openapi: 3.1.0 info: title: HackNotice API version: '2026-08-22' summary: External threat-intelligence API for first-party, third-party and end-user breach monitoring, threat research and vendor assessments. description: 'HackNotice''s REST API over its external threat-intelligence platform: credential and breach alerts for first-party domains, third-party vendors and end users; dark-web / hacker-forum research search; and AI-assisted vendor security assessments. PROVENANCE: this document was DERIVED by API Evangelist from HackNotice''s own published Postman collection "HackNotice-API", reached at https://api-docs.hacknotice.com (HTTP 301 -> https://documenter.getpostman.com/view/806684/2sBXiri7pT), linked from HackNotice''s help centre article "API". Paths, methods, parameters, request bodies and tags are transcribed from that collection; nothing was invented. Concrete record ids in the collection''s example URLs were templated into path parameters, and every token-shaped example value was redacted. HackNotice publishes a rate limit of 1 query per second, and states that API access is granted to approved accounts only after a 30-minute consultation call.' termsOfService: https://hacknotice.com/businesstandc/ contact: name: HackNotice Support url: https://hacknotice.zendesk.com/hc/en-us email: support@hacknotice.com x-api-evangelist-derived-from: https://api-docs.hacknotice.com servers: - url: https://extensionapi.hacknotice.com description: HackNotice production API host, as declared by HackNotice's own first-party n8n node (API_BASE_URL in credentials/HackNoticeApi.credentials.ts, github.com/HackNotice/n8n-nodes-hacknotice). The published Postman collection ships an internal {{url}} variable pointing at a developer VPN host, which is not the production base. tags: - name: All Business Accounts description: Authentication, leak/leakfile search, customer records, metrics, habits, downloads, utilities and item notes shared by every business account. - name: Research Service Accounts description: Threat-research search over terms, filenames and word pools, plus saved searches. - name: Third Party Accounts description: 'Third-party vendor monitoring: hacks, hack updates, watchlists, alerts and vendor security assessments.' - name: Domain Business Accounts description: 'First-party domain monitoring: domain watchlists, domain leaks, domain alerts and downloads.' - name: Enduser Business Accounts description: 'End-user monitoring: end-user watchlists, end-user leaks and end-user alerts.' - name: Deprecated description: Endpoints HackNotice groups as deprecated in its published collection (dark hash alerts, Teams accounts). - name: Alerts description: Cross-service alert retrieval. - name: Calc endpoints description: Aggregate/rollup calculation endpoints for breaches, threat actors and per-service alerts. security: - jwtAuth: [] - apiKeyAuth: [] paths: /assessmentdatafiles/count: post: tags: - Third Party Accounts summary: Get the count of documents operationId: postGetTheCountOfDocuments2 description: 'Folder: Assessments / assessment data files. Get the count of documents' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentdatafiles/download/{documentId}: get: tags: - Third Party Accounts summary: Download a doc operationId: getDownloadADoc2 description: 'Folder: Assessments / assessment data files. Download a Doc Purpose: Download the binary file for an assessment data file. Path Parameters Parameter Description docId Assessment data file document ID Behavior Streams file content from private storage Sets Content-Disposition using stored filename when available Responses Status Description 200 Binary file stream 400 Missing docId path parameter 401 Unauthorized user 404 File not found' parameters: - name: documentId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentdatafiles/invited: post: tags: - Third Party Accounts summary: Create a doc operationId: postCreateADoc5 description: 'Folder: Assessments / assessment data files / invited assessment data files. Create Invited Assessment Data File Purpose: Upload a file for an assessment shared with the invited user. Auth Authorization: JWT REDACTED_EXAMPLE_TOKEN Content Type multipart/form-data Form-Data Fields Field Type Required Description assessment_id text Yes Target assessment ID the invited user can access data file Yes File to upload filename text No Optional display filename override note text No Optional note/description Responses Status Description 200 Created file metadata document 400 Missing assessment_id or missing data file field 401 Unauthorized user or invite access not valid' requestBody: required: true content: multipart/form-data: schema: type: object properties: data: type: string format: binary assessment_id: type: string filename: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentdatafiles/invited/count: post: tags: - Third Party Accounts summary: Get the count of documents operationId: postGetTheCountOfDocuments description: 'Folder: Assessments / assessment data files / invited assessment data files. Get the Count of Documents Purpose: Return the total number of invited assessment data files for one assessment. Request Body Field Type Required Description assessment_id string Yes Assessment ID to count files for Body Example { "assessment_id": "69aadd3f4620e8b72b9ffffc" } Responses Status Description 200 Numeric count (for example 4 ) 400 Missing assessment_id 