OSINTNova - API Documentation

Authenticated programmatic access to OSINTNova for privacy-aware public-source research.

API access is available for Pro subscribers. Generate your key in the OSINTNova Platform and include it in each request path. API use is not anonymous; requests are tied to your key so access can be limited, audited, and reviewed for misuse.

Limit

100–800/day · 10–30/min

Base URL

https://app.osintnova.com/bosintapi/

Daily quota by plan

Every plan unlocks the same commands. Your daily call quota depends on your subscription tier, and the live figure is returned as api_metadata.daily_limit on every successful response.

Plan	Price	API calls per day	Burst limit
Pro (Monthly / Yearly / One-Time)	from $9.99 / month	100	10 / min
Pro Dev	$19.99 / month	300	20 / min
Pro Dev+	$39.99 / month	800	30 / min

Both limits are measured per API key, so your allowance is yours alone and is never shared with other subscribers. Daily quotas reset at midnight Pacific time.

Quickstart

Run a request with your API key to validate access before integrating additional commands.

Initial Test Request

curl "https://app.osintnova.com/bosintapi/YOUR_API_KEY/ip/8.8.8.8"

Authentication

All API requests must include your secret API key in the URL path. This ensures secure access to your daily quota and command set, and it keeps each use attributable to an authenticated account.

Endpoint Architecture

Request URL Structure

https://app.osintnova.com/bosintapi/{api_key}/{command}/{query}

API Endpoints

All endpoints accept GET and POST requests. Parameters can be passed via URL path, query string, or JSON body.

GET /ip/{ip_address} IP Intelligence

Retrieve geolocation, ISP, ASN, and threat intelligence for an IP address. Also available as /iplookup/{ip}.

Parameter	Type	Description
ip_address	string	IPv4 or IPv6 address required

Example

GET /bosintapi/{key}/ip/8.8.8.8

GET /domain/{domain} Domain Analysis

DNS records, WHOIS data, registrar info, and Microsoft tenant detection.

Parameter	Type	Description
domain	string	Domain name (e.g., example.com) required

Example

GET /bosintapi/{key}/domain/google.com

GET /phone/{number} Phone Intelligence

Carrier info, location, line type, timezone, and associated names when available.

Parameter	Type	Description
number	string	Phone number with country code required

Example

GET /bosintapi/{key}/phone/+12025551234

GET /discord/{user_id} Discord Intelligence

Profile data, account creation date, badges, bot status, and activity patterns.

Parameter	Type	Description
user_id	string	Discord user ID (snowflake) required

Example

GET /bosintapi/{key}/discord/123456789012345678

GET /steam/{steam_id} Steam Profile

Steam profile analysis including games, friends, and account statistics.

Parameter	Type	Description
steam_id	string	SteamID64 or vanity URL required

Example

GET /bosintapi/{key}/steam/76561198012345678

GET /email/{email} Email Intelligence

Account discovery for an email address across platforms that expose registration status, plus Google profile enrichment for Gmail addresses. Returns the same account coverage as Email Intelligence in the web app. Also available as /email-scan/{email}. For breach history, use /breach/{email} instead.

Parameter	Type	Description
email	string	Email address to scan required

Response field	Type	Description
is_gmail	boolean	Whether the address is a Google account, which unlocks the profile fields below
accounts	object	`total` plus a `sites` array of deduplicated account hits. Each entry has `site` and `url`, and may add `display_name`, `profile_url`, `phone_hint`, and a `details` object carrying whatever the platform exposed (username, join date, follower counts, seller data, and similar)
google_account	object	`gaia_id`, `profile_last_edit`, `activated_services`, `profile_photo_url`, and nested `chat`, `maps`, `play_games`, `calendar` objects
reviews	object	`total` plus an `items` array of public Google Maps reviews. Each item is the single source of truth for that review: `review_number`, `business_name`, `location`, `rating`, `posted`, `text`, `details`, `owner_response`, and — where the location could be placed — `latitude`, `longitude`, and the `cluster_id` it belongs to
review_clusters	object	Geographic grouping of those reviews. Each cluster gives `cluster_id`, `point_count`, `span_miles`, `max_link_miles`, a `review_numbers` array referencing `reviews.items`, and `edges` with the distance between each linked pair. Review detail is not repeated here — resolve `review_numbers` against `reviews.items`

Every section carries its own status: ok, not_applicable when the address is not a Google account, or unavailable with an error when that lookup could not complete. A section failing does not fail the request.

Infostealer exposure is not reported here — use /breach/{email} for that.

Example

GET /bosintapi/{key}/email/user@example.com

GET /breach/{email} Breach Intelligence

Known data breaches containing an email address, with record counts and verification status, plus any infostealer infections associated with it. Also available as /email-pwn/{email}.

