normalization)	`"satya@microsoft.com"`
`provider_answered`	boolean	True when the mailbox provider itself answered the probe	`true`
`domain_trust`	object	Email-authentication posture: `grade`, `spf`, `dkim`, `dmarc`, `mta_sts`, `tls_rpt`, `bimi`, `dnssec`. Not domain age or reputation
`person_signal`	object	OSINT corroboration: `{ count, sources }`
`smtp`	object	Raw SMTP probe result
`domain_info`	object	Domain registration / DNS posture (enrichment)
`mail_servers`	array	Per-MX infrastructure + TLS detail (enrichment)
`footprint`	object	Identity footprint across public sources (enrichment)
`checked_at`	string	Timestamp the verdict was produced	`"2026-09-28T10:12:00Z"`
`message`	string	Human-readable summary of the verdict	`"Mailbox exists and accepts email"`
`validity`	string	Deprecated alias of `status`, kept for older clients	`"valid"`
`credits`	integer	Credits billed (0 on a free repeat)	`1`
`cached`	boolean	True if the deliverability verdict was served from cache. Omitted when false	`true`

validity is also returned as a top-level alias of status for backward compatibility with older clients.

Email Gender

POST /api/lookup/email/gender infers the most likely gender and country behind an address.

Field	Type	Description	Example
`email`	string	The queried address	`"satya@microsoft.com"`
`name`	string	Name extracted from the address	`"Satya"`
`gender`	string	`male`, `female`, or `unknown`	`"male"`
`country`	string \| null	ISO alpha-2 country code, or `null` if unknown	`"US"`
`probability`	integer	Confidence in the prediction, 0-100	`98`
`credits`	integer	Credits billed (0 on a free repeat)	`1`
`cached`	boolean	True if served from cache. Omitted when false	`true`

Email Breaches

POST /api/lookup/email/breaches returns the breach exposure (HIBP) for an address.

Field	Type	Description
`email`	string	The queried address
`breached`	boolean	True if the email appears in 1 or more breaches
`breach_info`	object	Full breach detail (same shape as the `breach_info` field above)
`credits`	integer	Credits billed (0 on a free repeat)

breach_info object:

Sub-field	Type	Description
`breach_count`	integer	Number of breaches the email appears in
`services`	array	Breached services (`name`, plus `domain`, `breach_date`, `data_types` when known)
`exposed_data`	array	Unique data types leaked across all breaches. Omitted when empty
`interests`	array	Interest categories inferred from breach sources

Email Compliance

POST /api/lookup/email/compliance tells you whether it is legally safe to email an address and which laws apply.

Field	Type	Description	Example
`email`	string	The queried address	`"satya@microsoft.com"`
`country`	string	Inferred country of the recipient	`"United States"`
`country_code`	string	ISO alpha-2 country code	`"US"`
`email_type`	string	`consumer` or `business`	`"business"`
`recommendation_code`	string	Machine-readable verdict code	`"allowed_with_conditions"`
`recommendation`	string	Human-readable send guidance	`"Permitted with a working opt-out"`
`main_laws`	array	Governing laws that apply	`["CAN-SPAM"]`
`law_reference_urls`	array	Links to the referenced laws
`main_restrictions`	array	Key restrictions you must honor	`["Include an opt-out link"]`
`applicability`	string	How the guidance applies
`confidence`	string	Confidence in the country inference: `confident`, `medium`, or `unknown`	`"confident"`
`jurisdictions_applicable`	array	All jurisdictions that may apply	`["US", "EU"]`
`possible_travel`	array	Other jurisdictions the recipient may fall under
`signals`	object	Consolidated check summary: `points`, `max_points`, `checks`, `latency_ms`
`checking`	boolean	True while a background check is still running	`false`
`result_id`	integer	Row id; the background check finalises this result
`credits`	integer	Credits billed (0 on a free repeat)	`1`

checking and result_id are omitted when they are false / 0, so a settled verdict has neither key. While checking is true the verdict is provisional - repeat the request to get the settled one. The repeat is free within the billing window. There is no webhook event for this.

Password Breaches

POST /api/lookup/email/password/breaches checks whether a password appears in known breaches using HIBP k-anonymity. The plaintext password is never sent; only the first 5 characters of its SHA-1 hash leave the server.

Field	Type	Description	Example
`prefix`	string	The 5-char SHA-1 hash prefix used for the k-anonymity query	`"5BAA6"`
`found`	boolean	True if the password appears in any known breach	`true`
`count`	integer	How many times the password has been seen across breaches	`52372427`
`message`	string	Human-readable summary of the verdict	`"This password has appeared in known breaches."`
`credits`	integer	Credits billed (0 on a free repeat)	`1`

GitHub Leaks

POST /api/lookup/breaches/github scans a public GitHub repository for leaked secrets. Returns the { success, result, message } envelope, with the fields below inside result.