401 Unauthorized user or invite access not valid' requestBody: required: true content: application/json: schema: type: object properties: assessment_id: type: string example: assessment_id: 69aadd3f4620e8b72b9ffffc responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentdatafiles/invited/download/{documentId}: get: tags: - Third Party Accounts summary: Download a doc operationId: getDownloadADoc description: 'Folder: Assessments / assessment data files / invited assessment data files. Download a Doc Purpose: Download the binary file for an invited assessment data file. Path Parameters Parameter Description docId Assessment data file document ID Behavior Streams file content from private storage Sets Content-Disposition using stored filename when available Responses Status Description 200 Binary file stream 400 Missing docId path parameter 401 Unauthorized user or invite access not valid 404 File not found' parameters: - name: documentId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentdatafiles/invited/page/{pageNum}: post: tags: - Third Party Accounts summary: Read a page of documents operationId: postReadAPageOfDocuments3 description: 'Folder: Assessments / assessment data files / invited assessment data files. Read a Page of Documents Purpose: Return a paginated list of invited assessment data files for one assessment. Path Parameters Parameter Description pageNum Zero-based page index. Page size is fixed at 50 . Request Body Field Type Required Description assessment_id string Yes Assessment ID to list files for Body Example { "assessment_id": "69aadd3f4620e8b72b9ffffc" } Responses Status Description 200 Array of file metadata documents (newest first) 400 Missing assessment_id 401 Unauthorized user or invite access not valid' parameters: - name: pageNum in: path required: true schema: type: integer requestBody: required: true content: application/json: schema: type: object properties: assessment_id: type: string example: assessment_id: 69aadd3f4620e8b72b9ffffc responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentdatafiles/invited/{documentId}: get: tags: - Third Party Accounts summary: Read a doc operationId: getReadADoc6 description: 'Folder: Assessments / assessment data files / invited assessment data files. Read a Doc Purpose: Return metadata for one invited assessment data file by document ID. Path Parameters Parameter Description docId Assessment data file document ID Responses Status Description 200 File metadata document 400 Missing docId path parameter 401 Unauthorized user or invite access not valid 404 File not found' parameters: - name: documentId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - Third Party Accounts summary: Delete a doc operationId: deleteADoc6 description: 'Folder: Assessments / assessment data files / invited assessment data files. Delete a Doc Purpose: Delete an invited assessment data file by document ID. Path Parameters Parameter Description docId Assessment data file document ID Behavior Invited users can only delete files they uploaded themselves Valid invite/share access to the related assessment is still required Deletes both file record and underlying file object Responses Status Description 200 File successfully deleted 400 Missing docId path parameter 401 Unauthorized user or invite access not valid 404 File not found or user did not upload this file 200 Response Example { "message": "File successfully deleted" }' parameters: - name: documentId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentdatafiles/page/{pageNum}: post: tags: - Third Party Accounts summary: Read a page of documents operationId: postReadAPageOfDocuments4 description: 'Folder: Assessments / assessment data files. Read all domains.' parameters: - name: pageNum in: path required: true schema: type: integer responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentdatafiles/{fileId}: get: tags: - Third Party Accounts summary: Read a doc operationId: getReadADoc7 description: 'Folder: Assessments / assessment data files. Read a Doc Purpose: Return metadata for one assessment data file by document ID. Path Parameters Parameter Description docId Assessment data file document ID Responses Status Description 200 File metadata document 400 Missing docId path parameter 401 Unauthorized user 404 File not found' parameters: - name: fileId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Third Party Accounts summary: Update a doc operationId: putUpdateADoc4 description: 'Folder: Assessments / assessment data files. Update a Doc Purpose: Update metadata for one assessment data file. Path Parameters Parameter Description docId Assessment data file document ID Request Body (Allowed Field) Field Type Description note string Updates note/description for the file Body Example { "note": "Updated evidence note" } Responses Status Description 200 Updated file metadata document 400 Missing docId path parameter 401 Unauthorized user 404 File not found' parameters: - name: fileId in: path required: true schema: type: string requestBody: required: true content: application/json: schema: type: object properties: note: type: string example: note: note2 responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - Third Party Accounts summary: Delete a doc operationId: deleteADoc7 description: 'Folder: Assessments / assessment data files. Delete a Doc Purpose: Delete an assessment data file by document ID. Path