Lead enrichment API 2026: endpoints, waterfall & vendors

A lead enrichment API is a programmatic interface that returns enriched B2B contact data, email, phone, title, company firmographics, tech stack, buying signals, in response to a request containing a partial identifier such as name + company or LinkedIn URL. It replaces manual CRM enrichment with real-time enrichment triggered at signup, form submission, or CRM record creation. Unlike broader B2B contact data workflows, a lead enrichment API is specifically the developer-facing layer: REST endpoints, JSON payloads, rate limits, webhooks. Typical response times run 200-800 ms per call, with match rates from 50-70% single-vendor to 85-95% in waterfall API stacking. This article details how a lead enrichment API works, the standard endpoints, integration patterns (webhook vs polling), 5 vendors compared, and 3 FAQ.

For a CTO, RevOps engineer, or product engineer wiring enrichment into a CRM, marketing automation, or product signup flow, this article covers the API mechanics, integration patterns, and vendor selection criteria.

On the agenda:

• What a lead enrichment API does (request/response mechanics)
• Standard endpoints: person, company, email, phone
• Waterfall API architecture (fallback chaining)
• Integration patterns: real-time, batch, webhook
• Rate limits, quotas, and error handling
• 5 vendor APIs compared (Clearbit, Apollo, Cognism, Lusha, Zeliq)
• Security: authentication, PII handling, GDPR
• 3 FAQ (match rate benchmarks, latency SLAs, cost per call)

Key takeaways:

• Definition: REST API returning enriched contact/company data from partial identifiers
• Common endpoints: /person/enrich, /company/enrich, /email/verify, /email/find
• Response time: 200-800 ms typical single-call, 1-3 s waterfall
• Match rate: 50-70% single-vendor, 85-95% waterfall 3-4 sources
• Authentication: API key (Bearer token) or OAuth 2.0
• Rate limits: typically 60-600 calls/min on paid plans, 5-25/min on free tier
• Pricing model: per credit (1 credit = 1 enriched contact) or per call
• GDPR: legitimate interest documented, opt-out honored via suppression list API

1. What a lead enrichment API does

At the simplest level, a lead enrichment API accepts a partial identifier and returns a complete contact profile. Example request:

POST /v1/person/enrich
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "first_name": "Marie",
  "last_name": "Dupont",
  "company_domain": "acme.com"
}

Example response:

{
  "person": {
    "email": "marie.dupont@acme.com",
    "email_status": "verified",
    "phone": "+33 6 12 34 56 78",
    "title": "VP Marketing",
    "linkedin_url": "https://linkedin.com/in/marie-dupont",
    "seniority": "vp",
    "department": "marketing"
  },
  "company": {
    "name": "Acme Corp",
    "domain": "acme.com",
    "employee_count": 245,
    "revenue_estimate": "10M-50M",
    "industry": "SaaS",
    "location": "Paris, France",
    "tech_stack": ["Salesforce", "HubSpot", "Amplitude"]
  },
  "meta": {
    "confidence_score": 92,
    "credits_used": 1,
    "response_time_ms": 340
  }
}

The API abstracts everything the caller doesn’t want to build: pattern matching, SMTP verification, cross-source aggregation, freshness checks.

Two enrichment surfaces

• Person enrichment: fills in a specific contact’s data
• Company enrichment: fills in company-level data (headcount, industry, tech stack)

Some vendors combine them into /enrich with mixed payload; others split them.

2. Standard endpoints

Most B2B lead enrichment APIs expose 4-6 core endpoints:

/person/enrich

Input: name + company (or LinkedIn URL). Output: email, phone, title, seniority, LinkedIn, work history.

/company/enrich

Input: company domain (or name). Output: employees, revenue, industry, HQ, funding, tech stack, buying signals.

/email/find

Input: name + company. Output: predicted email + confidence score.

/email/verify

Input: email address. Output: valid, invalid, catch_all, disposable, or unknown status.

/search

Input: filters (title contains X, industry Y, headcount Z). Output: paginated list of matching contacts. This is the sourcing endpoint (vs pure enrichment).

