API Overview

Base URL

https://developer.encrata.com

Authentication

https://developer.encrata.com is API-key only. A dashboard session is not a credential here. Every endpoint below authenticates with your enc_ API key:

Authorization: Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Only GET /api/health is public.

Endpoints

Lookups

Method	Path	Description
`POST`	`/api/lookup/email/validity`	Email validity (deliverability)
`POST`	`/api/lookup/email/identity`	Person behind an email
`POST`	`/api/lookup/email/breaches`	Email breach check
`POST`	`/api/lookup/email/breaches/check`	Breached yes/no
`POST`	`/api/lookup/email/gender`	Gender & country from an email
`POST`	`/api/lookup/email/compliance`	Cold-email jurisdiction & rule
`POST`	`/api/lookup/email/password/breaches`	Password breach check
`POST`	`/api/lookup/breaches/github`	Scan a GitHub repo for leaked secrets
`GET`	`/api/lookup/breaches/github/{id}`	Read a stored GitHub scan
`POST`	`/api/lookup/breaches/exposed-keys`	Scan collected text for exposed credentials
`GET`	`/api/lookup/breaches/exposed-keys/{id}`	Read a stored exposed-key scan
`POST`	`/api/lookup/malware/scan`	Scan a URL, QR code, barcode, image, or file

Bulk jobs

Method	Path	Description
`POST`	`/api/jobs/bulk`	Run any lookup on a list (`type` = `validity`, `identity`, `email-breaches`, `gender`, `password-breaches`)
`GET`	`/api/jobs/exports/download`	Download a finished job’s result file

The result is delivered by webhook - see Bulk Operations.

API keys & credits

Method	Path	Description
`GET`	`/api/account/keys`	List API keys
`POST`	`/api/account/keys`	Create API key
`PUT`	`/api/account/keys`	Rename API key
`PATCH`	`/api/account/keys`	Enable or disable API key
`DELETE`	`/api/account/keys`	Revoke or delete API key
`GET`	`/api/account/keys/reveal`	Re-read a revealable key’s full value
`POST`	`/api/account/keys/limit`	Set API key credit limit
`GET`	`/api/account/credits`	Remaining credit balance

Workspaces

Method	Path	Description
`GET`, `POST`, `PUT`, `DELETE`	`/api/workspaces`	Manage workspaces
`PUT`	`/api/workspaces/switch`	Switch the active workspace
`GET`, `POST`, `PUT`, `DELETE`	`/api/workspaces/members`	Manage members

See the Workspaces guide.

Webhooks

Method	Path	Description
`GET`	`/api/webhooks`	List webhooks
`GET`	`/api/webhooks/{id}`	Get one webhook, with its signing secret
`POST`	`/api/webhooks`	Create webhook
`PUT`	`/api/webhooks`	Update webhook
`DELETE`	`/api/webhooks/{id}`	Delete webhook
`POST`	`/api/webhooks/test`	Send a test event
`GET`	`/api/webhooks/deliveries`	List webhook deliveries

System

Method	Path	Auth	Description
`GET`	`/api/health`	None	Health check

Rate limits

Lookup requests are limited per account at a default of 200 per minute. Lookup responses carry X-Ratelimit-Limit, X-Ratelimit-Remaining, and X-Ratelimit-Reset. The reset value is the number of seconds until the window resets. Account and health routes do not return these headers. A 429 Too Many Requests response doesn’t include Retry-After. Wait X-Ratelimit-Reset seconds instead. See Rate limits for the current limit, the response headers, and retry guidance.

Response format

All endpoints return JSON, but the error shape is not uniform. Match on the HTTP status code first, then read whichever of these is present.

Email lookups
Enveloped routes
Account routes
Bulk jobs
Unknown route

/api/lookup/email/validity, /identity, /gender, /breaches, and /password/breaches return a flat body with a machine-readable code:

{ "code": "bad_request", "error": "Invalid email address" }

/api/lookup/email/compliance, /api/lookup/breaches/github, /api/lookup/breaches/exposed-keys, /api/lookup/malware/scan, and the webhook routes return an envelope on every response, including validation errors:

{
  "success": false,
  "result": { "code": "bad_request" },
  "message": "That doesn't look like a valid email address. Please check it and try again."
}

On success, the payload is in result.

/api/account/* returns the shared envelope plus a legacy error key:

{
  "success": false,
  "result": { "code": "not_found" },
  "message": "API key not found",
  "request_id": "req_7f3a9c21",
  "error": "API key not found"
}

Bulk job validation errors return a bare error object:

{
  "error": "type must be one of: validity, identity, email-breaches, gender, password-breaches"
}

Routes that are not exposed on the developer host return:

{
  "success": false,
  "result": { "code": "not_found" },
  "message": "That endpoint is not available on the developer API. See the docs for the endpoints this host exposes.",
  "request_id": "..."
}

A 429 is the one exception and always returns:

{ "error": "Rate limit exceeded. Please try again later." }

Credits

Most lookups cost 1 credit. Email Identity and the full email lookup cost 1,000 credits each. GitHub leak scans are billed per finding, so a clean scan is free. Repeat lookups of the same input are free during the 6-month free-repeat window. See Credits for the full breakdown.

Overview

Email

Breaches

Malware

API Keys

Webhooks

Account

Base URL

Authentication

Endpoints

Lookups

Bulk jobs

API keys & credits

Workspaces

Webhooks

System

Rate limits

Response format

Credits

​Base URL

​Authentication

​Endpoints

​Lookups

​Bulk jobs

​API keys & credits

​Workspaces

​Webhooks

​System

​Rate limits

​Response format

​Credits

Base URL

Authentication

Endpoints

Lookups

Bulk jobs

API keys & credits

Workspaces

Webhooks

System

Rate limits

Response format

Credits