Parameters Parameter Description docId Assessment data file document ID Behavior Deletes both file record and underlying file object Responses Status Description 200 File successfully deleted 400 Missing docId path parameter 401 Unauthorized user 404 File not found 200 Response Example { "message": "File successfully deleted" }' parameters: - name: fileId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentevents: post: tags: - Third Party Accounts summary: Create assessment event operationId: postCreateAssessmentEvent description: 'Folder: Assessments / assessmentevents. Create a new assessment event for the authenticated customer. Access Rule User must belong to an allowed customer type and be authenticated. Request Body Field Type Required Description assessment_id string ✅ Required The ID of the assessment this event belongs to. action string Optional The action being recorded (e.g. review_started ). assessor_notes string Optional Notes added by the assessor. company_notes string Optional Notes added by the company/vendor. file_link string Optional URL to a linked evidence file. assessment_data_file_id string Optional ID of an uploaded assessment data file. complete boolean Optional Whether the event marks the assessment as complete. Body Example: { "assessment_id": "64f1c8...", "action": "review_started", "assessor_notes": "Initial review completed", "company_notes": "Vendor provided SOC report", "file_link": "https://example.com/evidence.pdf", "assessment_data_file_id": "65ab...", "complete": false } Server-side Behavior The following fields are set automatically by the API and should not be included in the request body: customer_id user_id timestamp Responses Status Description 200 OK Event successfully created. Returns the created event object. 400 Bad Request assessment_id is missing from the request body. 401 Unauthorized User is not authenticated or token is invalid.' requestBody: required: true content: application/json: schema: type: object properties: assessment_id: type: string action: type: string assessor_notes: type: string company_notes: type: string file_link: type: string complete: type: boolean example: assessment_id: 69a73dc2c0deb2b4840f44fc action: review_started assessor_notes: Initial review completed. Waiting on vendor responses. company_notes: Vendor requested 2-week extension. file_link: https://storage.example.com/assessments/evidence.pdf complete: false responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentevents/count: post: tags: - Third Party Accounts summary: Count assessment events operationId: postCountAssessmentEvents description: 'Folder: Assessments / assessmentevents. Return the total number of assessment events for the authenticated customer. Request Body All fields are optional. If no body is provided, the count covers all events for the caller''s customer. Field Type Required Description assessment_id string Optional If provided, restricts the count to events belonging to this assessment. Body Example: { "assessment_id": "64f1c8..." } Behavior Counts only records scoped to the caller''s customer_id . If assessment_id is provided, returns the count for that specific assessment only. Responses Status Description 200 OK Returns a numeric count of matching assessment events. 401 Unauthorized User is not authenticated or token is invalid. 200 Response Example: 42' requestBody: required: true content: text/plain: schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentevents/invited: post: tags: - Third Party Accounts summary: Create invited assessment event operationId: postCreateInvitedAssessmentEvent description: 'Folder: Assessments / assessmentevents / invited. Creates a new event, note, or action for an assessment that the invited user has access to. Access Rule The user must have a valid invite or share link for the specified assessment_id . Request Body (JSON) Field Type Required Description assessment_id string ✅ Yes The ID of the assessment to attach the event to action string No The type of action (e.g. comment , review_started ) assessor_notes string No Notes added by the assessor company_notes string No Notes added by the company file_link string No URL to an associated file assessment_data_file_id string No ID of an uploaded assessment data file complete boolean No Whether the assessment is marked as complete Example: { "assessment_id": "64f1c8...", "action": "comment", "assessor_notes": "Reviewed controls", "company_notes": "Need SOC2 evidence", "file_link": "https://example.com/file.pdf", "assessment_data_file_id": "65ab...", "complete": false } Responses Status Description 200 OK Event created successfully. Returns the created event object. 