Identity & Verification

Avatar and logo lookup API

Show a real face or logo next to every user, lead and company. Send an email address, a username or a domain and get the best verified image, where it came from, and an honest answer when there is none.

View documentation Explore all APIs

Endpoints Active

GET /v1/avatar

Example request

curl -H "X-API-Key: $DOMSCAN_API_KEY" "https://domscan.net/v1/avatar?username=octocat"

Example response 200 OK

{
  "input": { "type": "username", "value": "octocat", "platform": null },
  "avatar": {
    "url": "https://cdn.bsky.app/img/avatar/plain/did:plc:example/bafkreiexample",
    "source": "bluesky",
    "kind": "avatar",
    "verified": true,
    "content_type": "image/jpeg",
    "profile_url": "https://bsky.app/profile/octocat.bsky.social"
  },
  "candidates"
...

Example request GET /v1/avatar

Key Features 4

Frequently asked questions 4

HTTP status codes 200 / 400 / 401 / 402 / 429

Category Identity & Verification

Endpoints 1

Key Features 4

Frequently asked questions 4

Used by people at these companies

Trust signals before you integrate

Transparent docs, authenticated requests, and visible reliability details make it easier to evaluate DomScan before you ship.

Live Service status

Check live service health and documented failure responses before you integrate.

OpenAPI API artifacts

OpenAPI, Swagger, Postman, CLI, SDK, and MCP links are one click away.

API keys Protected access

Authenticated endpoints use API keys with clear credit costs before you call them.

1,000 Free allowance

Start with 1,000 free credits per UTC calendar month. Choose an optional monthly plan or buy a one-time pack if you need more.

What this API helps you ship

Use this page as a production brief: endpoints, examples, response shape, and the workflow pieces needed to plug DomScan into your own product.

Product workflows

Embed domain checks, DNS intelligence, risk signals, or enrichment into onboarding, search, and internal tools.

Analyst automation

Replace repeated manual lookups with scheduled jobs, alerting, and reproducible investigation steps.

Clean JSON data

Use predictable fields, documented status codes, and credit costs instead of scraping provider pages.

AI and ops tooling

Feed agents, dashboards, SOAR playbooks, and CRMs through OpenAPI, SDK, Postman, or MCP.

Integration workflow

A simple path from first request to repeatable production usage.

Authenticate once

Send your API key with the documented header and keep requests consistent across services.

Query with examples

Start from the curl and HTTP samples, then map the parameters into your application code.

Operate and monitor

Use status codes, credit costs, and response fields to build retries, logs, and alerts.

Developer kit

Jump from this page into machine-readable docs, request collections, SDKs, or agent tooling.

OpenAPI schema

Generate clients or inspect every request and response shape.

Postman collection

Import ready-made requests for manual testing and team handoff.

SDKs and CLI

Use maintained packages and command-line workflows instead of writing boilerplate.

MCP integration

Expose domain intelligence to AI agents and internal assistant workflows.

Parameters and response map

Scan the inputs, output fields, and status codes before wiring the endpoint into your client.

Request parameters

Parameter

emailusernameplatformdomain

Response fields

Example response

inputinput.typeinput.valueinput.platformavataravatar.urlavatar.sourceavatar.kindavatar.verifiedavatar.content_typeavatar.profile_urlcandidates

Status coverage

HTTP status codes

200400401402429

Endpoints

GET /v1/avatar

Credits: 2Authentication: Authentication required

Trust signals before you integrate

Transparent docs, authenticated requests, and visible reliability details make it easier to evaluate DomScan before you ship.

Live Service status

Check live service health and documented failure responses before you integrate.

OpenAPI API artifacts

OpenAPI, Swagger, Postman, CLI, SDK, and MCP links are one click away.

API keys Protected access

Authenticated endpoints use API keys with clear credit costs before you call them.

1,000 Free allowance

Start with 1,000 free credits per UTC calendar month. Choose an optional monthly plan or buy a one-time pack if you need more.

Key Features

Email, username or domain

Email addresses are matched with public avatar services and the company logo of their mail domain. Usernames are checked on GitHub, Bluesky, Mastodon and Keybase. Domains return the website logo.

Verified images only

Every returned image is downloaded and checked to be a real image. Error pages, broken links and default placeholders are never returned.

Evidence for every source

Each source reports present, absent or unknown with the reason, so a missing picture is never confused with a source that did not answer.

Fresh when you need it

Results are reused for a few hours. Send max_age to set how old a stored answer may be, or max_age=0 for a new check.

Example request

GET /v1/avatar?username=octocat bash

curl -H "X-API-Key: $DOMSCAN_API_KEY" "https://domscan.net/v1/avatar?username=octocat"

Example response

200 OK json

{
  "input": { "type": "username", "value": "octocat", "platform": null },
  "avatar": {
    "url": "https://cdn.bsky.app/img/avatar/plain/did:plc:example/bafkreiexample",
    "source": "bluesky",
    "kind": "avatar",
    "verified": true,
    "content_type": "image/jpeg",
    "profile_url": "https://bsky.app/profile/octocat.bsky.social"
  },
  "candidates": [
    {
      "source": "github",
      "kind": "avatar",
      "status": "present",
      "detail": "image_verified",
      "url": "https://avatars.githubusercontent.com/u/583231?v=4",
      "verified": true,
      "content_type": "image/png",
      "profile_url": "https://github.com/octocat",
      "may_be_generated": true
    },
    {
      "source": "bluesky",
      "kind": "avatar",
      "status": "present",
      "detail": "image_verified",
      "url": "https://cdn.bsky.app/img/avatar/plain/did:plc:example/bafkreiexample",
      "verified": true,
      "content_type": "image/jpeg",
      "profile_url": "https://bsky.app/profile/octocat.bsky.social"
    },
    { "source": "keybase", "kind": "avatar", "status": "absent", "detail": "account_not_found", "url": null, "verified": false, "content_type": null }
  ],
  "status": "present",
  "checked_at": "2026-11-02T10:00:00.000Z"
}

Frequently asked questions

Which sources are checked?

For an email: Gravatar, Libravatar and the BIMI logo of a company mail domain. For a username: GitHub, Bluesky, Mastodon and Keybase, or only the platform you choose. For a domain: the logo or icon the website publishes, and its BIMI logo.

What does absent mean?

Every source answered clearly that it has no picture: no account, an account without a picture, or no published logo. If any source was blocked, slow or unclear, the result is unknown instead.

Why can a GitHub picture be marked as possibly generated?

GitHub gives accounts without an upload a generated pattern and does not say which kind an account has. Such a picture is never returned as the avatar. It is listed with the other sources and flagged, and if it is the only image found the result is unknown.

How many credits does it cost?

Two credits per lookup, whatever the number of sources checked. Unknown results are refunded.

Related tools and resources

HTTP status codes

These are the HTTP status codes to handle, so you can tell apart successful responses, auth issues, credits, rate limits, missing data, and upstream failures.

OK 200

Request successful

Bad Request 400

Invalid parameters

Unauthorized 401

Missing or invalid API key/session.

Payment Required 402

Not enough credits to run this request.

Too Many Requests 429

Rate limit exceeded

Find an avatar

Start free View documentation