The Ultimate Guide to Professional Networks X-Ray Searches (2025 Update)

A definitive guide to searching for and extracting interesting professional networks profiles at scale with professional networks X-ray searches.

professional networks X-ray searches are a unique method that allows for much more freedom in terms of querying professional networks's B2B database for interesting companies, jobs, and individuals.

Technically, there are two similar but functionally different methods referred to as "the platform X-ray searches"–both being aimed at improving the process of searching for and extracting data from professional networking platforms search results.

Before I continue with the methods to do the platform X-ray search…

We've already built a full working demo of the platform X-ray search

That you can start using now: Free the platform Xray search tool

You can simply find profiles by searching based on:

• Job title

• Location by city

[!the platform Xray search demo by Enrich Layer](https://accountgram-production.sfo2.cdn.digitaloceanspaces.com/nubelaco_ghost/2025/01/the platform-Xray-search-demo-by-Enrich Layer.jpg)]( platform-xray-tool)We'll be adding on more features to the free tool, so subscribe and stay tuned ow, back to business.

An overview of some search methods

The first method uses Boolean operators (such as NOT, AND, OR) within the the platform search engine to improve search results.

For example, let's say you wanted to find and hire a content marketer or content strategist, but you wanted to make sure they were also writers themselves, as well as familiar with SEO standards.

Rather than sifting through thousands of profiles on the platform to find the right prospect, you could use the following search query to instantly find them, "content marketer" OR "content strategist" AND "writer" AND "SEO":

Quite a bit narrower than the original 385,00 results for "content marketer":

The second method for performing the platform X-ray searches is googling, but using operators to refine your results. The main difference is that we're using Google's search engine to find indexed the platform pages instead of the platform's search engine.

We also don't need to be logged into a the platform account to do the second method (hence the name "the platform X-ray search"), so there's no risk of getting banned. Most people prefer this method due to its scalability.

To give you an example, let's take our earlier example and take a look at the Google search results for the platform content writer and SEO:

Wow, that's a lot. Let's use a bit of magic and confine our search results to only professionalsocialnetwork.com:

Better. Now let's refine that search query further with operators: site:professionalsocialnetwork.com/in ("content marketer" OR "content strategist") AND "writer" AND "SEO":

Much better hat said, in this article, I'll be explaining how to use both methods to your advantage.

First, though, we need to talk a bit more about Boolean operators:

What are Boolean operators?

A Boolean operator is a word or symbol used in logic and search queries to combine or exclude keywords, resulting in more focused and specific search results. It's basically like searching on steroids.

Both the platform and Google's search engines support the following Boolean operators:

Operator Function Example Usage

AND Results must include all specified terms "developer AND manager"

OR Results may include any of the specified terms "sales OR marketing"

NOT Excludes results containing the specified term (Google uses "-" for NOT) "engineer NOT civil"

Quick heads up

We're about to get into further examples of utilizing search operators on the platform and performing the platform X-ray searches on Google, but before we do, I just wanted to give you a heads-up that for the examples throughout this article, we'll assume we're working in some type of HR role and need to find a given individual to fill a job role.

However, don't freak. If that doesn't apply to you, for example, if you're in sales or marketing, you can still use these same methods to find prospects for your use case as well. You'll just slightly modify your search query.

Okay, now let's put this into practice:

How to use search operators on the platform

On top of just Boolean operators, the platform also supports the following other search operators:

Operator Function Example

" " Search for an exact phrase "product manager"

( ) Group terms in complex queries (senior OR junior) AND engineer

first: Search by first name first:John

last: Search by last name last:Doe

These can further help refine our search results.

First up, the "AND" operator:

"AND" operators

So, let's say we need to find a software engineer who lives in Los Angeles and has experience with both Javascript and Linux.

Here's how we could use Boolean operators to help us here, "software engineer" AND "los angeles" AND "javascript" AND "linux":

That returns 374 results for profiles that match all of our search criteria. Here's the first profile:

"NOT" operators

Let's say for whatever reason, the company we're recruiting for doesn't hire programmers that use Kotlin.

