How to Find CEO Email Addresses (12 Ways With Real Queries)

The fastest way to find a CEO's email is to query a database that already holds a checked address. Guessing from a name pattern is the last resort, not the first.

Most lists of "ways" pad the count with LinkedIn tricks and press-page hunting. This one stays on routes that return an address you can read a status on. Every step has a request or a prompt.

The twelve steps fall into four groups. Steps 1 to 4 find the person. Steps 5 to 8 get and check the address. Steps 9 and 10 scale it up with an agent or a CSV. Steps 11 and 12 cover the odd cases: an address you already hold, and a name with no data behind it.

Run them in order the first time. After that, pick the step that matches what you start with: a market, a company, a profile URL or a bare address.

TL;DR

• Running all twelve once takes about 30 minutes.
• The walkthrough spends about 10 records. Counts, sizing and 404s are free. An export costs 1 record per row.
• Send only to verified, catch_all_valid or catch_all. Verify anything you guessed.

Prerequisites

• A LeadOcean API key from app.leadocean.io. Free is 1,000 records, one-off, no card.
• The key exported as $LEADOCEAN_API_KEY.
• curl and jq. Examples use acme.com and Jane Doe as placeholders.

export LEADOCEAN_API_KEY="paste-your-key-here"

Step 1: Size the CEO audience for free

Count before you spend. Send count=true and limit=1 as query parameters. Arrays go comma-separated.

curl -s -G https://api.leadocean.io/v1/people/search \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  --data-urlencode "title=CEO,Chief Executive Officer" \
  --data-urlencode "jobLevel=C-Team" \
  --data-urlencode "country=GB" \
  --data-urlencode "count=true" \
  --data-urlencode "limit=1" | jq '.meta | {total, totalIsExact, countOnly}'

REST meta.total stops at 100,000. A bigger market comes back as a floor with totalIsExact false.

Step 2: Search CEOs by title and region

Search returns a thin row with a person_id and contact flags, not the address. Each person returned costs 1 record. Filters are arrays in a flat JSON body.

curl -s https://api.leadocean.io/v1/people/search \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": ["CEO", "Chief Executive Officer"],
    "jobLevel": ["C-Team"],
    "country": ["GB"],
    "emailStatus": ["verified", "catch_all_valid"],
    "limit": 25
  }' | jq '.data[] | {person_id: .meta.source_ids.person_id, contact_data}'

Step 3: Pull the CEO of one named company

When you have a target account, search by domain. Title values are keywords, so check the returned title before you pick a row.

curl -s https://api.leadocean.io/v1/people/search \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": ["acme.com"], "title": ["CEO"], "limit": 3}'

GET /v1/companies/acme.com/people lists a whole roster instead. Use it when you want every executive, then filter locally.

Step 4: Cover founders and owners

Small companies rarely print "CEO". The top person is a founder or owner. Swap the title filter for seniority, which takes lowercase values.

curl -s https://api.leadocean.io/v1/people/search \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": ["acme.com"], "seniority": ["founder", "owner", "c_suite"], "limit": 5}'

Step 5: Reveal the address with enrich

Enrich takes exactly one of linkedin_url, email, phone or person_id. There is no name plus domain lookup, so run a search first and pass the person_id.

curl -s https://api.leadocean.io/v1/people/enrich \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"person_id": "PERSON_ID_FROM_STEP_3", "reveal_email": true}' \
  | jq '.data.contact_data | {email_status, contact_emails}'

It costs 1 record. Someone we hold nothing for is a 404 and costs nothing.