Field	Type	Description
`scan_id`	string	The scan’s id; poll the result with `GET /api/lookup/breaches/github/{id}`
`repository_id`	string	Encrata’s stable id for the scanned repository
`target`	string	The normalized repository URL that was scanned
`kind`	string	The scan family (e.g. `github`)
`type`	integer	The detection profile that ran (`0`, `1`, or `2`)
`depth`	integer	The history depth that was applied
`config`	object	The effective configuration, after defaults
`commit_sha`	string	The repository state these findings describe
`status`	string	`processing`, `succeeded`, or `failed`
`findings`	array	Detected secrets. Each finding never contains the raw credential
`summary`	object	Roll-up: `total`, `by_severity`, `by_engine`, `engines_run`, `rules_requested`, `head_sha`, `deep_scan`, `duration_ms`, `suppressed`, `truncated`
`reused`	boolean	An existing scan of this repository state answered the request
`charged`	boolean	Whether the request debited the account
`credits`	integer	Credits debited: 1 per leak found, `0` on a clean or reused scan

Each item in findings:

Sub-field	Type	Description
`fingerprint`	string	Stable identifier for the finding, used to deduplicate and build a baseline
`rule_id`	string	The detection rule that matched (e.g. `aws-access-key-id`)
`severity`	string	`critical`, `high`, `medium`, `low`, or `unknown`
`severity_source`	string	Where the severity came from
`engines`	array	The detection engines that produced this finding
`file`	string	Path to the file containing the secret
`start_line`	integer	1-based line where the match starts
`end_line`	integer	1-based line where the match ends
`column`	integer	1-based column of the match
`entropy`	number	Shannon entropy of the matched string
`tags`	array	Rule tags, for triage routing
`preview`	string	Masked preview of the match (e.g. `AKIA****************`)
`commit`	string	The commit SHA. A string, with sibling `author`, `email`, and `date` strings
`likely_false_positive`	boolean	Whether the finding is flagged as a likely false positive

A GitHub Leaks scan with zero findings is a success, not an error, and is free. Scans are always asynchronous: a new scan returns 202 with status: "processing", and you poll GET /api/lookup/breaches/github/{id} for the findings.

Response structure

The full API response wraps fields inside the person object:

{
  "email": "satya@microsoft.com",
  "person": {
    "first_name": "Satya",
    "last_name": "Nadella",
    "validity": "valid",
    "company": "Microsoft",
    "job_role": "Chairman and CEO of Microsoft",
    "socials": {
      "linkedin": "https://linkedin.com/in/satyanadella",
      "twitter": "https://twitter.com/satyanadella"
    },
    "company_info": {
      "name": "Microsoft Corporation",
      "rating": 4.1,
      "category": "Technology company"
    },
    "breach_info": {
      "breach_count": 2,
      "services": [{"name": "LinkedIn", "domain": "linkedin.com", "breach_date": "2012-05-05"}],
      "exposed_data": ["Email addresses", "Passwords"]
    },
    "registered_services": {
      "total_checked": 219,
      "registered_count": 8,
      "services": [{"name": "GitHub"}, {"name": "Spotify"}]
    }
  },
  "files": {
    "json": "/api/files/satya_at_microsoft_com.json",
    "csv": "/api/files/satya_at_microsoft_com.csv"
  }
}

Most person fields are serialized even when empty: expect "" for unresolved strings and null for unresolved lists. Check for a truthy value rather than for the key’s presence.

Overview

Email

Breaches

Workflows

API Keys

Webhooks

Account

Response Fields

How field selection works

Data sources

Person fields

Work fields

Education fields

Company fields

Security fields

`validity`

`breach_info`

`registered_services`

Dedicated endpoint responses

Email Validity

Email Gender

Email Breaches

Email Compliance

Password Breaches

GitHub Leaks

Response structure

​How field selection works

​Data sources

​Person fields

​Work fields

​Education fields

​Social fields

​Company fields

​Security fields

​validity

​breach_info

​registered_services

​Dedicated endpoint responses

​Email Validity

​Email Gender

​Email Breaches

​Email Compliance

​Password Breaches

​GitHub Leaks

​Response structure

How field selection works

Data sources

Person fields

Work fields

Education fields

Social fields

Company fields

Security fields

`validity`

`breach_info`

`registered_services`

Dedicated endpoint responses

Email Validity

Email Gender

Email Breaches

Email Compliance

Password Breaches

GitHub Leaks

Response structure