The profile returned above also has Kotlin, the programming language, listed as a skill:

We can refine our search accordingly, "software engineer" AND "los angeles"AND "javascript" AND "linux" NOT "kotlin":

You'll see our search just slightly went down in the number of results returned. Our friend from earlier is also now no longer returned.

Filtering with location and putting everything together

We can take this one step further and assume everything above is true, but the company we're recruiting for has offices in both Los Angeles and New York City, so they could work in either and come into either respective office.

We can expand our original search by alternating it slightly, "software engineer" AND ("los angeles" OR "new york city") AND "javascript" AND "linux" NOT "Kotlin":

The amount nearly doubles by including New York City as an option. All profiles returned still fit our earlier search. Nice

Searching on the platform vs. Google

It may sound silly, but the main con of this way of searching for prospects is the fact you have to provide your own the platform account and be actively logged into it. You can't use the platform's search engine otherwise.

You'll also inevitably run into account limits and bans by doing this in bulk, and you can't access more than 1,000 results at any given time on a free the platform account, even if it tells you more results were returned.

It's simply not a scalable method, and you can't automate it for the most part.

This is why the platform operators, while they help improve search results, aren't quite as powerful as utilizing Google to perform a true the platform X-ray search without the same limitations as on the platform.

That said, let me show you how to do this in a bit of a better way by using Google:

Google's search operators

On top of AND, OR, and NOT, the platform, Google also supports additional search operators:

Operator Function Example

" " Searches for an exact phrase "climate change"

As mentioned above, Google uses "-" for NOT jaguar -car

site: Limits the search to a specific website or domain site:nytimes.com

related: Finds websites similar to a specified site related:time.com

filetype: Searches for a specific file type filetype:pdf "renewable energy"

intitle: Finds pages with a specific term in the title intitle:conservation

inurl: Searches for a specific term within the URL inurl:nutrition

intext: Searches for a specific term within the text of a page intext:"global warming"

Acts as a wildcard world * champion

AROUND(X) Finds terms that are within a certain number of words apart solar AROUND(3) energy

cache: Shows the most recent cached version of a web page cache:google.com

We can use these operators to our advantage.

How to do the platform X-ray searches

site:professionalsocialnetwork.com/in, will be our starting point and is what allows us to search on Google exclusively for the platform results.

(Note: Remember the part from earlier where I mentioned you can also do this for companies and jobs? The only different is that companies have a URL structure with /company instead, for example: https://www.professionalsocialnetwork.com/company/microsoft/, and jobs have a URL structure of /jobs, such as: `https://www.professionalsocialnetwork.com/jobs/search/?

the platform X-ray searches by job role

So, let's say we want to find a full-stack developer. Here's how we could do just that by using a the platform X-ray search, site:professionalsocialnetwork.com/in/ intitle:"full-stack developer":

11,100 results returned. All consisting of user profiles, having "full-stack developer" in their title:

the platform X-ray searches by job role and skill

Now, let's narrow that search down a bit and say we need them to be familiar with both Django and React, site:professionalsocialnetwork.com/in/ intitle:"full-stack developer" (django OR react):

6,560 results returned. With profiles such as this:

Excluding skills, roles, or anything from your the platform X-ray search

Next, let's say we want the same as above, but we want to exclude PHP programmers.

Here's how we could do that, site:professionalsocialnetwork.com/in/ intitle:"full-stack developer" intext:django OR intext:react -php:

Quite a bit fewer results, none of the profiles containing PHP within them as a skill:

I think you're probably just about getting the point, but I'll show you another trick:

Location-based filtering with the platform X-ray searches

One way of doing this is by simply adding the location into the search such as this, site:professionalsocialnetwork.com/in/ intitle:"full-stack developer" "new york city" (django OR react) -php:

Obviously narrowing the search results down, matching profiles like this:

170 results. Full of user profiles like this:

Not bad ou can get even more sophisticated with operators for an even more refined search results returned too.

Now let's talk a bit more about extracting this data from professional networking platforms:

Extracting your the platform X-ray search results

Ideally, we want to automate and systemize as much as possible. Especially if you're doing this at scale image for recruiting.

