Developers

Open API

OathNet's API needs an x-api-key you only get after signup + a paid plan. Ours needs nothing. Base URL:

https://evidence-logger-swat-1800.pages.dev
GET/api/search?q={anything}
Smart search — auto-detects email / username / domain / IP / Discord ID / URL / phone and fans out to every relevant source.
curl "https://evidence-logger-swat-1800.pages.dev/api/search?q=test@gmail.com"
GET/api/breach?q={email|user|domain}
Breach corpus search — XposedOrNot + HIBP catalog join + Hudson Rock stealer verdict + LeakCheck index.
curl "https://evidence-logger-swat-1800.pages.dev/api/breach?q=test@gmail.com"
GET/api/stealer?term={email|user|domain|ip}
Infostealer-log exposure — the data class paid platforms gate hardest. Free here.
curl "https://evidence-logger-swat-1800.pages.dev/api/stealer?term=wired.com"
GET/api/email?email={addr}
Email footprint — breaches, disposable check, Gravatar, PGP key, stealer intel.
curl "https://evidence-logger-swat-1800.pages.dev/api/email?email=test@gmail.com"
GET/api/username?name={handle}
34-platform existence sweep with profile links.
curl "https://evidence-logger-swat-1800.pages.dev/api/username?name=builderman"
GET/api/discord?id={snowflake}
Discord public profile + badges + local snowflake decode.
curl "https://evidence-logger-swat-1800.pages.dev/api/discord?id=80351110224678912"
GET/api/roblox?user={name|id}
Roblox profile — avatar, friends, followers, join date, verified badge.
curl "https://evidence-logger-swat-1800.pages.dev/api/roblox?user=builderman"
GET/api/steam?id={vanity|id64}
Steam profile + Steam2/Steam3 ID conversion + VAC/trade status.
curl "https://evidence-logger-swat-1800.pages.dev/api/steam?id=gabelogannewell"
GET/api/minecraft?name={name|uuid}
Minecraft UUID, full name history, skin/cape textures.
curl "https://evidence-logger-swat-1800.pages.dev/api/minecraft?name=Notch"
GET/api/xbox?gt={gamertag}
Xbox gamertag profile — gamerscore, avatar (best-effort public scrape).
curl "https://evidence-logger-swat-1800.pages.dev/api/xbox?gt=Major%20Nelson"
GET/api/github?user={login}
GitHub profile + top repositories.
curl "https://evidence-logger-swat-1800.pages.dev/api/github?user=octocat"
GET/api/ip?ip={ipv4}
IP intel — geo, ASN, VPN/proxy/Tor, open ports, CVEs.
curl "https://evidence-logger-swat-1800.pages.dev/api/ip?ip=1.1.1.1"
GET/api/domain?d={domain}
Domain recon — RDAP, DNS, CT subdomains, urlscan captures.
curl "https://evidence-logger-swat-1800.pages.dev/api/domain?d=oathnet.org"
GET/api/wayback?url={url}
Wayback Machine — closest snapshot + recent archive history.
curl "https://evidence-logger-swat-1800.pages.dev/api/wayback?url=oathnet.org"
GET/api/health · /api/stats
Service status and platform stats. Always 200.
curl "https://evidence-logger-swat-1800.pages.dev/api/health"

Response contract

Every endpoint returns { success, query, verdict, blocks[], sources[], took_ms, free: true }. verdict is human-grade (COMPROMISED, NO HITS…). sources[] shows upstream status + latency per source. Errors use { success:false, error } with a 4xx/5xx status.