/bulk or /batch

Input: array of up to 100-1,000 records. Output: async job ID, results polled or delivered via webhook.

3. Waterfall API architecture

Single-vendor APIs deliver 50-70% match rate. To lift that to 85-95%, engineering teams implement a waterfall pattern:

def enrich_waterfall(name, company_domain):
    # Try vendor A first (highest match rate on target ICP)
    result = vendor_a.enrich(name, company_domain)
    if result.email_status == "verified":
        return result

    # Fallback to vendor B
    result = vendor_b.enrich(name, company_domain)
    if result.email_status == "verified":
        return result

    # Fallback to vendor C
    result = vendor_c.enrich(name, company_domain)
    if result.email_status == "verified":
        return result

    # Final fallback: pattern-match + SMTP verify
    return pattern_match_smtp(name, company_domain)

This pattern is why many teams don’t build direct integrations with each vendor. Instead they use waterfall-native platforms that expose one API on top of aggregated vendor stacks, dramatically reducing engineering time.

Waterfall trade-offs

• Latency: each fallback adds 200-500 ms; a full 4-vendor waterfall runs 1-3 seconds
• Cost: each vendor charges independently; a match on vendor A costs 1 credit, a match on vendor C costs 3 credits (A + B + C called)
• Match rate: 85-95% aggregated vs 50-70% single-vendor

4. Integration patterns

Pattern 1: Real-time synchronous

CRM webhook fires on new lead → your code calls enrichment API → response inserted into CRM record. Total latency: 500ms - 3s user-facing.

Use case: inbound form fills, product signups where enriched data drives immediate routing decisions.

Trade-off: user waits for API response; failed API call blocks the flow.

Pattern 2: Real-time async (queue-based)

CRM webhook → job pushed to queue → worker picks up → API called → CRM updated via reverse-webhook or PATCH.

Use case: same as pattern 1 but without blocking the user experience. Enrichment appears in CRM 5-30 seconds after signup.

Pattern 3: Batch scheduled

Cron job (daily/weekly) → export list of un-enriched CRM records → call /bulk endpoint → poll for completion → import results.

Use case: legacy CRM cleanup, bulk enrichment of a new imported list, monthly re-enrichment of stale records.

Pattern 4: Webhook-driven

Some enrichment APIs support “watch” endpoints: register a set of contacts, and the API pushes updates as data changes (job change, new signals). Bombora, 6sense, and a few others support this for intent data specifically.

5. Rate limits, quotas, error handling

Rate limits

Typical structures: - Free tier: 5-25 calls/min - Starter paid: 60-120 calls/min - Growth: 300-600 calls/min - Enterprise: 1,000+ calls/min or unlimited with fair-use

Vendors return 429 Too Many Requests with a Retry-After header. Client SDKs typically implement exponential backoff automatically.

Quotas

Distinct from rate limits: quotas are total credits per month. Example: 10,000 credits/month with 300/min rate limit means you can burst but not exceed monthly cap.

Error taxonomy

• 400, malformed request (missing required fields)
• 401, invalid API key
• 403, plan doesn’t include this endpoint
• 404, no match found (empty result, not an error in some vendors’ semantics)
• 429, rate limited
• 500-503, vendor server issue, retry with backoff

Well-designed clients treat 404/no-match distinctly from actual errors and log both to separate metrics.

6. 5 vendor APIs compared

Positioning only, no pricing (which changes frequently).

Clearbit (HubSpot)

Mature API, strong US firmographic + tech stack detection. Native HubSpot integration. Downside: weaker EU coverage.

Apollo.io

REST + GraphQL. Broadest single-vendor contact database (275M+). Combines sourcing (/search) + enrichment. Free tier available.

Cognism

European positioning, GDPR-compliant certified base. Strong on EMEA phone numbers and enterprise sales use cases.

Lusha

Focused on person enrichment, especially phones. Simple API, quick to integrate. Chrome extension companion.

Zeliq

450 million contact base, waterfall enrichment built-in through the API (no need to orchestrate 3-4 vendors yourself), integrated email verification, multichannel sequences as a follow-on. European positioning, GDPR by design.