So, to help accomplish this, we can use a tool like Value Serp, which is a search engine result page API (ELI5: an API is like a fast food menu for data–it makes it easy to send/receive data between applications):

Its sole job is to scrape search result pages at scale and conveniently return the data. This will help us avoid any future issues like running into CAPTCHAs or just blatantly being blocked (you'll have to source proxies otherwise).

Value Serp starts out at $2.50 to scrape 1,000 Google results, so not bad, but there are also other similar services out there you can use, so if you find an equivalent service for less, it's one of those things that it either works or doesn't, so it should do just as good of a job.

Anyway, using Value Serp's API, we can extract the results of Google search queries at scale:

And we can conveniently export these results to a .CSV:

Here's our earlier Germany example, site:de.professionalsocialnetwork.com/in/ intitle:"full-stack developer" "frankfurt" (django OR react) -php exported:

You could do this to thousands of profiles at once, all fitting different the platform X-ray search queries or recruiting prospects.

This is where the platform X-ray searches truly shine: the programmatic, and scalable nature of it in comparison to traditional the platform prospecting methods.

Continuing on:

How to enrich user profiles

You now have a way to search for qualified prospects that meet specified criteria. You know how to search for professional networks profile URLs at scale and export the results without limitations.

But a professional networks profile URL alone doesn't do us much good.

Sure, you could click that URL and then manually send them a connection and try to message them, however, ideally, I would want their email and phone number for better touchpoints. All 3 if possible for multiple touchpoints.

So, what's an easy way to do that?

Well, no other than [Enrich Layer](https://Enrich Layer.com) of course; a B2B data provider and API.

Let me explain more:

Enrich Layer's Person Profile Endpoint

One of the key endpoints of Enrich Layer is the Person Profile Endpoint, which allows you to extract quite a bit of data from public user profiles, such as education, employment, skills, and everything you would find on a professional networks profile.

But it doesn't just extract the platform information. The B2B data provided by our API is also enriched with other data sources, which is our secret sauce.

Anyway, by using our Person Profile Endpoint, you can take your newly exported list of user profiles and enrich them, improving both the quantity and quality of data you have on any given prospect. And we can do it in a nearly automatic fashion that requires almost no effort or human intervention.

Using Enrich Layer's API for enrichment

In the above Value Serp API example I used their built-in API sandbox feature, however, for the following Enrich Layer example I'll be using a bit of Python, one of the easiest programming languages there is to use, to accomplish our professional networks profile enrichment.

(For the untechnical/non-programmers, there are many different ways to request data from an API. I chose Python because I'm familiar with it. You can easily use a free Python IDE like PyCharm on any device.)

That said, using a bit of Python, here's how we could pull quite a bit of information from any given professional networks profile:

`import requests

api_ response.raise_for_status() # Raise an exception for HTTP errors (e.g., 404, 500)

Print the response content and status code

print("Response Content:") print(response.text) print("\nResponse Status Code:", response.status_code) except requests.exceptions.RequestException as e: print("An error occurred during the HTTP request:", e) except Exception as ex: print("An unexpected error occurred:", ex)

In this example, it would enrich thethe platform_profile_urlofhttps://www.professionalsocialnetwork.com/in/russellbrunson/` (random example, he's a co-founder of the company ClickFunnels), immediately printing the results:

(Note: You could try this for yourself by creating an account here, we give you 15 free credits for testing a few things out upon account creation.)

The JSON result returned at the bottom looks like this:

"public_identifier": "russellbrunson", "profile_pic_url": "normal_url.com", "background_cover_image_url": null, "first_name": "Russell", "last_name": "Brunson", "full_name": "Russell Brunson", "follower_count": 81644, "occupation": "Owner at ClickFunnels", "headline": "New York Times Bestselling Author, Co-Founder of ClickFunnels", "summary": "Over the past 14 years, Russell has built a following of over 2 million entrepreneurs, sold over 450,000 copies of his books, popularized the concept of sales funnels, and co-founded ClickFunnels, a software company that helps 90,000 entrepreneurs quickly get their message out to the marketplace. \n\nRussell has been featured on major publications and websites such as Forbes, Entrepreneur Magazine, and The Huffington Post. He is also the host of the #1 rated business podcast, Marketing Secrets. In 2018, he was awarded \u2018Entrepreneur of the Year\u2019 in the Utah region by ey.com. Russell also regularly works with non-profits like Operation Underground Railroad and Village Impact.", "country": "US", "country_full_name": "United States of America", "city": null, "state": null, "experiences"...(continues on with more data)... You can see all of the different data points that can be returned by the Person Profile Endpoint here.

