How to Find a Recruiter's Email Address (2026)

TL;DR

• Search by title and region, then reveal the email only for the recruiters you will write to. A guessed pattern is a guess.
• It takes about 15 minutes and about 15 LeadOcean records: 10 search rows and 5 reveals. The count in Step 1 is free.
• Read email_status before you send. Send to verified. Treat catch_all as a risk you choose, and skip the rest.

Prerequisites

• A LeadOcean account. The free plan gives you 1,000 records, one-off, with no card: start free.
• An API key in your shell: export LEADOCEAN_API_KEY=... (the app lists your keys).
• curl and jq. Every request goes to https://api.leadocean.io with the x-api-key header.

Step 1: Count the mailable recruiters

Count first. It is free and tells you whether the filter is worth running. Send count=true and limit=1 as query parameters.

Recruiter emails come from four places. These are the company careers page, a job post or LinkedIn profile, a pattern guessed from a colleague's address, and a data provider with a verification status. The first two give you a form or a profile, not an address. The third fails quietly. The fourth is what this guide uses.

Recruiters are also easier to find than most roles, because they work in the open. But the title varies: "Recruiter", "Technical Recruiter", "Talent Acquisition Partner". Search on the title keyword, then check a sample before you export.

curl -s -X POST "https://api.leadocean.io/v1/people/search?count=true&limit=1" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": ["Recruiter"],
    "salesRegion": ["NORAM"],
    "emailStatus": ["verified", "catch_all_valid", "catch_all"]
  }' | jq '.meta | {total, totalIsExact, credits}'

Change salesRegion to EMEA, APAC or LATAM to size each region. I ran the same filter through the free MCP count_leads tool on 21 October 2026. These are mailable counts: emailStatus verified, catch_all_valid or catch_all, the default.

The four regions add to 248,873. The other 58,515 match the title but fall outside all four regions. The counts cover the title keyword only. Add "Talent Acquisition" to title if you want those people too.

The split matters for what you send. In-house recruiters read email about hiring tools, job boards and agencies. Agency recruiters read email about candidates, data and sourcing tools. Pick one audience per campaign, because one message rarely fits both. The count tells you which audience is big enough to test first.

Step 2: Pull a first page of recruiters

Run the search without count. Each person returned costs one record, so keep limit small while you test. Add emailStatus to keep only addresses worth sending to.

Two recruiter audiences behave differently. In-house recruiters hire for one company. Agency recruiters sell candidates to many. To pull agency recruiters, add "industry": ["Staffing and Recruiting"].

curl -s -X POST "https://api.leadocean.io/v1/people/search" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": ["Recruiter"],
    "country": ["US"],
    "emailStatus": ["verified"],
    "limit": 10
  }' > recruiters.json

jq '.meta | {count, credits, nextCursor}' recruiters.json

Search rows are thin. They carry has_email and email_status but no address. Use meta.nextCursor for the next page and pass it back unchanged.

Step 3: Reveal the email for the people you want

Pick the rows worth contacting and enrich each one by person_id. Send reveal_email=true, or the call returns no address. It costs one record per person, and the reveal adds nothing.

PERSON_ID=$(jq -r '.data[0].meta.source_ids.person_id' recruiters.json)

curl -s -X POST "https://api.leadocean.io/v1/people/enrich" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"person_id\": \"$PERSON_ID\", \"reveal_email\": true}" > reveal.json

jq '.data.contact_data.contact_emails' reveal.json

There is no name plus domain lookup. If you start from a company list, search by domain first, then enrich by person_id.

Step 4: Verify before you send

Check the status on every address. This reads the file from Step 3, so it spends nothing. A pattern such as first.last@acme.com or flast@acme.com only tells you how some company might name mailboxes. It does not tell you the mailbox exists.

If you only have a name and a domain, the pattern route is slow. You try jane.doe@, jdoe@ and jane@, send three emails, and learn from the bounces. Each bounce costs sender reputation. Search by domain for the recruiter instead, and read the status on the address you get back.

jq -r '.data.contact_data.contact_emails[]
  | select(.type == "work")
  | [.email, .status, .verified_batch_date] | @tsv' reveal.json

Use this rule:

• verified: send.
• catch_all: the domain accepts everything, so a bounce is possible. Send a small batch and watch it.
• risky, unknown, untested, role, invalid: do not send.

verified_batch_date is the date of the verification run. There is no refund for bounced emails, so this step protects your sender reputation.

Step 5: Export the whole list

When the count looks right, export instead of paging. Bulk CSV export is included on Solo and Agency, not on Free. One request takes up to 50,000 rows, with 500,000 a day. Every row costs one record, so set limit to what you will use.

curl -s -X POST "https://api.leadocean.io/v1/exports" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "recruiters-noram-verified",
    "filters": {
      "title": ["Recruiter"],
      "salesRegion": ["NORAM"],
      "emailStatus": ["verified"]
    },
    "limit": 500,
    "preset": "full",
    "caps": {"emails": 1}
  }'

Poll GET /v1/exports/{id} until status is done, then download the CSV. Headers are email_1_address and email_1_status. You can build the same export in the app (app.leadocean.io, Exports page), which shows the record price before you start.

What you get

The free count for the NORAM filter, from the MCP count_leads tool on 21 October 2026 (trimmed):

{
  "total": 186928,
  "totalIsExact": true,
  "totalAll": 582776,
  "credits": 0,
  "defaults": "Counted only addresses worth sending to (emailStatus: verified or catch_all_valid or catch_all), which is this tool's default."
}

A search row, as a response shape from the API reference. Values are placeholders and profile_data is abbreviated:

{
  "success": true,
  "data": [
    {
      "profile_data": {},
      "contact_data": {
        "has_email": true,
        "has_phone": false,
        "email_status": "verified",
        "email_type": "work"
      },
      "meta": { "source_ids": { "person_id": "1234567" } }
    }
  ],
  "meta": { "count": 1, "credits": 1, "nextCursor": "..." }
}

After the reveal, contact_data.contact_emails holds objects with email, type, status and verified_batch_date, for example jane.doe@acme.com, work, verified.

Troubleshooting

FAQ