openapi: 3.1.0
info:
  title: Live Search Internal API
  license:
    name: Kleissner Investments v1.0
    url: 'https://intelx.io/licenses/LICENSE-1.0'
  version: 1.0.0
  description: |
    Internal search in "buckets" (e.g. usenet, web.public, whois).   Needs `X-Key` header authorization.
servers:
  - url: 'https://3.intelx.io'
paths:
  /authenticate/info:
    get:
      summary: Return a JSON object with the current user's API capabilities
      operationId: authenticateInfo
      description: |
        Return a JSON object with the current user's API capabilities
      responses:
        "200":
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/StatusResponse"
              example:
                added: "2025-11-04T22:45:01.1220324Z"
                buckets: ["darknet","dns","documents.public","dumpster","leaks.logs","leaks.private","leaks.public","pastes","usenet","web.gov.ru","web.public","whois"]
                bucketsh: ["Darknet","DNS","Documents » Public","Dumpster","Leaks » Logs","Leaks » Restricted","Leaks » Public","Pastes","Usenet","Web » Government » Ukraine","Web » Public","Whois"]
                preview: []
                previewh: []
                redacted: []
                redactedh: []
                paths:
                  /authenticate/info: { Path: "/authenticate/info", Credit: 0, CreditMax: 0, CreditReset: 0 }
                  /file/preview:       { Path: "/file/preview",       Credit: 9971, CreditMax: 10000, CreditReset: 2 }
                  /file/read:          { Path: "/file/read",          Credit: 998,  CreditMax: 1000,  CreditReset: 2 }
                  /file/treeview:      { Path: "/file/treeview",      Credit: 500,  CreditMax: 500,   CreditReset: 2 }
                  /file/view:          { Path: "/file/view",          Credit: 998,  CreditMax: 1000,  CreditReset: 2 }
                  /intelligent/search: { Path: "/intelligent/search", Credit: 479,  CreditMax: 500,   CreditReset: 2 }
                  /intelligent/search/export:  { Path: "/intelligent/search/export",  Credit: 100, CreditMax: 100, CreditReset: 2 }
                  /intelligent/search/result:  { Path: "/intelligent/search/result",  Credit: 0,   CreditMax: 0,   CreditReset: 0 }
                  /intelligent/search/statistic: { Path: "/intelligent/search/statistic", Credit: 0,  CreditMax: 0,   CreditReset: 0 }
                  /intelligent/search/terminate: { Path: "/intelligent/search/terminate", Credit: 0,  CreditMax: 0,   CreditReset: 0 }
                  /item/selector/list/export:  { Path: "/item/selector/list/export",  Credit: 1000, CreditMax: 1000, CreditReset: 2 }
                  /item/selector/list/human:   { Path: "/item/selector/list/human",   Credit: 1000, CreditMax: 1000, CreditReset: 2 }
                  /phonebook/search:           { Path: "/phonebook/search",           Credit: 100,  CreditMax: 100,  CreditReset: 2 }
                  /phonebook/search/export:    { Path: "/phonebook/search/export",    Credit: 100,  CreditMax: 100,  CreditReset: 2 }
                  /phonebook/search/result:    { Path: "/phonebook/search/result",    Credit: 0,    CreditMax: 0,    CreditReset: 0 }
                searchesactive: 0
                maxconcurrentsearches: 10
        401:
          description: Unauthorized

  /intelligent/search:
    post:
      summary: Initialize an intelligent search and return the ID of the task/search for further processing.
      operationId: intelligentSearch
      description: |
        Initialize an intelligent search and return the ID of the task/search for further processing.         
      parameters:
        - name: term
          in: query
          required: true
          style: form
          explode: true
          schema:
            type: string
          example: info@intelx.io
          description: |
            The term must be a strong selector. These selector types are currently supported:
              - Email address
              - Domain, including wildcards like *.example.com
              - URL
              - IPv4 & IPv6
              - CIDRv4 & CIDRv6
              - Phone Number
              - Bitcoin Address
              - MAC Address
              - IPFS Hash
              - UUID
              - Storage ID
              - System ID
              - Simhash
              - Credit card number
              - IBAN

            Soft selectors (generic terms) are not supported!
        - name: maxresults
          in: query
          required: true
          style: form
          explode: true
          schema:
            type: integer
          example: 100
          description: |
            - Tells how many results to query maximum per bucket.
        - name: buckets
          in: query
          required: true
          style: form
          explode: true
          schema:
            type: string
          example: pastes,darknet.i2p
          description: |
            - Specify the buckets to search
            - Example: buckets=[]
            - Example: buckets=['pastes', 'darknet.i2p']
        - name: timeout
          in: query
          required: true
          style: form
          explode: true
          schema:
            type: integer
          example: 30
          description: |
            - Set a timeout value for the search.
        - name: datefrom
          in: query
          required: true
          style: form
          explode: true
          schema:
            type: string
          example: 2020-01-01 00:00:00        
          description: |
            - Set a starting date to begin the search from.
            - Example: 2020-01-01 00:00:00
            - Example: 2020-01-01 12:00:00
        - name: dateto
          in: query
          required: true
          style: form
          explode: true
          schema:
            type: string
          example: 2020-02-02 23:59:59
          