So, of course, you could individually put any given professional networks profile in your new Python script to enrich, but you could also automate the entire process, using a familiar file format such as a .CSV to store the data, such as your professional networks profile URLs.

How to easily enrich user profiles at scale

In fact, here's a script that does just that, reading an original .CSV named input_the platform_profiles.csv, full of just the platform URLs, enriches them, and then returns the results into a new .CSV named enriched_data.csv:

`import json import requests import csv

Your API key

API_

API endpoint for Person Profile

api_

Headers for the API request Input and output CSV file names

input_ output_

Function to extract experiences as a string

def extract_experiences(profile): []) return '; '.join([f"{exp.get('title', ”)} at {exp.get('company', ”)}" for exp in experiences])

Read professional networks profile URLs from the input CSV file

with open(input_file, 'r') as csvfile: the platform_ for row in reader]

Open the output CSV file for writing

with open(output_file, 'w',) as csvfile: 'the platform_url', 'full_name', 'profile_picture', 'current_occupation', 'country', 'city', 'state', 'experiences', 'skills', 'personal_emails', 'inferred_salary' ] writer.writeheader()

Loop through each professional networks profile URL

for the platform_url in the platform_urls: = requests.get(api_endpoint, if response.status_ 200:

Extracting skills and experiences.join(profile.get('skills', []))

experiences_

writer.writerow({ 'the platform_url': the platform_url, 'full_name': profile.get('full_name', ”), 'profile_picture': profile.get('profile_pic_url', ”), 'current_occupation': profile.get('occupation', ”), 'country': profile.get('country_full_name', ”), 'city': profile.get('city', ”), 'state': profile.get('state', ”), 'experiences': experiences_str, 'skills': skills, 'personal_emails': "; ".join(profile.get('personal_emails', [])), 'inferred_salary': profile.get('inferred_salary', {}).get('min', ”) # Example of handling nested data }) else: print(f"Failed to fetch data for {the platform_url}, Status Code: ")

print(f"Data exported to {output_file}") ![Example of the data returned into the new .CSV](https://accountgram-production.sfo2.cdn.digitaloceanspaces.com/nubelaco_ghost/2024/02/excel.png)There's no limit to this, so you can automate the enrichment of thousands and thousands of prospects/professional networks profile URLs directly generated from a tool like Value Serp. You could also integrate our API directly with Value Serp's API and skip the.CSV` with a little bit more effort.

But there's also another way of doing this as well…

Enrich Layer's Person Search Endpoint

Enrich Layer's Person Search Endpoint is another useful endpoint, especially for those in the recruitment sector. It allows you to search for individuals by using job roles, education, the companies they work for, and more.

So you'll be able to skip Value Serp and search directly within our existing dataset, full of millions and millions of user profiles (powered by LinkDB). And it's pretty darn simple to do so. Much similar to the above examples.

Searching based on job role and company

Let's say we want to hire a project manager, and we want them to be from a big tech background.

We'll use Microsoft as the source company (but we could of course use others, such as AWS), and then we can use the following Python script to search our dataset for anyone that matches being a "project manager" for "Microsoft" and return an enriched result:

`import json, requests 'country': 'US', 'current_role_title': '(?i)Project Manager', 'current_company_the platform_profile_url': 'https://www.professionalsocialnetwork.com/company/microsoft', 'page_size': '10', 'enrich_profiles': 'enrich', } try: response.raise_for_status() # Raise an exception for HTTP errors (e.g., 404, 500)

Print the response content and status code

print("Response Content:") print(response.text) print("\nResponse Status Code:", response.status_code) except requests.exceptions.RequestException as e: print("An error occurred during the HTTP request:", e) except Exception as ex: print("An unexpected error occurred:", ex) ` Here's an example profile:

It should be noted when using the enrich_profiles variable, you're limited to a page_size of 10 (which is why you see that limit above), but you can use our next_page function to pull large enriched lists with ease still.

