Inquire — Every answer keeps its receipt

Getting started

Inquire provides targeted OSINT for email, phone, Discord, IP, domain, username, Xbox Network, and PlayStation Network. Use the web console at inquire.sh, the REST API at https://api.inquire.sh, or the Telegram bot (optional).

Step 1Choose a plan and complete checkout

Step 2Create your email + password at checkout (or register a free account)

Step 3Sign in at /login

Step 4Search in the dashboard, or call https://api.inquire.sh/api/v1/search with your API key

Console login is email and password. API keys are for REST automation only — create or rotate them under Dashboard → API keys after you sign in.

Architecture

Split stack: Next.js frontend (inquire.sh), Python API on a dedicated VPS. Cloudflare sits in front of both the site and API for TLS, WAF, and bot filtering. Always call the API over HTTPS (https://api.inquire.sh) — plain HTTP redirects with 301.

Websitehttps://inquire.sh — Next.js console, docs, login

APIhttps://api.inquire.sh — Python REST (HTTPS only)

EdgeCloudflare — DDoS, WAF, Turnstile, TLS

BFFNext.js /api/* proxies session to backend with X-WolfEye-BFF

Telegram botOptional client; same API underneath

Quick check

# Use HTTPS. On Windows PowerShell use curl.exe (curl is an alias for Invoke-WebRequest).
curl.exe -s "https://api.inquire.sh/api/v1/health"
# → {"status":"ok","service":"wolfeye-api"}

External automation should call https://api.inquire.sh/api/v1/… with an API key. The web console uses session cookies and verifies Cloudflare Turnstile before each search.

Query modules

Each identifier type activates a dedicated pipeline. Queries are routed automatically by format detection, or pass module explicitly on the REST API. Dashboard deep links use the shorter m query parameter (for example /dashboard?view=console&m=inmate_search).

target@domain.com

BreachHub · Seekria · OpenArchive · Ithil · CoreSint · DataHound · OathNet · BreachVIP · SeekKnow · Syntrax · Godseye · IntelX · DeepScan · Local Breach · Horus · Account Recovery · Email Enrichment · Email to Profile · Snusbase · Minerva · SEON · LeakOSINT · AI OSINT · Auto Cascade

Phone

+39 333 1234567

DataHound · Horus · OathNet · LeakOSINT · Seekria · DeepScan · CoreSint · Phone Intel · Account Recovery · Partial Recovery · Shadow Partial · FiveM Link · Syntrax Phone · OpenArchive · Ithil · Local Breach · Snusbase · SEON

@username or 123456789

DeepScan · DataHound · Horus Telegram · Phone Intel · Seekria

Telegram ID

868984065792158 or @username

Telegram MTProto · BreachHub Telegram ID · NetSpy · DeepScan

Ruin.tf

username

Ruin.tf RPC

Doxbin

username

Doxbin Leak DB · Local Breach DB · Doxbin Live

Dox Search

First Last or nickname

Doxbin Leak DB · Local Breach DB · Doxbin Search

Fiscal Code

RSSMRA85M01H501Z

CF Decoder · Belfiore · Local Breach DB · OathNet · LeakOSINT · BreachVIP · SeekNow

VAT Search

12345678901 or DE123456789

VIES EU · VATComply · OpenAPI IT · Local Breach DB · OathNet · LeakOSINT

Business Search

Acme Srl or P.IVA

OpenCorporates · Companies House · OpenAPI IT · VIES · Local Breach DB · OathNet

Business

John Smith / email / phone / company

Business Breach DB · USA B2B · Local Breach · OpenCorporates

IBAN Intel

IT60X0542811101000000123456

OpenIBAN · IBAN Checksum · Local Breach DB · OathNet · LeakOSINT · BreachVIP

VIN Lookup

1HGCM82633A004352

NHTSA vPIC · VIN Decode

Tax ID Search

CF, P.IVA, EIN, VAT or IBAN

Auto-detect · VIES · OpenIBAN · CF Decoder · Local Breach DB · OathNet · LeakOSINT

Partial Recovery

email or +39...

Instagram · Battle.net · Epic · EA · Apple · Google · PayPal · Uber · Twitter/X

Phone → Email

+39 333 1234567

Amazon · Apple · Google · Microsoft · Twitter/X · WhatsApp · Telegram · PayPal

Email → Phone

target@domain.com

Amazon · Apple · Google · Microsoft · Twitter/X · PayPal · Steam · Epic

Email → LinkedIn

target@domain.com

Inmate Search

first name, last name

Federal BOP · VINELink · State DOC · County Jails · Mugshot archive · UK MoJ

Face Search

Upload photo

Yandex Reverse · Google Images · FaceCheck.id · InsightFace AI · Gemini Vision

Shadow Leak

email, phone or username

Shadow Partial DB · Local Breach DB

FiveM Hunter

username, steam, license, discord id

FiveM Link DB · CFX Dumps · EvoLife · MoonLife

Discord Grave

username, email or discord id

Discord Scrape DB · Local Breach DB

PayPal Trace

email, username or IP

PayPal Logs · Buycraft · Tebex

DoorDash

DoorDash Recovery

PayPal

PayPal Recovery

DataAvoid

DataAvoid Recovery

Stripe

merchant@email.com

Stripe Dashboard

Discord

123456789012345678

CordCat · BreachVIP · OathNet · Syntrax Discord ID · Inquire Discord · BreachHub Discord Pack · Seekria Discord · Discord Graveyard · FiveM Link · DataHound · GodsEye · OpenArchive · Local Breach DB · SeekKnow · IntelX · Ithil · LeakOSINT · CoreSint

