> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oathnet.org/llms.txt
> Use this file to discover all available pages before exploring further.

# OSINT Lookups Guide

> Use point lookups to enrich identities, domains, emails, and network indicators

## What OSINT Lookups Are

OSINT lookups are quick enrichment calls for a single indicator. They are best
when you already have one identifier from a breach, stealer log, scanner alert,
or manual investigation and want surrounding context.

Use them to answer questions like:

* who owns this Discord, Steam, Xbox, Roblox, Google, or Minecraft account?
* has this email appeared on common signup surfaces?
* what network, country, ISP, or risk flags are tied to this IP?
* what subdomains are visible for a domain, and which ones are alive?

<Note>
  Use this page for meaning and workflow guidance. Use the generated OpenAPI
  reference for exact parameters, schemas, enums, and playground requests.
</Note>

## Lookup Families

| Lookup                   | Input                         | What it helps explain                                                              |
| ------------------------ | ----------------------------- | ---------------------------------------------------------------------------------- |
| IP info                  | IP address                    | Location, ISP, ASN, mobile/proxy/hosting signals, and reverse DNS                  |
| Steam                    | Steam64 ID or custom URL name | Public Steam identity, avatar, and raw profile metadata                            |
| Xbox                     | Gamertag or XUID              | Xbox identity, avatar, gamer score, account tier, and related profile metadata     |
| Discord user info        | Discord snowflake ID          | Username, global name, avatar, banner, creation date, and badges                   |
| Discord username history | Discord snowflake ID          | Prior usernames and the timestamps returned by the upstream source                 |
| Roblox user info         | Roblox user ID or username    | Roblox identity, display name, old usernames, join date, avatar, and Discord hints |
| Holehe                   | Email address                 | Which common services appear to have an account for the email                      |
| GHunt                    | Gmail address                 | Public Google profile details when the upstream source can resolve them            |
| Subdomain extraction     | Domain                        | Known subdomains and optional live-check details                                   |
| Minecraft history        | Minecraft username            | Historical Minecraft names                                                         |

## Response Shape

Most OSINT lookups use the standard API envelope:

```json theme={null}
{
  "success": true,
  "message": "Request completed successfully",
  "data": {},
  "lookups_left": 999,
  "search_session": {
    "id": "sess_abc123"
  }
}
```

The important part is `data`. Each provider returns a different shape because
each source exposes different evidence. For example, IP info has geographic and
network fields, Discord has profile fields, and subdomain extraction can return
either plain host strings or objects with live-check metadata.

## Search Sessions

Pass `search_id` when the lookup belongs to an existing investigation. This
keeps related breach, stealer, victim, and OSINT calls grouped together and can
avoid spending extra lookups for the same investigation context.

```bash theme={null}
curl -G "https://oathnet.org/api/service/discord-userinfo" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "discord_id=300760994454437890" \
  --data-urlencode "search_id=sess_abc123"
```

## Identity Enrichment Flow

A common flow starts from a Discord ID found in breach or stealer data:

1. Call Discord user info to confirm the visible account.
2. Call Discord username history to see prior names.
3. If you already have a Roblox ID or username from another source, call Roblox user info for profile details.

```python theme={null}
import requests

headers = {"x-api-key": "YOUR_API_KEY"}
discord_id = "300760994454437890"

discord = requests.get(
    "https://oathnet.org/api/service/discord-userinfo",
    params={"discord_id": discord_id},
    headers=headers,
).json()

history = requests.get(
    "https://oathnet.org/api/service/discord-username-history",
    params={"discord_id": discord_id},
    headers=headers,
).json()

print(discord["data"].get("username"))
for entry in history["data"].get("history", []):
    print(entry.get("name"), entry.get("time"))
```

## Email Enrichment Flow

For Gmail addresses, GHunt can return public Google profile data when available.
For any email address, Holehe helps identify where that address may have signup
presence.

```bash theme={null}
curl -G "https://oathnet.org/api/service/ghunt" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "email=user@gmail.com"

curl -G "https://oathnet.org/api/service/holehe" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "email=user@gmail.com"
```

GHunt responses use a nested provider shape. In SDKs and raw JSON, expect
profile details under `data.data.profile`, with provider errors surfaced
separately when present.

## Domain Enrichment Flow

Subdomain extraction helps turn a root domain into concrete hosts you can use
for stealer, breach, scanner, or asset-review workflows.

```bash theme={null}
curl -G "https://oathnet.org/api/service/extract-subdomain" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "domain=example.com" \
  --data-urlencode "is_alive=true"
```

When `is_alive=true`, subdomain entries may include metadata such as whether the
host appears reachable. Code should accept both plain string entries and object
entries.

## Provider Caveats

* OSINT providers can change response details without warning.
* Some lookups return partial data when a profile exists but a provider hides a field.
* External provider downtime may produce temporary lookup errors.
* Discord username-history entries can contain arrays for `name` and `time`.
* Roblox responses may include human-readable keys such as `Current Username`
  and `Display Name`.
* Use OpenAPI for exact current field names before building strict parsers.

<Card title="OpenAPI Reference" icon="code" href="/api-reference/overview">
  Check exact OSINT request and response schemas in the generated reference
</Card>