Extracting all search results

Here's a slightly altered script that would endlessly keep going until there were no more results to return:

`import requests

api_ 'country': 'US', 'current_role_title': '(?i)Project Manager', 'current_company_the platform_profile_url': 'https://www.professionalsocialnetwork.com/company/microsoft', 'page_size': '10', 'enrich_profiles': 'enrich', } def fetch_page(url, params): if response.status_ 200: return response.json() else: print("Error:", response.status_code, response.text) return None

Fetch the initial page

response_ params)

Loop through pages

while response_data and response_data.get('next_page'):

Process the results here

for result in response_data['results']: print(result) # or any other processing

Fetch the next page

next_page_ if 'country' not in next_page_url: next_page_url += '& # Append 'country' parameter response_ {})

End of pagination

print("Completed fetching all pages.") `

Exporting search results to a .CSV

We could even take these results and export them to a .CSV like so:

`import requests import csv from urllib.parse import urlparse, parse_qs, urlencode, urlunparse

API credentials and endpoint configuration

api_

Parameters for the initial request

initial_ 'country': 'US', 'current_role_title': '(?i)Project Manager', 'current_company_the platform_profile_url': 'https://www.professionalsocialnetwork.com/company/microsoft', 'page_size': '10', 'enrich_profiles': 'enrich', }

Define the output CSV file and headers

output_ 'the platform_profile_url', 'full_name', 'profile_picture', 'background_cover_image_url', 'current_occupation', 'location' ]

def fetch_profiles(url, headers, """Fetch profiles from the given URL with specified parameters.""" if response.status_ 200: return response.json() else: print(f"Error: , {response.text}") return None

def add_country_to_url(url, country): """Add the 'country' parameter to the given URL.""" parsed_ query_ keep_blank_ query_params['country'] = [country] # Ensure 'country' parameter is included new_ new_ return new_url

def process_profile_data(profile): """Process and return the profile data in a dict format.""" return { 'the platform_profile_url': profile.get('the platform_profile_url', ”), 'full_name': profile.get('profile', {}).get('full_name', ”), 'profile_picture': profile.get('profile', {}).get('profile_pic_url', ”), 'background_cover_image_url': profile.get('profile', {}).get('background_cover_image_url', ”), 'current_occupation': profile.get('profile', {}).get('occupation', ”), 'location': f"{profile.get('profile', {}).get('city', ”)}, {profile.get('profile', {}).get('country_full_name', ”)}" }

Open the output CSV file for writing

with open(output_file,,) as file: writer.writeheader()

Fetch the initial page of profiles

profiles_ headers, initial_params)

if profiles_data and 'results' in profiles_data:

Iterate through each profile and write to CSV

for profile in profiles_data['results']: profile_ writer.writerow(profile_data)

Handle pagination

while 'next_page' in profiles_data: next_page_ initial_params['country']) profiles_ headers)

if profiles_data and 'results' in profiles_data: for profile in profiles_data['results']: profile_ writer.writerow(profile_data) else: break

print("Completed fetching and storing all profile data.") It would export them to a file namedenriched_profiles.csv` that looks like this:

Exporting phone numbers and emails with our Search API

Notice, however, how there is no phone number or email…

We could use our Personal Contact Number Lookup Endpoint and Personal Email Lookup Endpoint to change that.

Here's our updated Python script, keeping the same "project manager" at "Microsoft" example:

`import requests import csv from urllib.parse import urlparse, parse_qs, urlencode, urlunparse

API credentials and endpoint configuration

api_ # Replace with your actual API key contact_phone_ contact_email_

Parameters for the initial search request

search_ 'country': 'US', 'current_role_title': '(?i)Project Manager', 'current_company_the platform_profile_url': 'https://www.professionalsocialnetwork.com/company/microsoft', 'page_size': '10', 'enrich_profiles': 'enrich', }

