IDLink API

💡 LOOKING FOR API REFERENCE?

For more information about the IDLink API See API reference.

Identity data is often fragmented across breach and malware records, making connections between related accounts and identity attributes difficult to uncover. SpyCloud’s IDLink API automatically finds those hidden connections. It pivots across related identity data, uses confidence scoring to evaluate relationships, and returns a broader view of an identity than a direct-match search alone.

The result is an identity graph that provides a more holistic view of an identity without requiring analysts or applications to perform each search and pivot manually.

How IDLink works

IDLink automatically expands a search from a known identity asset to uncover connected identity data.

1. Search	2. Pivot	3. Score
Find records that directly match the starting identity asset.	Use related identity assets in those results to automatically search for additional connections. Each round of searching adds another depth level.	Evaluate relationships using weighted identity attributes and cumulative confidence scoring to determine the relevance of connections.

Together, these automated pivots and confidence scoring help IDLink uncover relevant identity connections that a direct-match search alone may not reveal.

Query inputs

IDLink supports multiple identity assets as the starting point for a query:

Query input	Query input
`email`	`national_id`
`phone`	`passport_number`
`username`	`social_security_number`
`social_handle`	`infected_machine_id`
`password`	`log_id`
`bank_number`	`ip_address`
`driver_license`

IDLink can pivot across supported identity assets found within matching records to discover additional connections.

Note: Not every asset behaves identically during graph expansion. For example, an IP address can be used as the starting point for a query but is not used for subsequent pivots. backup_email can be used for graph pivots and is queried through the email input.

Typical uplift vs. exact match queries

Compared with searching only for records directly associated with the original identifier, IDLink queries can return an expected:

8x more identity records
2x more malware records
14x more cracked passwords
5x more email addresses

This additional data comes from IDLink automatically following connections beyond the original query.

Identity correlation and confidence

Finding a shared attribute doesn't necessarily mean two records have an equally strong relationship. IDLink accounts for this by assigning different weights to identity attributes and using those weights to calculate cumulative confidence as it builds connections.

Supported identity attributes receive weights based on their value for identity correlation. As IDLink performs automated pivots, these weights help determine the relevance of relationships between records.

Confidence calculations can consider attributes including email addresses, usernames, names, dates of birth, phone numbers, passwords, addresses, infected machine IDs, log IDs, bank numbers, passport numbers, national IDs, and IP addresses.

When to use IDLink API

Use IDLink when you need to understand the broader identity and hidden connections surrounding a known identifier, rather than only retrieving records that directly match it.

Use cases include:

Connect personal and corporate identities. Discover relationships between identity assets that may not be apparent from a corporate email address alone.
Expand an identity investigation. Start with a known identifier and uncover additional accounts, identity attributes, and records connected to it.
Investigate malware-related identities. Start with an infected_machine_id or log_id to explore identities and other data connected to an infected device.
Enrich security data. Add connected identity context to an existing alert, investigation, or internal dataset.
Automate identity correlation. Replace repeated manual searches and pivots with automated exploration of connected identity data.

Maximum depth

IDLink supports four depth levels. Each level represents how many times IDLink searches based on data returned by the previous results.

Depth	How it works
1	Returns directly matched results only. It can also be useful for investigating both usernames and email usernames in a single username search.
2	Uses direct matches from Depth 1 to automatically search related identity assets, uncovering records connected through other identity data. SpyCloud recommends Depth 2 as a starting point for most searches.
3	Conducts additional searches using identity assets discovered in Depth 2 results, expanding the identity graph another level.
4	Searches identity assets discovered in Depth 3 results. This is the deepest search available and may return a large number of results.

Tip: Increasing the depth expands the identity graph by searching on assets discovered at each preceding level. Higher depths can uncover more connections but may also return significantly more results.