192.168.1.1

OathNet · BreachVIP · Seekria · Local Breach DB · Syntrax IP · CoreSint · Shodan · SEON

Domain

example.com

DataHound · Seekria · Syntrax Domain

IntelX

domain, email or phone

IntelX Search

Folder

breach/subfolder

Folder Intel · Local Breach DB · Horus

Username

handle

DataHound · OathNet · LeakOSINT · BreachVIP · SeekKnow · Seekria · CSINT · CoreSint · Shadow Partial · FiveM Link · Discord Graveyard · PayPal Trace · Syntrax Username

GitHub

username or github.com/owner/repo

GitHub OSINT · Commit Scraper

Minecraft

Steve123

Seekria MC · Reconly · Local Breach DB · BreachVIP

FiveM

license:abc123 or username

Reconly FiveM · Local Breach DB · BreachVIP · Seekria

Xbox Network

MajorNelson or XUID

PlayerDB · xboxgamertag · TrueAchievements · BreachHub Xbox · Local Breach · CoreSint

PlayStation Network

OnlineId or psn:handle

PSNProfiles · TrueTrophies · BreachHub · Local Breach · CoreSint

Steam Lattice

7656119… or steamcommunity.com/id/…

Steam Community XML · BreachHub Steam · FiveM Link · Local Breach · CoreSint

Geolocation

Upload photo

EXIF GPS · OCR · Local Breach DB · Offline Geocoder · Satellite Map

Web console

Sign in with email and password. Overview shortcuts, streaming search, breach cards, intel tools (WolfLocate, Face Recon — coming soon, Inmate Search, Xbox Network, PlayStation Network, stealer logs, VIN, Business), history, tickets, and API keys for REST.

Dashboard/dashboard

Search (BFF)POST /api/search — body: { query, module?, horus?, stream?, turnstileToken }

Bot challengeCloudflare Turnstile on site entry + before each search

StreamingNDJSON stream for auto / email / Discord modules

Deep link/dashboard?view=console&m=<module-id>

Photo tools/dashboard?view=wolflocate (Geospy) · /dashboard?view=facedetect (Face Recon — coming soon)

API keysDashboard → API keys — for REST only, not console login

REST API

Base URL: https://api.inquire.sh

Authenticate with X-Api-Key header. Requires Pro, Ultra, or Owner plan. Device binding applies to dashboard login.

AuthX-Api-Key header (required for API calls)

Device bindX-Device-Id header (web console)

TurnstileBot protection on web console

FormatJSON — POST bodies application/json

QuotaPlan-based lookup limit (429 when exceeded)

CORSEnabled for inquire.sh and API subdomain

# Quick test
curl.exe -s "https://api.inquire.sh/api/v1/health"
curl.exe -s "https://api.inquire.sh/api/v1/status" -H "X-Api-Key: YOUR_API_KEY"

Security

Defense in depth: Edge protection (DDoS, OWASP WAF, bot filtering) plus strict origin controls. The database is never reachable over HTTP.

Edge protection

DDoSProtection against volumetric attacks

Bot Fight ModeBlocks automated abuse while allowing legitimate API clients

OWASP managed rulesSQLi, XSS, RCE probes blocked at edge

Custom WAFBlocks malicious path patterns and scanners

Rate limitsPer-IP and per-key rate limiting enforced

TunnelOrigin access restricted via edge headers

API origin

Origin protectionDirect IP access blocked without edge headers

Path whitelist/api/v1/* only — probes blocked

Rate limitsPer-IP and per-API-key rate limiting

Auth hardeningConstant-time key validation

Injection filterSQLi/XSS patterns in query/path rejected

Scanner blockKnown scanner User-Agents denied

Payload capMaximum POST body size enforced

HeadersHSTS, nosniff, frame protection, no-store

Key transportX-Api-Key header required

Web console

TurnstileBot protection on entry and sensitive actions

MiddlewareSecurity headers on all pages + API routes

Edge rate limitsPer-IP rate limiting enforced

CookiesHttpOnly, Secure, SameSite=Lax, .inquire.sh

CSPconnect-src includes api.inquire.sh + challenges.cloudflare.com

Your checklist

Run bash deploy/security-setup.sh and apply every rule.
Enable IP whitelist for production API keys.
Never expose keys in frontend JavaScript or public repos.
Regenerate key immediately if leaked.

Endpoints

Authenticated endpoints require X-Api-Key header unless logged in via the web console.