Define the output CSV file and headers

output_ 'the platform_profile_url', 'full_name', 'profile_picture', 'background_cover_image_url', 'current_occupation', 'location', 'personal_phone_number', 'personal_email' ]

def fetch_contact_info(api_endpoint, the platform_profile_url): """Fetch personal contact info (phone number or email).""" Social Network_profile_url': the platform_profile_url} if response.status_ 200: if api_endpoint.endswith('personal-contact'): return ', '.join(data.get('numbers', [])) # Join all numbers into a single string elif api_endpoint.endswith('personal-email'): return ', '.join(data.get('emails', [])) # Join all emails into a single string else: print(f"Error fetching contact info from {api_endpoint}: , {response.text}") return ” # Return empty string if no data or in case of error

def add_country_to_url(url, country): """Add the 'country' parameter to the given URL.""" parsed_ query_ keep_blank_ query_params['country'] = [country] new_ new_ return new_url

def process_and_write_profiles(writer): """Fetch profiles and write their details, including contact info, to the CSV file."""

while url: if response.status_code != 200: print(f"Error fetching profiles: , {response.text}") break for profile in data.get('results', []):

Fetch contact information

email_ profile['the platform_profile_url']) phone_ profile['the platform_profile_url'])

Write profile and contact information to CSV

writer.writerow(, {profile['profile']['country_full_name']}", 'personal_phone_number': phone_info, 'personal_email': email_info, })

Prepare for the next page

next_page_ if next_page_url: search_params['country']) # Since all needed params are in the URL, clear params to avoid duplication else: break

Open the output CSV file for writing and process profiles

with open(output_file,,) as file: writer.writeheader() process_and_write_profiles(writer)

print("Completed fetching and storing all profile data with contact information.") Which will export an enriched list of prospects, including contact and email (providing we have it available), to a file namedenriched_profiles_with_contacts.csv`:

I've gone ahead and blurred all contact information, but as you can see, it pulled additional contact information for many of our earlier prospects.

Now we're really talking…

There are 100 different ways you could do this, even going as far as to directly integrate outreach channels straight into our API (sending emails, messages, automatically) and beyond.

But, as you can see, our Search API is quite powerful, and you can avoid many of the cons of a traditional professional networking platforms search, or the platform X-ray search.

By the way, if you're entirely uninterested in coding…

I don't know how you got this far. Nevertheless, we do have a no-code option that anyone could use.

It's a Google Sheets extension named [Sapiengraph](https://sapiengraph.com/?utm_ that'll allow you to conveniently pull all of this same data into a Google Sheets spreadsheet.

It won't have the level of functionality or customizability as our API, however, it's still very effective and [worth checking out](https://sapiengraph.com/?utm_

Additional tips

There are several other API endpoints we offer that could be of value to you, but I'm not going to mention every single one of them here for the sake of brevity.

The most immediately relevant not already shown above is our Employee Listing Endpoint, which works similarly to our Person Search Endpoint, but instead searches a given company for a matching job role.

Outside of that, for a full understanding of what's possible, I would read over our documentation here.

You now have three options

• You can take your newly gained knowledge and do nothing with it.

• You can take your newly gained knowledge about the platform X-ray searches and implement it.

• You can take your newly gained knowledge about the platform X-ray searches and our B2B enrichment APIs and fully utilize it to your advantage.

The choice is yours to make, but, if you're thinking what I'm thinking in my admittedly very biased position…

Create your account today

It's free to create a Enrich Layer account and you start out with a few trial credits to test things out. What do you have to lose?

That said, you can click right here to create your account for free now.

If you're interested in learning more about our credit usage system and pricing policy first, you can do that here.

Conclusion

Whether you're looking to fill a job role, find a sales lead, or beyond, the platform X-ray searches offer a scalable and programmatically friendly way to access the vast amounts of B2B data available on the platform. It just requires a bit of technical know-how.

But, if you want the most convenient way, you can skip the platform X-ray searches altogether and [use a B2B data provider and API like ours to handle all of the headaches for you](https://Enrich Layer.com) (like scraping user profiles and Google SERPs). You can just flawlessly pull rich B2B data instead.

Thanks for reading, and here's to both more and better-quality data P.S. Have any questions about Enrich Layer? Feel free to reach out to us at "[email protected]" and we'll be glad to help