DEVELOPERS
API DOCUMENTATION
One bearer key, 142 modules, JSON in and JSON out. The public API mirrors the console: anything you can run in a module you can run over HTTPS.
QUICK START
BASE URL https://cexaw.xyz/api/public/v1 · ALL RESPONSES ARE JSON · ALL REQUESTS REQUIRE A BEARER KEY.
SHELL
curl "https://cexaw.xyz/api/public/v1/search?source=snusbase&email=target@example.com" \ -H "Authorization: Bearer cexaw_live_yourkey"
AUTHENTICATION
KEYS ARE CREATED IN THE CONSOLE UNDER API KEYS AND SHOWN ONCE. SEND THE KEY IN THE AUTHORIZATION HEADER — NEVER IN A QUERY STRING, AND NEVER FROM BROWSER CODE. FREE ACCOUNTS CANNOT ISSUE KEYS; PAID PLANS GET A PER-PLAN KEY ALLOWANCE.
HEADER
Authorization: Bearer cexaw_live_yourkey
GET
/API/PUBLIC/V1/SOURCES
LISTS EVERY MODULE WITH ITS ID, CATEGORY, FREE-TIER FLAG AND ACCEPTED FIELD NAMES. USE IT TO DISCOVER VALID source VALUES.
SHELL
curl "https://cexaw.xyz/api/public/v1/sources" \ -H "Authorization: Bearer cexaw_live_yourkey"
200 RESPONSE
{
"ok": true,
"count": 142,
"sources": [
{
"id": "cexaw-seon-email",
"name": "CEXAW SEON Email",
"group": "CEXAW Modules",
"free": false,
"fields": ["email"]
}
]
}GET · POST
/API/PUBLIC/V1/SEARCH
RUNS ONE IDENTIFIER AGAINST ONE MODULE. GET TAKES QUERY PARAMETERS, POST TAKES A FLAT JSON OBJECT WITH THE SAME KEYS. MAXIMUM 25 PARAMETERS, 300 CHARACTERS EACH.
source
REQUIREDModule id. Aliased as `module`. Every id is listed by /v1/sources.
<module fields>
AT LEAST ONEEach module declares its own fields (email, username, ip, domain, hash…). Unknown keys are dropped.
POST
curl -X POST "https://cexaw.xyz/api/public/v1/search" \
-H "Authorization: Bearer cexaw_live_yourkey" \
-H "Content-Type: application/json" \
-d '{"source":"snusbase","email":"target@example.com"}'200 RESPONSE
{
"ok": true,
"source": "snusbase",
"status": 200,
"took_ms": 412,
"data": { "results": [ /* upstream payload, unmodified */ ] }
}EVERY SUCCESSFUL CALL RETURNS X-QUOTA-REMAINING SO YOU CAN TRACK CREDITS WITHOUT A SECOND REQUEST.
RATE LIMITS
CEILINGS APPLY PER KEY AND PER IP, AND TIGHTEN AUTOMATICALLY FOR CALLERS WITH A BAD REPUTATION SCORE. A 429 CARRIES retryAfter, retryAt AND THE STANDARD Retry-After HEADER — BACK OFF INSTEAD OF RETRYING IMMEDIATELY.
FREE KEY
30 REQ/MIN
STARTER (WEEKLY)
90 REQ/MIN
PRO (MONTHLY)
180 REQ/MIN
YEARLY
300 REQ/MIN
LIFETIME LITE
300 REQ/MIN
LIFETIME PRO
600 REQ/MIN
LIFETIME ELITE
1200 REQ/MIN
PER IP (ALL KEYS)
240 REQ/MIN
CONSOLE LOOKUPS
60 FREE / 180 PAID PER MIN
FREE SOURCES (BURST)
90 PER MIN
MULTISINT SWEEPS
10 FREE / 30 PAID PER MIN
SIGN-IN ATTEMPTS
15 PER 10 MIN / IP
429 RESPONSE
{
"ok": false,
"error": "Too many requests. Try again in 42 seconds.",
"code": "rate_limited",
"retryAfter": 42,
"retryAt": "2026-01-01T00:00:42.000Z"
}ERROR CODES
400
MISSING OR INVALID PARAMETERS — NO DECLARED FIELD WAS PROVIDED.
401
MISSING, MALFORMED OR REVOKED BEARER KEY.
403
PLAN DOES NOT INCLUDE THIS MODULE, OR QUOTA IS EXHAUSTED.
404
UNKNOWN SOURCE ID.
429
RATE LIMITED — RETRY AFTER THE SECONDS IN THE RETRY-AFTER HEADER.
5XX
UPSTREAM CORPUS FAILURE — RETRY WITH BACKOFF, THE CALL IS NOT BILLED.
FAILED RESPONSES ALWAYS CARRY { "ok": false, "error": "…" } SO A SINGLE BRANCH HANDLES EVERY FAILURE PATH.