Full phone number intelligence lookup
Full number intelligence (carrier / portability / SIM swap / roaming / live status) for a single E.164 phone number. Uses Devotel HLR as primary and Telnyx as fallback. When fields= is supplied (comma-separated or JSON array), the response also carries a dataPackages map keyed by the requested field names — each entry carries a discriminated status enum (available | coming_soon | not_implemented | error), a reason string, the intended provider, and an optional data payload when realised. The number_reputation field (Twilio Lookup v2 Number Reputation parity) returns a transparent 0-1 spam/fraud risk score in data.risk_score with a data.risk_bucket (low/medium/high), the data.factors that fired, and the contributing signals (line_type, reachable, ported, sim_swapped) — DERIVED from the same HLR/Telnyx upstream the lookup already fetched (flagged data.derived: true, NOT a paid reputation feed) whenever any usable HLR signal is present, and falls back to not_implemented only when no usable signal exists. call_forwarding returns a DERIVED, best-effort signal in data.call_forwarding (boolean) inferred from the HLR reachability dip — explicitly flagged data.derived: true with data.confidence: low (not an operator-asserted flag; the paid Telnyx forwarding add-on is not contracted) and falling back to coming_soon only when HLR returns no usable reachability signal. cnam and its Twilio-compat alias caller_name resolve against the Telnyx Lookup v2 caller-name dip and return available with the registered caller name, falling back to coming_soon only when Telnyx is not configured. Mirrors the Twilio Lookup v2 add-on selector.
Authorizations
Dashboard JWT token from Clerk
Path Parameters
Phone number in E.164 format. URL-encode the leading + (or use %2B). The route also accepts an unencoded + for back-compat — decodeURIComponent runs server-side.
Query Parameters
Optional Twilio-compat data-package selector. Comma-separated list of field names from the enumeration below (case-insensitive, deduped server-side, max 16 fields per request). Unknown field names reject the whole request with 400.