📧 Intelligence API

Email Intelligence API

Credential Exposure & Identity Risk — Delivered in Real-Time

Built for banks, fintechs, marketplaces, telecoms & identity platforms

The Email Intelligence API helps your platform instantly determine whether an identity is at risk — before fraud, account takeover, or abuse occurs.

By analyzing breach exposure, reputation signals, and attacker-side telemetry, City of Hats transforms every email lookup into an actionable trust decision.

50B+ Records Monitored

<200ms API Response Time

99.9% Uptime SLA

Instead of asking:

"Has this email appeared in a breach?"

→

Your team finally sees:

"Is this user currently risky?"

View API Documentation Get API Key

Detection

What the API Detects

Every lookup returns risk-enriched intelligence across three key dimensions.

Credential Exposure Signals

🔍 Appears in breach datasets
🔁 Password reuse detection
📅 Leak recency
📈 Exposure velocity
✅ Source confidence

Identity Reputation Signals

🎭 Disposable / alias / masked email
⏳ Age & stability
⚠️ Prior malicious activity
🤖 Bot-like registration behavior
🌐 Domain trust classification

Threat Funnel Indicators

We classify risk based on attacker lifecycle stage:

CLEAN → LEAKED → REPOSTED → TRADED → TESTED → ATTACKED

This helps teams distinguish:

🔹 Passive exposure vs 🔸 Active criminal interest

Response

Risk Model Output

Each lookup returns structured intelligence so your systems can automate decisions — not alerts.

📊

Identity Risk Score

0–100 scale

📍

Threat Funnel Stage

Attack lifecycle position

🎯

Exposure Confidence

Signal reliability

🏷️

Risk Reason Codes

Explainable risk factors

⚡

Recommended Action

allow / step_up / block

Applications

Common Use Cases

🚫

Fraud & Trust

Stop:

Fake account creation
Refund abuse
ATO-based takeover
Bonus abuse

🔐

Authentication & IAM

Enable:

Adaptive MFA
Step-up verification
Trust-based login flows
Risk-aware password resets

🛡️

SOC & Security Ops

Reduce noise:

Score identity events
Enrich SIEM alerts
Accelerate investigations
Prioritize response

Comparison

Why We're Different

City of Hats goes beyond simple breach lookups to deliver real-time identity risk intelligence.

🔎

Other Tools

Tell you if an email appeared in a breach
Binary yes/no response
Static, historical data
No attacker context
No recommended action

🧠

City of Hats

Tells you whether the identity is risky right now
Real-time risk score (0–100)
Attacker-side telemetry + lifecycle analysis
Threat funnel stage classification
Actionable recommendations

The difference: We don't just tell you what happened — we tell you what's likely to happen next.

Integration

Example Workflow

👤

User signs up

→

📧

Email submitted

→

🧠

City of Hats

→

📊

Risk Score

→

⚙️

Policy Engine Acts

Policy Examples:

Low risk → Allow

Medium risk → Step-up

High risk → Block / Review

Developer

API Reference

Simple REST API with JSON request/response.

POST /api/v1/intel/analyze

cURL

curl -X POST "https://api.cityofhats.com/api/v1/intel/analyze" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "email": "user@example.com"
  }'

Response 200 OK

{
  "email": "user@example.com",
  "risk_score": 78,
  "threat_stage": "TEST",
  "exposed": true,
  "exposure_count": 12,
  "last_seen": "2025-01-09",
  "disposable": false,
  "domain_age_days": 4521,
  "risk_reasons": [
    "recent credential exposure",
    "password reuse risk",
    "known criminal trade source"
  ],
  "recommended_action": "step_up_auth",
  "confidence": "high"
}