IDLink API

🧨 The Problem

Analysts often rely on OSINT and surface-level data that lacks full visibility into a user's identity — whether that user is a legitimate employee, customer, or criminal actor. This creates blind spots, delayed decisions, and manual investigative churn.

Without access to darknet-sourced identity correlation, teams face:

• Fragmented selectors and disconnected exposures
• Missed attribution opportunities
• Extended MTTD/MTTR for identity threats

🚀 IDLink API Overview

SpyCloud's IDLink API automates the pivoting process — linking emails, usernames, passwords, phone numbers, and more — to build a holistic identity view of your subject.

IDLink reduces manual investigation time by aggregating related identity records and eliminating dead ends and out-of-scope assets.

⚡ Benefits at a Glance

🧠 Understand the Scope of an Identity — Faster

IDLink API returns a full digital footprint for a queried identity (email, username, or phone), including:

• Recaptured and linked selectors (social handles, backups, passwords)
• Pivotable relationships (up to 4 layers deep)
• Filtered, relevance-scored output

All of this happens without returning disjointed or out-of-scope data.

🔄 How IDLink API Works

1. Submit a selector – email, username, or phone number
2. Specify pivot depth – IDLink pivots up to 4 layers deep on linked selectors
3. Receive enriched identity graph – Only relevant, high-confidence records are returned

📊 Typical Uplift vs Exact Match Queries (as shown on PDF page 2)

• 8x more identity records
• 2x more malware records
• 14x more cracked passwords
• 5x more email addresses

These enhancements reduce blind spots and dramatically expand investigative value.

🔐 Key Capabilities