Selection grid

• HubSpot ecosystem, US firmographic priority → Clearbit
• Broadest single-vendor DB, self-serve → Apollo
• Enterprise EMEA, strict GDPR → Cognism
• Phone-heavy use case → Lusha
• Waterfall as a service + European positioning → Zeliq

7. Security and PII handling

API authentication

• API Key + Bearer token: simplest, adequate for most B2B APIs. Rotate keys quarterly.
• OAuth 2.0: required when accessing on behalf of a user (e.g., CRM integration). More setup, but scoped tokens improve security.
• HMAC signed requests: some vendors sign requests with a shared secret for extra tamper resistance.

PII in transit and at rest

• All API calls over TLS 1.2+
• API keys never in source control (use environment variables, secret managers)
• Vendor should be SOC 2 Type II certified minimum for enterprise use
• For SMTP verification steps, refer to IETF RFC 5321 (SMTP) and Google Postmaster Tools for domain-side reputation monitoring

GDPR-compliant vendors

Look for: documented legitimate interest processes, active suppression list API (endpoint to submit opt-out requests), data processing agreement (DPA) signed with vendor. The CNIL 2025 sanctions summary documents €486M in enforcement actions, including €900k against SOLOCAL for prospecting emails sent without a valid legal basis, illustrating the direct exposure when supplier suppression workflow is missing.

Zeliq’s enrichment API

Zeliq exposes a lead enrichment API with waterfall built-in: one endpoint call queries 3-4 vendor sources under the hood, returns the best-matched result, and honors GDPR opt-out via a native suppression endpoint. Combined with 450 million B2B contacts, waterfall enrichment, integrated email verification, and multichannel sequences, it removes the engineering burden of stitching multiple vendor APIs.

See Zeliq’s API in action

8. Typical implementation timeline

For a mid-sized engineering team, a real-time enrichment API integration takes:

• Day 1-2: API sandbox setup, first successful /person/enrich call
• Day 3-5: CRM webhook receiver, enrichment orchestration service
• Day 6-8: error handling, retry logic, dead-letter queue for failures
• Day 9-11: monitoring (call volume, latency percentiles, match rate)
• Day 12-15: waterfall or fallback logic if using multiple vendors

Total: 2-3 weeks single engineer, 1 week with a dedicated backend engineer + waterfall-native API vendor.

9. Cost models

Common pricing structures:

Per credit

1 credit = 1 enriched contact. Bulk plans discount to $0.05-0.20/credit. Waterfall may charge per vendor called (a failed A → B → C match burns 3 credits).

Per call

Fixed cost per API call regardless of result. Simpler forecasting, but pay for 404 no-match responses too.

Bulk annual

Enterprise contracts: 100k-1M credits/year, negotiated flat rate. Best per-unit price but requires volume commitment.

10. Common integration pitfalls

Pitfall 1: Not caching results

Enriching the same contact twice = 2 credits. Cache results for 30-90 days minimum. Store last_enriched_at timestamp in your CRM.

Pitfall 2: Ignoring rate limits

Blasting 10,000 records at 500/min limits = throttled after 20 seconds. Batch endpoint (/bulk) or self-throttle to avoid 429 cascade.

Pitfall 3: Skipping email verification post-enrichment

Some APIs return unverified emails to widen match rate. Always call /email/verify or check email_status field before using in outbound.

Pitfall 4: No suppression check before send

Even a verified email may be on a GDPR opt-out list. Query the vendor’s suppression endpoint or maintain your own suppression table synced daily.

Pitfall 5: Hard dependency on single vendor

Single-vendor API = single point of failure. Vendor downtime, price hike, or data quality drift kills your pipeline. Waterfall or vendor-agnostic API layer mitigates this.

11. Frequently asked questions

What match rate should I expect from a lead enrichment API?