          description: |
            - Set an ending date to finish the search from.
            - Example: 2020-02-02 23:59:59
            - Example: 2020-02-02 00:00:00
        - name: sort
          in: query
          required: true
          style: form
          explode: true
          schema:
            type: integer
          example: 4
          description: |
            - Define the way to sort search results.
            - 0: No sorting.
            - 1: X-Score ASC. Least relevant items first.
            - 2: X-Score DESC. Most relevant items first.
            - 3: Date ASC. Oldest items first.
            - 4: Date DESC. Newest items first.
        - name: media
          in: query
          required: true
          style: form
          explode: true
          schema:
            type: integer
          example: 0
          description: |     
            - Define the type of media to search for.
            - 0: Not set. (All media types)
            - 1: Paste document
            - 2: Paste User
            - 3: Forum
            - 4: Forum Board
            - 5: Forum Thread
            - 6: Forum Post
            - 7: Forum User
            - 8: Screenshot of a Website
            - 9: HTML copy of a website.
            - 10: Invalid, do not use.
            - 11: Invalid, do not use.
            - 12: Invalid, do not use.
            - 13: Tweet
            - 14: URL, high-level item having HTML copies as linked sub-items
            - 15: PDF document
            - 16: Word document
            - 17: Excel document
            - 18: Powerpoint document
            - 19: Picture
            - 20: Audio file
            - 21: Video file
            - 22: Container files including ZIP, RAR, TAR and others
            - 23: HTML file
            - 24: Text file
        - name: lookuplevel
          in: query
          required: false
          style: form
          explode: true
          schema:
            type: integer
          example: 0
          description: |
            lookuplevel
        - name: terminate
          in: query
          required: false
          style: form
          explode: true
          schema:
            type: string
          example: '61202067-543e-4e6a-8c23-11f9b8f008cf'
          description: |
            You can terminate previous search ids
      responses:
        '200':
          description: Success search
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: Result status
                  id:
                    type: string
                    example: '61202067-543e-4e6a-8c23-11f9b8f008cf'
                    pattern: '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
          links:
            LiveSearchResult:
              operationId: liveSearchResult
              parameters:
                id: $response.body#/id
        '400':
          description: Invalid data
        '401':
          description: Invalid api token
      security:
        - ApiKeyAuth: []
  /live/search/internal:
    get:
      summary: Internal live search
      operationId: liveSearch
      description: |
        Initiates the search; will return status and search Id on success.
      parameters:
        - name: term
          in: query
          required: true
          style: form
          explode: true
          schema:
            type: string
          example: info@intelx.io
          description: Search term
        - name: bucket
          in: query
          required: true
          schema:
            type: string
          example: 'usenet,web.public,whois'
          description: |
            CSV list of "buckets"  (pastes,darknet.tor,darknet.i2p,whois,usenet,leaks.private.general,leaks.private.comb,leaks.logs,leaks.public.wikileaks,leaks.public.general,dumpster,documents.public.scihub,dns)
        - name: skipinvalid
          in: query
          required: false
          schema:
            type: boolean
            default: false
          description: Skip invalid records
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            default: 100
            minimum: 1
            maximum: 1000
          description: Result limit
        - name: analyze
          in: query
          required: false
          schema:
            type: boolean
            default: false
          description: Analyze
        - name: datefrom
          in: query
          required: false
          schema:
            type: string
            format: date-time
            example: '2024-01-01 00:00:00'
            pattern: '^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$'
          description: Date from of the result in `YYYY-mm-dd HH:ii:ss` format. (Not RFC3339)
        - name: dateto
          in: query
          required: false
          schema:
            type: string
            format: date-time
            example: '2024-01-31 23:59:59'
            pattern: '^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$'
          description: Date to of the result in `YYYY-mm-dd HH:ii:ss` format. (Not RFC3339)
        - name: terminate
          in: query
          required: false
          schema:
            type: array
            items:
              type: string
          style: form
          explode: true
          description: You can terminate previous search ids
      responses:
        '200':
          description: Success search
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: Result status
                  id:
                    type: string
                    example: '61202067-543e-4e6a-8c23-11f9b8f008cf'
                    pattern: '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
          links:
            LiveSearchResult:
              operationId: liveSearchResult
              parameters:
                id: $response.body#/id
        '400':
          description: Invalid data
        '401':
          description: Invalid api token
      security:
        - ApiKeyAuth: []
  /live/search/result:
    get:
      summary: Fetch results from internal live search
      operationId: liveSearchResult
      description: |
        Initiates the search; will return status and search Id on success. Status = 2 means end of search result. Good manners is to wait 1s before each new result fetch.
      parameters:
        - name: id
          in: query
          required: true
          style: form
          explode: true
          schema:
            type: string
            pattern: '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
          example: '61202067-543e-4e6a-8c23-11f9b8f008cf'
          description: 'Search id from `/live/search/internal`, (e.g. "61202067-543e-4e6a-8c23-11f9b8f008cf")'
        - name: format
          in: query
          required: false
          schema:
            type: integer
            default: 0
          description: |
            Format Info 0 Text view, any non-printable characters shall be removed, UTF-8 encoding. 1 Hex view of data. 2 Auto-detect hex view or text view. 3 Picture view. 4 Not supported. 5 HTML inline view. Content will be sanitized and modified! 6 Text view of PDF. Content will be automatically converted. 7 Text view of HTML. 8 Text view of Word files (DOC/DOCX/RTF).
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            default: 100
            minimum: 1
            maximum: 1000
          description: Result limit
      responses:
        '200':
          description: Success search
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: integer
                    description: Result status
                  results:
                    type: string
                    description: Text response
        '400':
          description: Invalid data
        '401':
          description: Invalid api token
      security:
        - ApiKeyAuth: []
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-Key