How to Find an Email From the YC Company List (2026)

TL;DR

• The YC directory lists company names, batches, websites and founder names. It lists no emails, so you copy the website, then look the person up by domain.
• It takes about 15 minutes for 10 companies. The API route spends about 40 LeadOcean records: up to 30 for the domain search, plus 1 per work-email lookup.
• For a whole batch, skip the loop and run one export. You read email_status in the CSV before you send.

Prerequisites

• A LeadOcean account from app.leadocean.io. The free plan has no card and gives 1,000 records, one-off. Step 5 needs bulk CSV export, which starts on Solo.
• curl, jq and python3.
• An API key in your shell as $LEADOCEAN_API_KEY. Free keys get both scopes, search and enrich.

export LEADOCEAN_API_KEY="paste-your-key-here"

Step 1: Copy the domains from the YC directory

The YC startup directory filters by batch, industry and region, as of September 2026. Each company page shows the batch, a website link and a list of active founders (example page, September 2026).

Open the batch you want, open each company, and copy the website. Paste them into a file, one per line. Keep the list short on your first run.

The script below strips the scheme, www and any path, removes duplicates, and builds the JSON array the later steps send as domain.

cat > yc-sites.txt <<'EOF'
http://acme.com
https://www.example.com/
http://example.org
EOF

sed -E 's#^https?://##; s#^www\.##; s#/.*$##' yc-sites.txt | sort -u > domains.txt
jq -R . domains.txt | jq -s -c . > domains.json
cat domains.json

The directory page is for reading. This guide does not scrape it. Copy by hand, or use a domain list you already hold.

Step 2: Find one founder by hand

For one company, the founder names are on the YC page. The manual route is to guess the address and test it. This prints the usual candidates for a placeholder name.

first="jane"; last="doe"; domain="acme.com"
for p in "$first.$last" "$first" "${first:0:1}$last" "$first$last"; do
  echo "$p@$domain"
done

Every line is a guess. A domain that accepts all mail answers the same for a real and a fake address, so a guess can look fine and still bounce. Use this for one or two people, then move to the API.

Early-stage founders often use a short handle or a first name alone. That makes pattern guessing weaker for YC companies than for older ones, and it is the main reason to look the person up instead.

Step 3: Size the list for free

Ask how many founders we hold across your domains before you spend a record. Send count=true as a query parameter with limit at 1. It costs nothing.

curl -s "https://api.leadocean.io/v1/people/search?count=true" \
  -H "x-api-key: $LEADOCEAN_API_KEY" -H "content-type: application/json" \
  -d "{\"domain\": $(cat domains.json), \"title\": [\"founder\", \"ceo\", \"cto\"], \"limit\": 1}" \
  | jq '.meta | {total, totalIsExact, credits}'

title is a keyword match, so "founder" also matches "co-founder". Wrap a value in brackets, such as "[CEO]", for an exact match. A total of 0 means we hold nobody there, so drop that domain. A low total on a small company is normal, since a team of three has few people to hold.

Step 4: Search by domain, then get the work email

There is no name plus domain lookup in the API. Search the domains for the founders, then use the person_id from the search row. Each person returned costs one record, so keep limit close to the number you need.

curl -s "https://api.leadocean.io/v1/people/search" \
  -H "x-api-key: $LEADOCEAN_API_KEY" -H "content-type: application/json" \
  -d "{\"domain\": $(cat domains.json), \"title\": [\"founder\", \"ceo\"], \"limit\": 30}" \
  | jq '{count: .meta.count, credits: .meta.credits,
         people: [.data[] | {name: .profile_data.full_name, person_id: .meta.source_ids.person_id}]}'

A search row is thin. It has the name, headline, role and flags such as has_email and email_status, but no address. Pick a person and send the person_id to the work-email endpoint.

PERSON_ID="paste-person_id-from-the-search"

curl -s "https://api.leadocean.io/v2/people/email/work?person_id=$PERSON_ID" \
  -H "x-api-key: $LEADOCEAN_API_KEY" | jq '.data'

It returns one address or null, and costs one record either way. It returns only an address at the person's current employer that is verified, catch_all_valid or catch_all. For every email and phone we hold, call POST /v1/people/enrich with reveal_email true instead.

Step 5: Export the whole batch

For more than a few dozen people, export. Bulk CSV export is not on the Free plan: it comes with Solo ($97 a month) and Agency ($497 a month, 50,000 rows a file). Export rows count against the plan's search pace. One request takes up to 50,000 rows and a day takes up to 500,000. Each row written costs one record, and the export reserves up to your limit when it starts.

curl -s https://api.leadocean.io/v1/exports \
  -H "x-api-key: $LEADOCEAN_API_KEY" -H "content-type: application/json" \
  -d "{
    \"name\": \"YC founders\",
    \"filters\": {
      \"domain\": $(cat domains.json),
      \"title\": [\"founder\", \"ceo\"],
      \"emailStatus\": [\"verified\", \"catch_all_valid\", \"catch_all\"]
    },
    \"limit\": 100,
    \"preset\": \"full\"
  }" | jq '.data | {id, status}'

Poll GET /v1/exports/{id}, then fetch GET /v1/exports/{id}/download when the status is done. The full preset reveals emails, so the key needs the enrich scope. The app does the same on its Exports page, with a filter builder, a column picker and the record price before you start.

Step 6: Check the file before you send

Columns are numbered: email_1_address, email_1_status. Keep only rows where the status is verified or catch_all_valid.

curl -s "https://api.leadocean.io/v1/exports/$EXPORT_ID/download" \
  -H "x-api-key: $LEADOCEAN_API_KEY" -o yc-founders.csv

python3 - <<'EOF'
import csv
rows = list(csv.DictReader(open("yc-founders.csv")))
ok = [r for r in rows if r.get("email_1_status") in ("verified", "catch_all_valid")]
print(len(rows), "rows,", len(ok), "ready to send")
EOF

LeadOcean gives no refund or credit-back for bounced emails. Read email_1_status first. catch_all means the domain accepts any address, so it is riskier than catch_all_valid.

What you get

Your Step 3 total depends on the domains you paste. As a reference point, we ran a broader sizing count on 2026-10-21 with leadocean_count_leads, which spends 0 records. It asked for people with "founder" or "ceo" in their title at companies whose own description mentions Y Combinator (companyKeywords).

{
  "total": 748,
  "totalIsExact": true,
  "totalAll": 1264,
  "distinctCompanies": 404,
  "credits": 0,
  "unsupportedFilters": []
}

That is 748 founders and CEOs at 404 companies at the default mailable filter (verified, catch_all_valid or catch_all). With no email condition the same filters match 1,264 people. The keyword only finds companies that name YC in their description, so it undercounts the directory. Use your own domain list for the real run.

The work-email call returns the shape below. This is the response shape from the API reference, with placeholder values.

{
  "success": true,
  "data": {
    "email": "jane.doe@acme.com",
    "status": "verified",
    "verified_batch_date": "2026-09-20"
  }
}

A verified_batch_date means we ran the check. A null there means the status came from a source we hold to the same standard.

Troubleshooting

FAQ