Parameter	Type	Description
email	string	Email address to check required
include_html	string	Set to `1` to also return a rendered HTML report

Response field	Type	Description
breach_count	integer	Number of breaches containing the address
total_records	integer	Combined record count across those breaches
verified_breaches	integer	How many of the breaches are verified
sensitive_breaches	integer	How many are flagged sensitive
most_recent_breach	string	Name of the newest breach, with `most_recent_date` alongside it
data_types	array	Every category of data exposed across all breaches, deduplicated
breaches	array	One object per breach: `name`, `domain`, `breach_date`, `added_date`, `records`, `data_types`, and the `verified`, `sensitive`, `fabricated`, `retired`, `spam_list`, `malware` flags
hudson_rock	object	`found`, service counts, and an `infections` array describing each infostealer-compromised machine associated with the address

Example

GET /bosintapi/{key}/breach/user@example.com

GET /username/{username} Username Search

Search for a username across 3,000+ social media platforms and websites.

Parameter	Type	Description
username	string	Username to search required

Example

GET /bosintapi/{key}/username/johndoe

GET /darkweb/{query} Exposure Reference Search

Search for surface-level exposure mentions and security-relevant public references.

Parameter	Type	Description
query	string	Search term (email, username, etc.) required

Example

GET /bosintapi/{key}/darkweb/user@example.com

GET /url/{url} URL Analysis

Analyze URLs for safety, redirects, and threat intelligence. Also available as /url-detective/{url}.

Parameter	Type	Description
url	string	Full URL to analyze required

Example

GET /bosintapi/{key}/url/https://example.com

GET /vin/{vin} VIN Lookup

Vehicle identification number lookup for automotive intelligence.

Parameter	Type	Description
vin	string	17-character VIN required

Example

GET /bosintapi/{key}/vin/1HGBH41JXMN109186

Response Format

All responses are JSON with a consistent structure. Every response includes metadata about your API usage.

Successful Response

200 OK

{
  "success": true,
  "data": {
    "phone": "202-555-1234",
    "location": "Washington, DC",
    "carrier": "Verizon Wireless",
    "line_type": "MOBILE",
    "time_zone": "America/New_York"
  },
  "query": "+12025551234",
  "api_metadata": {
    "daily_usage": 42,
    "daily_limit": 100,
    "command": "phone",
    "timestamp": "2025-01-20T15:30:00.000Z"
  }
}

HTTP Status Codes

The API uses standard HTTP status codes to indicate request outcomes.

Code	Status	Description
200	OK	Request successful, data returned
400	Bad Request	Missing required parameter or invalid format
401	Unauthorized	Invalid or missing API key
403	Forbidden	Account suspended or Pro subscription required
429	Too Many Requests	Plan daily limit (100 / 300 / 800) or burst limit (10 / 20 / 30 per min) exceeded
500	Internal Error	Server error, try again later

Error Codes

Error responses include a code field for programmatic handling.

401 Error Response

{
  "success": false,
  "error": "Invalid API key",
  "code": "INVALID_API_KEY"
}

Error Code Reference

Code	HTTP	Description
INVALID_API_KEY	401	API key is invalid or not found
PRO_REQUIRED	403	Active Pro subscription required for API access
ACCOUNT_SUSPENDED	403	Account has been suspended
RATE_LIMIT_EXCEEDED	429	Your plan's daily call limit, or its per-minute burst limit, was exceeded. A burst rejection carries `"limit_type": "per_minute"`, your `limit`, and a `Retry-After` header; a daily rejection carries `daily_usage` and `daily_limit`.
UNKNOWN_COMMAND	400	Command not recognized
UNSUPPORTED_COMMAND	400	Command exists but not available via API
INTERNAL_ERROR	500	Server-side error occurred

Rate limit responses include daily_usage and daily_limit fields to help you track usage.

Python Example

Use the requests library to interact with the OSINTNova API.

python

                            import requests

API_KEY = "bosint_your_api_key_here"
BASE_URL = "https://app.osintnova.com/bosintapi"

def ip_lookup(ip_address):
    url = f"{BASE_URL}/{API_KEY}/ip/{ip_address}"
    response = requests.get(url)
    data = response.json()
    
    if data['success']:
        return data['data']
    else:
        print(f"Error: {data['error']} ({data.get('code', 'N/A')})")
        return None

# Example usage
result = ip_lookup("8.8.8.8")
if result:
    print(f"Country: {result.get('country')}")
    print(f"ISP: {result.get('isp')}")
                        

cURL Examples

Test endpoints directly from your terminal.

bash

# IP Lookup
curl "https://app.osintnova.com/bosintapi/YOUR_KEY/ip/8.8.8.8"

# Domain Analysis
curl "https://app.osintnova.com/bosintapi/YOUR_KEY/domain/google.com"

# Phone Lookup
curl "https://app.osintnova.com/bosintapi/YOUR_KEY/phone/+12025551234"

# Discord User
curl "https://app.osintnova.com/bosintapi/YOUR_KEY/discord/123456789"

# Username Search
curl "https://app.osintnova.com/bosintapi/YOUR_KEY/username/johndoe"

# Pretty print with jq
curl -s "https://app.osintnova.com/bosintapi/YOUR_KEY/ip/8.8.8.8" | jq .