Identity Portal

Identity Portal takes one selector, most often an email address, and returns the identity records the Intelligence X archive holds for it. When the archive gives the raw line a record was found in, such as an address with a city and a country, it is in linea. Use it when you want the matching lines themselves. To list the files that mention a selector, use Intelligence Search instead.

When to use it

You have an email address and want the lines of leaked data that mention it.
You want to see what was stored next to an address: a name, a city, a country.
You want to know which files and buckets those lines come from.

Request

POST /v1/search/identity-portal, with a JSON body.

Parameter	Type	Required	What it does
`query`	string	Yes	The selector to look up, such as an email address or a domain. 200 characters at most.

Any other field is refused with 400 invalid_request, and nothing is charged.

curl https://api.orelys.io/v1/search/identity-portal \
  -H "Authorization: Bearer $ORELYS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "query": "john@example.com" }' \
  --max-time 120

const response = await fetch("https://api.orelys.io/v1/search/identity-portal", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ORELYS_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ query: "john@example.com" }),
  signal: AbortSignal.timeout(120_000),
});

const data = await response.json();
if (!response.ok) throw new Error(`${data.error.code}: ${data.error.message}`);

for (const record of data.results) {
  console.log(record.linea || "(no line)", "|", record.bucket, record.name);
}

import os
import requests

response = requests.post(
    "https://api.orelys.io/v1/search/identity-portal",
    headers={"Authorization": f"Bearer {os.environ['ORELYS_API_KEY']}"},
    json={"query": "john@example.com"},
    timeout=120,
)
data = response.json()
if not response.ok:
    raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")

for record in data["results"]:
    print(record.get("linea") or "(no line)", "|", record.get("bucket"), record.get("name"))
print("Requests left today:", data["quota"]["remaining"])

Like every list mode, the search service has 85 seconds to start answering; past that, the API answers 504 source_timeout, which costs nothing. Set your HTTP client’s timeout to at least 100 seconds — 120 seconds, as above, is a safe value.

What you get back

{
  "mode": "identity-portal",
  "request": { "query": "john@example.com" },
  "count": 1,
  "results": [
    {
      "name": "john@example.com",
      "linea": "john@example.com:London:UK",
      "date": "2023-02-08T00:00:00Z",
      "bucket": "leaks.private.general"
    }
  ],
  "charged": true,
  "quota": { "limit": 500, "used": 15, "remaining": 485, "resets_at": "2026-09-26T00:00:00.000Z" }
}

Field	What it is
`mode`	`identity-portal`.
`request`	Your search as sent to the archive.
`count`	Number of items in `results`.
`results`	The identity records found. `[]` when there are none.
`charged`	Whether the search took a request. Also in the `X-Request-Charged` header.
`quota`	Your quota after this search.
`redacted`	Only there when records were left out because they mention a removed selector.
`source`	Only there when the archive sent other facts with the list, such as a `total`, passed on as they are.

Each record usually has:

Field	What it is
`name`	The name the archive gives the record, often the file it comes from.
`linea`	The raw line the record was found in, exactly as stored, when the archive gives one. It is often empty.
`date`	When it was indexed.
`bucket`	The bucket it is stored in, when the archive gives it.

Any field can be missing, and other fields can appear. Build your code to ignore the fields it does not know.

A line is leaked data, written by whoever made the file. Show it as text, never as HTML, and do not follow its links automatically.

Cost and limits

Case	Requests
A search that returns records	1, from your daily quota.
A search that completes with an empty list	1, as in the dashboard.
The archive answers “no results”, or refuses the search (`400 rejected`)	0, within a daily allowance (your daily quota, at least 10). Past it, 1.
Connection closed after the search was sent	0, within the same daily allowance.
A search for a removed selector	0: an empty result, and the archive is not asked.
Invalid input, a limit reached, the search service down, busy or too slow	0.

Plans: Professional (500 requests a day) and Enterprise (1,500). Both include Identity Portal.
Per account: 60 searches a minute and 3 at the same time on Professional, 120 and 5 on Enterprise, shared with all your other searches.
Per address: 120 calls a minute, whatever the plan.

See Limits for the details.

Errors

Status	Code	When
`400`	`invalid_request`	`query` is missing, too long, or another field was sent. `details` lists each problem.
`400`	`rejected`	The search service refused the search. Check the values.
`401`	`missing_api_key`, `invalid_api_key`	No key was sent, or it is not a valid one.
`403`	`plan_required`, `account_blocked`	The account is not on Professional or Enterprise, or it is blocked.
`429`	`rate_limited`, `concurrency_limited`, `ip_rate_limited`, `quota_exceeded`	A limit is reached. Wait `Retry-After` seconds.
`502`	`source_error`, `source_unreachable`, `response_too_large`	The search service failed, or the answer is too large. Try again later.
`503`	`service_unavailable`, `source_busy`	Search is down or busy for a moment.
`503`	`module_maintenance`, `module_offline`	The Orelys team has paused this mode, or all of Intelligence X. Nothing is charged. Under maintenance, wait `Retry-After` seconds.
`504`	`source_timeout`	The search service did not start answering within 85 seconds.

Errors use the usual envelope: { "error": { "code": "…", "message": "…" } }.

Tips

Keep linea whole. It is one string, separators included. Split it on your side only when you know the file’s format.
Expect empty lines. Many records carry no linea. name and bucket still tell you where the record lives.
Group by bucket. bucket tells leaks from pastes or the darknet. Buckets gives a readable label for each main one.
Go wider with Intelligence Search. Intelligence Search lists the files that mention the selector, each with a system_id to open it.

Reference

Request and response schemas, every error, and a playground to try it.

Get started

Essentials

Intelligence X

OSINT

Data breaches

Privacy

Identity Portal

When to use it

Request

What you get back

Cost and limits

Errors

Tips

Reference

Identity Portal

​When to use it

​Request

​What you get back

​Cost and limits

​Errors

​Tips

​Reference

Identity Portal

When to use it

Request

What you get back

Cost and limits

Errors

Tips

Reference