A curated, categorized directory of hundreds of REST and unofficial APIs covering phone numbers, domains, leaks, geolocation and social media, designed to accelerate authorized OSINT research and defensive threat intelligence work.
| Tool | cipher387/API-s-for-OSINT — a community-maintained awesome-list cataloging APIs for automating OSINT tasks across dozens of categories |
| Category | OSINT resource directory / awesome list |
| Primary Use | Finding and comparing APIs for phone lookup, Domain/DNS/IP enrichment, Whois, GEO IP, Pastebin/Leaks, Social Media and Vulnerabilities research in authorized investigations |
| Safe Use | Reference material for authorized security assessments, fraud investigations, due-diligence research and defensive threat intelligence; every listed service must be used within its own terms of service and applicable privacy law |
| Telemetry Note | As a documentation repository it generates no telemetry itself; however, each third-party API it links logs your queries against your registered API key, creating an audit trail on the provider side that investigators should account for |
Most OSINT practitioners hit the same wall eventually: the data exists, but it is scattered across hundreds of providers, each with its own pricing, rate limits and authentication model. cipher387/API-s-for-OSINT attacks that problem directly. It is not a tool you install but a rigorously organized catalog — an awesome-list in the classic sense — that maps the public API landscape for investigative work, currently sitting at roughly 2,600 stars and licensed under CC0-1.0, which means the compilation itself is free to reuse in any internal wiki or training material.
The structure of the repository is its real value. Rather than dumping links alphabetically, the maintainer has segmented the catalog into more than thirty functional categories visible in the table of contents: IOT/IP Search engines, Universal OSINT APIs, Phone Number Lookup and Verification, Address/ZIP codes lookup, Domain/DNS/IP lookup, Whois, GEO IP, Pastebin/Leaks, Face Search and detection, AI Geolocation, Darknet, and Vulnerabilities, among many others. Each entry is a table row carrying the service name, a documentation link, a short description and — crucially — a price column. That pricing column is what elevates this from a link dump to a decision-support resource: you can see at a glance whether a capability is FREE, Partly FREE, or metered at, say, $0.01 per request.
The IOT/IP Search engines section is a good illustration of the depth on offer. It lists Shodan, Netlas.io, Fofa.info, Censys.io, Hunter.how and Fullhunt.io side by side, each described as a search engine for internet-connected hosts and devices. For a defender building external attack-surface monitoring into a workflow, this single table effectively constitutes a vendor comparison sheet. Supplementary enrichment sources like IPQuery.io and IPLocate.io — which surface IP risk, geolocation, ASN details, and proxy/VPN/Tor detection — extend the section beyond raw device discovery into reputation intelligence.
The Universal OSINT APIs category is comparatively new territory. Here the list covers aggregated lookup services such as Social Links, which the README describes as handling email and phone info lookup, individual and company profiling, social media tracking and dark web monitoring, priced per request. Another entry, Opsis, is documented as searching over 1,000 modules and returning structured JSON with streaming progress. These aggregator APIs matter operationally because they collapse dozens of point queries into a single programmatic call — a significant factor when you are pivoting from an email address to a constellation of registered accounts during an authorized fraud investigation.
Identity-adjacent categories round out the human-intelligence side. Phone Number Lookup and Verification lists Numverify (232 countries, 250 free requests), Twilio's lookup API, Plivo, GetContact and Veriphone, all oriented toward carrier and number-type validation. People and documents verification catalogs KYC-grade services such as Onfido and Appruve, which the README positions for document and biometric verification across jurisdictions including Africa and India. These are clearly aimed at compliance and fraud teams rather than red-team recon, and their inclusion signals that the maintainer's definition of OSINT spans due diligence, not just security research.
For readers of an offensive-security publication, the most practically relevant sections are probably Domain/DNS/IP lookup, Whois, Network, Vulnerabilities and Pastebin/Leaks. The catalog also includes specialized categories that experienced investigators will appreciate: Wi-fi lookup, Hashes decrypt/encrypt, Crypto, Reverse Image Search, AI Geolocation, Torrents/file sharing, Flights, Webcams, and even Curl converters — tools that translate curl command lines into code for whatever language your automation is written in. The breadth is the point: whatever the pivot point in your investigation, there is almost certainly a listed API that touches it.
Two meta-categories deserve attention because they reflect the maturity of the ecosystem the list documents. API testing tools, Create your own API and Distribute your own API turn the catalog from a consumer resource into a producer's handbook — useful for teams that end up wrapping multiple upstream sources behind an internal service. The API Keys Info section is a pragmatic touch; key management across dozens of providers is a real operational burden, and acknowledging it in the table of contents suggests the maintainer has actually built with these services rather than just collecting links.
It is worth being candid about what this repository is not. It ships no code, performs no queries itself, and — as the truncated table sections show — depends on continuous community curation to stay accurate, since API pricing and availability drift constantly. The README's Contributing section exists precisely for that reason. There is also a promotional placement for OneQuery API by UserSearch at the top of the page, which is commercial sponsorship rather than editorial selection; treat that entry with the same vendor skepticism you would apply to any advertised product.
From a defensive and professional-ethics standpoint, the catalog is best treated as a capability map. Blue-team and threat-intelligence teams can use it to understand which data dimensions an adversary can cheaply query — if IPLocate.io offers Tor-exit detection, assume attackers chain proxies with the same ease. Investigators doing authorized fraud or missing-persons work benefit most directly, provided they respect each provider's terms of service and the data-protection law governing personal data in their jurisdiction; several listed services handle regulated identity information, and the CC0 license on the list confers no legal cover for misuse of the underlying data.
There is also an operational-security angle worth stating plainly: every API in this catalog is keyed and logged. When you query Censys.io or Social Links during an investigation, the provider sees your target, your timestamp and your account. OpSec-conscious practitioners maintain separate investigative identities and read each provider's retention policy before touching sensitive subjects. The repository itself, being plain markdown on GitHub, leaves only the faintest trace — a git clone and a local read — making it a low-signature reference compared to browsing dozens of provider sites individually.
Integrating the catalog into a workflow is trivial: git clone https://github.com/cipher387/API-s-for-OSINT gives you the full markdown locally, where the tables can be parsed or converted into an internal portal. Teams that maintain their own tooling wikis can fork freely under the CC0-1.0 license. The main maintenance burden is verification — spot-check the links and prices for the categories you rely on before committing them to a client engagement, because stale entries are the failure mode of every awesome-list.
As a snapshot of the 2026 OSINT automation landscape, API-s-for-OSINT is one of the more complete maps available. It compresses weeks of vendor research into a scannable set of tables, prices included, and its category taxonomy alone is a useful mental model for structuring an investigation program. For authorized professionals — fraud analysts, threat-intelligence teams, due-diligence researchers — it is a bookmark that earns its place; for anyone tempted toward unconsented surveillance of individuals, it is a reminder that capability and permission are different things, and only the pairing of the two constitutes legitimate tradecraft.
cipher387/API-s-for-OSINT.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.