Step 6: Start from a LinkedIn URL

If you already have the CEO's profile, skip the search and enrich by linkedin_url.

curl -s https://api.leadocean.io/v1/people/enrich \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"linkedin_url": "https://www.linkedin.com/in/jane-doe-example", "reveal_email": true}' \
  | jq '.data.contact_data.contact_emails'

Step 7: Fetch a work address directly

GET /v2/people/email/work returns one current-employer address or null. It costs 1 record per call, including a call that finds nothing, so prefer Step 5 when you are unsure.

curl -s "https://api.leadocean.io/v2/people/email/work?person_id=PERSON_ID_FROM_STEP_3" \
  -H "x-api-key: $LEADOCEAN_API_KEY"

Step 8: Read the status before you send

The status says how far to trust the address. verified was tested. catch_all_valid means the mailbox was confirmed on a domain that accepts everything. catch_all means the mailbox is unproven.

curl -s https://api.leadocean.io/v1/people/enrich \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"person_id": "PERSON_ID_FROM_STEP_3", "reveal_email": true}' \
  | jq -r '.data.contact_data
    | select(.email_status | IN("verified","catch_all_valid","catch_all"))
    | .contact_emails[0].email'

LeadOcean gives no refund for bounces. This check is your protection.

Step 9: Ask an AI agent over MCP

The hosted MCP server at https://api.leadocean.io/mcp signs in with OAuth, so no key is pasted. It exposes 13 tools. The count and filter tools are free.

Count CEOs in the United Kingdom with a mailable email. Then list 10 of them
at companies with 11-50 employees, and tell me each email_status.

The agent calls leadocean_count_leads first (free), then leadocean_search_leads (1 record per person returned).

Step 10: Export a whole list

For hundreds of CEOs, export instead of paging. POST /v1/exports takes the same filters as people search, up to 50,000 rows a request and 500,000 a day. Bulk CSV export is not on Free.

curl -s https://api.leadocean.io/v1/exports \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "UK CEOs",
    "filters": {"title": ["CEO"], "jobLevel": ["C-Team"], "country": ["GB"],
                "emailStatus": ["verified", "catch_all_valid"]},
    "limit": 5000,
    "preset": "full"
  }'

Poll GET /v1/exports/{id}, then GET /v1/exports/{id}/download. Every row costs 1 record. The Exports page in the app does the same with a filter builder and shows the price first.

Step 11: Run a reverse lookup on an address you hold

You may hold a CEO's address from a business card or an old thread. Enrich by email to confirm who holds it and get the current role.

curl -s https://api.leadocean.io/v1/people/enrich \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "jane.doe@acme.com"}' | jq '.data.profile_data'

Whichever route you use, the cost rule is the same. One record is one person you receive. A count, a 404 and an empty page cost nothing. Paid plans have a fair-use pace instead of credits, so a Solo ($97 a month) or Agency ($497 a month) user does not watch a meter. See pricing.

Step 12: Fall back to a name pattern

When the data holds nothing, build candidates from the name and domain, then verify each one with an email verifier you trust. A domain that accepts all mail cannot confirm a mailbox, so a guess there stays a guess.

first="jane"; last="doe"; domain="acme.com"
printf '%s\n' "$first@$domain" "$first.$last@$domain" "${first:0:1}$last@$domain"

This is the weakest route for a CEO, who often uses a short alias. Never send to an unverified candidate.

What you get

Step 1 is free. We ran leadocean_count_leads on 2026-10-21 with title CEO or Chief Executive Officer, job level C-Team, on the default mailable filter (verified, catch_all_valid or catch_all). Counts below are mailable CEOs, not every CEO we hold.

The UK total spans 23,837 distinct companies. The same filters without the mailable default match 154,658 people.

Read the table as a ceiling for sizing, not a promise of replies. A CEO list of 30,084 in one country is a lot to mail. Narrow it by industry or company size before you export, so the rows you pay for are the rows you will use.

A revealed person comes back in this shape. This is the response shape from the API reference, with placeholder values.

{
  "success": true,
  "data": {
    "profile_data": { "...": "name, title, company" },
    "contact_data": {
      "has_email": true,
      "email_status": "verified",
      "contact_emails": [
        { "email": "jane.doe@acme.com", "type": "work", "status": "verified" }
      ]
    }
  }
}

Troubleshooting

FAQ