50-70% for a single-vendor API on typical B2B ICPs, rising to 85-95% with a waterfall of 3-4 vendors and pattern-match fallback. Match rate depends on three factors: (1) the vendor’s coverage of your target geography (US-heavy vendors underperform on EMEA/APAC), (2) the input quality (first-name + last-name + company_domain outperforms LinkedIn URL alone by 10-15 points), (3) whether the vendor verifies emails or returns pattern guesses. Concrete benchmarks: Apollo.io single-vendor returns email in ~55-65% of B2B ICPs, Cognism in EMEA at ~60-70%, Clearbit US at ~55-65%. A well-tuned waterfall (Zeliq’s built-in stack, or a self-orchestrated 4-vendor chain) lifts aggregate match to 85-95%. To measure your own vendor’s real match rate, run a controlled test: 500 in-ICP contacts, call the API, count contacts where email_status == "verified", that’s your real number, ignoring the vendor’s marketing benchmark. If it’s below 60% single-vendor or 85% waterfall, either the vendor is a poor fit for your geography or your input data quality is degrading match. Do NOT accept vendor claims of « 95% match rate » at face value; those numbers usually cite total contacts touched, not verified emails delivered.

What latency SLA should a lead enrichment API commit to?

200-500 ms p50, 800 ms-1.5s p95, 3s p99 for single-vendor calls; waterfall doubles to triples these numbers. Latency comes from: (1) database lookup on the vendor side (50-200 ms), (2) SMTP verification if performed synchronously (200-500 ms), (3) cross-vendor lookup in waterfall (each vendor adds ~300 ms), (4) network round-trip. Serious vendor SLAs commit to p95 < 1s and 99.9% uptime. If your integration pattern is synchronous user-facing (a signup form), keep total budget under 800ms, that means single-vendor call with async waterfall fallback if needed. For async patterns (queue-based), latency matters less; you can afford 3-5s waterfall. Watch for these anti-patterns: (a) API with no p99 disclosed in docs, usually means their p99 is bad (5-30s), (b) API that returns quickly but with unverified emails, you’ll pay downstream in bounces, (c) synchronous SMTP verification that doubles the response time versus caching verification results. Best-in-class APIs cache verifications for 30-60 days so repeat lookups skip the SMTP step and stay under 300 ms.

What does a lead enrichment API cost per contact?

$0.05-0.50 per verified enriched contact depending on volume commitment, plan tier, and how deep the enrichment payload runs. Cost breakdown by tier: (1) Pay-as-you-go / free tier of paid vendors: $0.20-0.50/contact effective; (2) Starter plans ($100-500/month): $0.15-0.30/contact; (3) Growth plans ($500-2,000/month): $0.10-0.20/contact; (4) Enterprise annual commits ($20k+/year): $0.05-0.10/contact. Waterfall multiplies cost: a match on vendor A costs 1 unit, on vendor B costs ~2 (A tried, then B), on vendor C costs ~3. So waterfall aggregate cost is typically 1.3-1.8x single-vendor cost per matched contact, but delivers 30-40 percentage points more match, so cost-per-verified-contact is often lower with waterfall despite higher per-call spend. Beyond direct API cost, factor in: engineering time to build waterfall (2-3 weeks vs 3-5 days for single-vendor), monitoring and error handling overhead (~10-15 hours/month), and vendor lock-in cost. Vendor-agnostic API layers (like Zeliq’s waterfall-as-a-service model) trade slightly higher per-call cost for lower engineering + integration cost, typically breaking even at 10k-50k contacts/year.

12. Conclusion: 3 actions to run

1. Prototype with a free-tier API within 7 days. Apollo, Clearbit, or Zeliq free credits are enough to test the workflow end-to-end on 20-50 contacts.

2. Measure real match rate on your ICP within 15 days. 500-contact sample, single-vendor call, count verified emails. Anything below 60% means either wrong vendor or bad input data.

3. Implement waterfall or vendor-agnostic API within 30 days if scaling above 5,000 contacts/month. Direct waterfall build takes 2-3 weeks; using a waterfall-native API layer cuts that to 3-5 days.

And if you want a single enrichment API with waterfall built in and GDPR-native suppression, try Zeliq for free: sourcing, enrichment, and multichannel sequences via API, no credit card required.

Further reading

• B2B contact data
• Cold email best practices
• Improve email open rates
• Cold email guide
• Multichannel prospecting guide