GET/api/v1/health

Health check. No authentication. Minimal public response.

curl.exe "https://api.inquire.sh/api/v1/health"

GET/api/v1/status

Returns plan, usage count, and remaining lookups.

curl.exe "https://api.inquire.sh/api/v1/status" -H "X-Api-Key: YOUR_API_KEY"

GET/api/v1/search

Execute OSINT search via query string. Consumes one lookup.

curl.exe "https://api.inquire.sh/api/v1/search?q=target@email.com" \
  -H "X-Api-Key: YOUR_API_KEY"

POST/api/v1/search

Recommended. JSON body with query, optional module, stream: true for NDJSON, turnstileToken when Turnstile is enabled, and horus: true for Horus OSINT (€0.10/search).

curl.exe -X POST "https://api.inquire.sh/api/v1/search" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"+393331234567","module":"phone","horus":false,"stream":true}'

GET/api/v1/analytics

Search statistics, recent history, wallet balance, Horus config.

curl.exe "https://api.inquire.sh/api/v1/analytics" -H "X-Api-Key: YOUR_API_KEY"

GET/api/v1/horus/modules

List Horus modules permitted for your API key.

curl.exe "https://api.inquire.sh/api/v1/horus/modules" -H "X-Api-Key: YOUR_API_KEY"

POST/api/v1/analyze

Folder or file analysis — scan breach dumps for identifiers.

curl.exe -X POST "https://api.inquire.sh/api/v1/analyze" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"folder":"breach/subfolder"}'

POST/api/v1/geospy

WolfLocate — photo geolocation. Send the image as multipart/form-data with an image field (JPEG, PNG, or WebP, max 10 MB) or as JSON with a base64 image. The optional hint accepts a known street or city. Returns ranked coordinates, an estimated capture window, and the scene evidence behind them.

curl.exe -X POST "https://api.inquire.sh/api/v1/geospy" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -F "image=@photo.jpg" \
  -F "hint=Via Camillo Aita, Padova"

POST/api/v1/face-search

Face Recon — coming soon. The reverse-face pipeline is announced but not live: the BFF route answers 503 with coming_soon: true and no engine or face-AI call is made, so there is no request to document yet. It will search Yandex, Google, Bing, TinEye and public mugshot databases, scored locally with InsightFace, with an image_analysis object and per-candidate extra.engine provenance when it ships.

POST/api/v1/inmate-search

Inmate Search — government jail & prison rosters (BOP, VINELink, county jails, UK MoJ and international). JSON body with first, last, and optional country, state, county. Requires Pro or higher.

curl.exe -X POST "https://api.inquire.sh/api/v1/inmate-search" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"first":"John","last":"Smith","country":"us","state":"CA"}'

GET/api/v1/inmate-catalog

Country, state and county catalog that powers the Inmate Search pickers.

curl.exe "https://api.inquire.sh/api/v1/inmate-catalog" -H "X-Api-Key: YOUR_API_KEY"

GET/api/v1/modules

Capability list: every module id, its label, and the plan required to use it.

curl.exe "https://api.inquire.sh/api/v1/modules" -H "X-Api-Key: YOUR_API_KEY"

POST/api/v1/roblox/lookup

Roblox username lookup with headshot and account metadata.

curl.exe -X POST "https://api.inquire.sh/api/v1/roblox/lookup" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"username":"builderman"}'

POST/api/v1/auth/email-login

Email and password sign-in used by the web console. When the account has sign-in approval enabled it returns requires_email_link and mails a single-use link; no one-time code is ever requested. Not for API automation — use X-Api-Key there.

curl.exe -X POST "https://api.inquire.sh/api/v1/auth/email-login" \
  -H "Content-Type: application/json" \
  -d '{"email":"you@domain.com","password":"…","deviceId":"…"}'

GET/api/v1/account/settings

Account snapshot: plan, role, API key preview, device binding and the IP whitelist. Companion POST routes cover profile, IP whitelist, key regeneration, device unbind, and link-based sign-in approval.

curl.exe "https://api.inquire.sh/api/v1/account/settings" -H "X-Api-Key: YOUR_API_KEY"

POST/api/v1/account/ip-whitelist

Set allowed IPs for your API key (empty list = allow all).

curl.exe -X POST "https://api.inquire.sh/api/v1/account/ip-whitelist" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ips":["203.0.113.10","198.51.100.5"]}'

Response shape

pages[]Paginated result sections

data.sections{}Raw source payloads keyed by module

metaduration_ms, source_count, horus_used, wallet_cents

402Insufficient Horus wallet balance

Error codes

400Missing query or malformed request

401Invalid or missing API key

402Insufficient Horus balance

403Plan insufficient, banned, device/IP blocked, or Turnstile failed

404Unknown path (non-API routes blocked)

413Upload too large (photo tools cap at 10 MB)

422Unsupported media / insufficient evidence to geolocate

429Lookup limit or rate limit exceeded

500Search execution error

504Gateway timeout — long analysis exceeded the edge limit, retry

Support

Write to the support bot on Telegram (or open a ticket in the console): describe the problem and the team answers in the same chat. Payments and activation are handled by @spyharver_help.

Platform & API Reference

Getting started

Architecture

Query modules

Web console

REST API

Security

Endpoints

Error codes

Support