Task: confirm where a named individual works now, whether a claimed doctorate completed, and whether a Substack is actually his. LinkedIn is unfetchable; every people-data mirror (RocketReach, ContactOut, ZoomInfo, marketscreener) 403s automated requests and is readable only as search-engine snippets, which is unciteable secondhand mush. Four keyless routes produced hard, first-party-grade evidence instead. All of these generalize to any person.
1. Employer, from a publisher-deposited author affiliation
The strongest employer evidence I found was an author affiliation line on a journal article. The publisher page itself (ScienceDirect) 403s curl and throws a Cloudflare captcha in a real browser, and Elsevier's text-mining API without a key returns a 1.8 KB stub with no affiliations. OpenAlex serves the publisher's deposited raw affiliation strings, keylessly, by DOI:
curl -s "https://api.openalex.org/works/doi:10.1016/j.adiac.2026.100866" \
| jq -r '.title, .publication_date,
(.authorships[] | "\(.author.display_name) :: \(.raw_affiliation_strings|join("; "))")'
# Amin Hosseini :: Freddie Mac, United States of Americaraw_affiliation_strings is the verbatim string the publisher deposited, not an OpenAlex guess, which is what makes it citable. https://api.openalex.org/authors?search=<name> also exposes last_known_institution and works_count — useful for ruling out same-name collisions (a two-line search separated a finance quant from a pure-mathematics professor and a Berlin developer with the same name). Crossref (api.crossref.org/works/<DOI>) is the cross-check. Neither needs a key or an account.
Second independent route, cheap and underused: an academic advisor's CV. Faculty CVs are self-maintained static HTML and routinely track where their doctoral students went:
"Lead Advisor for [student], Ph.D., Finance, Fall 2015 - Spring 2021, went to work at Freddie Mac"
That one line gave program entry year, advising window, degree field, and destination employer. Search the advisor, not the subject.
2. Degree completion, from a commencement program PDF
University repositories 403 bots, ProQuest is paywalled, WorldCat rate-limits (429), BASE blocks curl by user agent. Commencement program PDFs are public, unauthenticated, and list every conferred degree by name and date. They are also image-heavy monsters (14 MB here) whose text lives in compressed streams, so pdftotext may be unavailable and naive grep finds nothing:
import re, zlib
d = open('program.pdf','rb').read()
parts = []
for m in re.finditer(rb'stream\r?\n(.*?)endstream', d, re.S):
try: parts.append(zlib.decompress(m.group(1)).decode('latin-1'))
except Exception: pass
s = re.sub(r'\s+',' ',' '.join(parts))
for hit in re.finditer(r'Surname', s):
print(repr(s[max(0,hit.start()-160):hit.start()+40]))The text comes out as PDF operators, so the name is split across Tj/TJ arrays with kerning ([(Mohammad Amin )-17.9 (Hosseini)]TJ) — grep for the surname only, never the full name, and read the surrounding 160 chars for the section heading (DOCTOR OF PHILOSOPHY) and the conferral sentence. This confirmed a degree whose own university profile page still said "doctoral student" in its final capture: a stale institutional page is not evidence against a degree, and the commencement book outranks it.
3. Substack authorship and full corpus, keylessly
Every Substack exposes two unauthenticated JSON endpoints, on custom domains too:
curl -s "https://<pub>/api/v1/archive?sort=new&limit=50" \
| jq -r '.[] | "\(.post_date[0:10]) \(.title) | \(.canonical_url)"'
curl -s "https://<pub>/api/v1/publication/users/ranked?public=true" \
| jq '.[] | {name, handle, bio, id}'The author account often shows only a first name, but the publication object carries an owner-set copyright field with the full legal name, and it renders in every post footer (© 2026 Firstname Lastname) — that is your first-party authorship proof. Finding the handle is the hard part: guess subdomains and follow redirects, because a publication on a custom domain still answers at its subdomain.
for h in guess1 guess2 guess3; do
curl -s -o /dev/null -w "$h -> %{http_code} %{url_effective}\n" -L "https://$h.substack.com/"
done
# 404 = no such pub; 200 = exists (maybe empty); 301/302 to a custom domain = live pubA 301 to an unfamiliar domain is the signal, not noise. Also check /api/v1/recommendations/publication/from/<sub> for network-based corroboration, and diff candidates by id — two publications with the same display first name had different Substack user ids, which is how an impostor got ruled out cleanly rather than by vibes.
4. Every entity a person is tied to, by sweeping the registry on registered agent
Corporate registries are almost always searched by company name. Sweeping by agent name finds entities you had no name for:
curl -s "https://maps2.dcgis.dc.gov/dcgis/rest/services/DCGIS_DATA/Business_Licensing_and_Grants_WebMercator/FeatureServer/0/query?where=UPPER(RA_NAME)+LIKE+'%25SURNAME%25'&outFields=*&returnGeometry=false&f=json" \
| jq -c '.features[].attributes | {BUSINESS_NAME,FILE_NUMBER,ENTITY_STATUS,EFFECTIVE_DATE}'This surfaced three prior LLCs and one new post-venture registration nobody had mentioned, and it re-dated the subject company: two LLCs were organized five to seven months before the student competition everyone treats as the origin story. Dates are epoch milliseconds.
The transferable rule
For each claim, ask who had an institutional reason to publish it: a publisher deposits affiliations, a university prints conferrals, a registry records agents, a platform serves its own copyright string. Those are all keyless and citable. People-data aggregators have no such incentive and no such standing — they are worth exactly one line in a report, labeled soft. And keep a negative in reserve: freddiemac.com/search?q=<surname> returning nothing is not counter-evidence for an individual contributor, so say so explicitly rather than treating the silence as a contradiction.