How to Find an Email From a Crunchbase Profile (2026)

TL;DR

• A Crunchbase profile gives you a company, a website and names. Take the website domain, find the founder in LeadOcean, then ask for their checked work email. Two calls.
• It takes about 15 minutes the first time, mostly getting a key. Each person costs about 2 records of your 1,000 free ones: 1 for the search row and 1 for the email.
• For a list, loop the same two calls over a file of domains. Speed is per plan: 5 requests a second on Free, 50 on Solo, 200 on Agency.

Prerequisites

• A LeadOcean account and key from app.leadocean.io. The free plan has no card and 1,000 records, one-off. Free keys get both the search and enrich scopes.
• The key in your shell as $LEADOCEAN_API_KEY.
• curl and jq. For the bulk step, a text file with one company domain per line.

export LEADOCEAN_API_KEY="paste-your-key-here"

Step 1: Read the profile by hand

Open the company's Crunchbase page and copy two things: the website and the names of the founders or executives. That takes a minute and costs nothing.

Crunchbase is built around funding and company facts, not mailboxes. Treat the profile as a source of names and a domain, then get the address somewhere that checks it.

Strip the website down to a bare domain. Search matches on the domain, so https://www.acme.com/about becomes acme.com.

echo "https://www.acme.com/about" | sed -E 's#^https?://##; s#^www\.##; s#/.*$##'

acme.com

Step 2: Size the company, then find the founder

Ask how many people we hold at that domain before you spend anything. A count call is free: send count=true as a query parameter with limit 1.

curl -s -X POST "https://api.leadocean.io/v1/people/search?count=true" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "content-type: application/json" \
  -d '{"domain": ["acme.com"], "limit": 1}' | jq '.meta.total'

Then pull the senior people. The body is flat JSON and every filter is an array. Each person returned costs 1 record, so keep limit small.

curl -s -X POST "https://api.leadocean.io/v1/people/search" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "content-type: application/json" \
  -d '{
    "domain": ["acme.com"],
    "seniority": ["founder", "c_suite"],
    "limit": 5
  }' | jq -c '.data[] | {person_id: .meta.source_ids.person_id}'

Match the names from the Crunchbase page against the rows. Take the person_id of the person you want. It names a record, and it works even for people with no LinkedIn URL.

Pick the seniority filter to fit the company. A seed-stage startup has founders and little else, so founder is enough. A company that has raised several rounds has a layer of executives, so add c_suite or vp. Enum values are exact strings, and leadocean_list_enum_values lists them for free.

If the search returns nothing, the domain is usually the cause. Crunchbase sometimes lists a marketing site or a parent brand. Try the domain from the company's own email signature or its LinkedIn page, then run the count call again.

Step 3: Get the work email

Send the person_id to the work email endpoint. It returns one address at the person's current employer, or data: null.

curl -s -G "https://api.leadocean.io/v2/people/email/work" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  --data-urlencode "person_id=PERSON_ID_FROM_STEP_2" | jq

Only addresses that were checked come back: verified, catch_all_valid or catch_all. So null means "none that qualify", not "this person has no email".

Do not guess the address from a pattern. jane@acme.com and jane.doe@acme.com both look plausible, and neither has been tested. Guessed addresses bounce, and a high bounce rate damages the sending domain you need for the rest of the list.

The call costs 1 record, found or not. If the person's Crunchbase page links a LinkedIn profile, you can send linkedin_url instead of person_id and skip step 2. See the pricing page for what the free plan covers.

Step 4: Run it over a list

Put one domain per line in domains.txt. Loop both calls and write one JSON line per company. This version takes the first founder or executive the search returns, so read a few results before you trust it.

while IFS= read -r domain; do
  id=$(curl -s -X POST "https://api.leadocean.io/v1/people/search" \
    -H "x-api-key: $LEADOCEAN_API_KEY" \
    -H "content-type: application/json" \
    -d "{\"domain\": [\"$domain\"], \"seniority\": [\"founder\", \"c_suite\"], \"limit\": 1}" \
    | jq -r '.data[0].meta.source_ids.person_id // empty')
  [ -z "$id" ] && continue
  curl -s -G "https://api.leadocean.io/v2/people/email/work" \
    -H "x-api-key: $LEADOCEAN_API_KEY" \
    --data-urlencode "person_id=$id" \
  | jq -c --arg domain "$domain" '{domain: $domain, email: .data.email, status: .data.status}'
done < domains.txt > results.jsonl

Records add up on a loop: 500 companies spend up to 1,000 records. Run 20 domains first and read the hit rate before you run the rest.

When you have an audience definition but no domain list, skip the loop. POST /v1/exports takes the same filters as search and writes a CSV, up to 50,000 rows a request and 500,000 a day. Each row costs 1 record. Bulk CSV export is not on Free: it is included on Solo ($97 a month) and Agency ($497 a month).

curl -s -X POST "https://api.leadocean.io/v1/exports" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "content-type: application/json" \
  -d '{
    "name": "founders-by-domain",
    "filters": {"domain": ["acme.com", "globex.com"], "seniority": ["founder"]},
    "limit": 100,
    "reveal": "email"
  }' | jq

Step 5: Filter on status before you send

Pick the route by job. Use the single lookup when you have a handful of companies and want to read each one. Use the loop for a list you already hold. Use the export when you describe the audience and let the filters find the people.

An address is not a send list until you have read its status. Keep verified and catch_all_valid. Treat catch_all as a risk you size, not a green light.

jq -c 'select(.email != null and (.status == "verified" or .status == "catch_all_valid"))' \
  results.jsonl > sendable.jsonl
wc -l sendable.jsonl

LeadOcean gives no refund or credit-back for bounced emails, so this filter is your protection.

What you get

Response shape from the API reference, with placeholder values. A search row carries the id you need at meta.source_ids.person_id. The profile fields sit under profile_data and are left out here.

{
  "success": true,
  "data": [
    {
      "profile_data": {},
      "meta": { "source_ids": { "person_id": "1234567890" } }
    }
  ],
  "meta": { "count": 1, "nextCursor": null }
}

The work email call returns success and data, with no meta object.

{
  "success": true,
  "data": {
    "email": "jane.doe@acme.com",
    "status": "verified",
    "verified_batch_date": "2026-09-20"
  }
}

Troubleshooting

FAQ