400 Bad Request assessment_id is missing from the request body. 401 Unauthorized User is not authorized for the specified assessment.' requestBody: required: true content: application/json: schema: type: object properties: assessment_id: type: string action: type: string assessor_notes: type: string company_notes: type: string file_link: type: string complete: type: boolean example: assessment_id: 69a73dc2c0deb2b4840f44fc action: review_started assessor_notes: Initial review completed. Waiting on vendor responses. company_notes: Vendor requested 2-week extension. file_link: https://storage.example.com/assessments/evidence.pdf complete: false responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentevents/invited/page/{pageNum}: post: tags: - Third Party Accounts summary: List invited assessment events (paginated) operationId: postListInvitedAssessmentEventsPaginated description: 'Folder: Assessments / assessmentevents / invited. Returns up to 50 events for a single assessment, sorted by newest first. Path Parameters Parameter Description pageNum Zero-based page number. Page 0 returns the first 50 records. Request Body (JSON) Field Type Required Description assessment_id string ✅ Yes The ID of the assessment to retrieve events for Note: assessment_id is required in the request body even though this is a paginated read operation, due to the current implementation. Example: { "assessment_id": "64f1c8..." } Responses Status Description 200 OK Returns an array of event objects for the assessment. 400 Bad Request assessment_id is missing from the request body. 401 Unauthorized The invite or share link is invalid or has expired.' parameters: - name: pageNum in: path required: true schema: type: integer requestBody: required: true content: application/json: schema: type: object properties: assessment_id: type: string example: assessment_id: 69a73dc2c0deb2b4840f44fc responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentevents/invited/{documentId}: get: tags: - Third Party Accounts summary: Get one invited assessment event operationId: getOneInvitedAssessmentEvent description: 'Folder: Assessments / assessmentevents / invited. Fetch a single assessment event by its ID. Access Rule The user must have valid access to the assessment the event belongs to. Path Parameters Parameter Description docId The ID of the event to retrieve. Responses Status Description 200 OK Returns the event object. 400 Bad Request docId is missing. 401 Unauthorized User does not have valid access to the assessment. 404 Not Found No event found for the given ID.' parameters: - name: documentId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - Third Party Accounts summary: Delete one invited assessment event operationId: deleteOneInvitedAssessmentEvent description: 'Folder: Assessments / assessmentevents / invited. Delete an event previously created by the invited user. Path Parameters Parameter Description docId The ID of the event to delete. Responses Status Description 200 OK Event successfully deleted. 400 Bad Request docId is missing. 401 Unauthorized User does not have valid access. 404 Not Found Event not found, or not owned by this invited user. 200 Response Example: { "message": "Assessment event successfully deleted" }' parameters: - name: documentId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Third Party Accounts summary: Update one invited assessment event operationId: putUpdateOneInvitedAssessmentEvent description: 'Folder: Assessments / assessmentevents / invited. Update an event previously created by the invited user. Path Parameters Parameter Description docId The ID of the event to update. Request Body (JSON) Only the following fields can be updated: Field Type Description action string The type of action (e.g. comment ) assessor_notes string Notes added by the assessor company_notes string Notes added by the company file_link string URL to an associated file assessment_data_file_id string ID of an uploaded assessment data file complete boolean Whether the assessment is marked as complete Example: { "assessor_notes": "Updated after follow-up", "complete": true } Responses Status Description 200 OK Returns the updated event object. 400 Bad Request docId is missing. 401 Unauthorized User does not have valid access. 404 Not Found Event not found, or not owned by this invited user.' parameters: - name: documentId in: path required: true schema: type: string requestBody: required: true content: application/json: schema: type: object properties: file_link: type: string example: file_link: https://storage.example.com/assessments/evidence2.pdf responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentevents/page/{pageNum}: post: tags: - Third Party Accounts summary: List assessment events (paginated) operationId: postListAssessmentEventsPaginated description: 'Folder: Assessments / assessmentevents. Get a paginated list of assessment events for the authenticated customer. Path Parameters Parameter Type Description pageNum integer Zero-based page index. Use 0 for the first page. Request Body (Optional) Field Type Description assessment_id string If provided, filters results to events belonging to this assessment. Example: { "assessment_id": "64f1c8..." } Behavior Returns only events belonging to the authenticated user''s customer_id If assessment_id is provided, results are filtered to that assessment Results are sorted by timestamp descending (most recent first) Page size is fixed at 50 events per page Responses Status Description 200 OK Returns an array of assessment event objects. 401 Unauthorized User is not authenticated or token is invalid.' parameters: - name: pageNum in: path required: true schema: type: integer requestBody: required: true content: application/json: schema: type: object properties: assessment_id: type: string example: assessment_id: 69a73dc2c0deb2b4840f44fc responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentevents/{eventId}: get: tags: - Third Party Accounts summary: Get one assessment event operationId: getOneAssessmentEvent description: 'Folder: Assessments / assessmentevents. Fetch a single assessment event by its ID, scoped to the authenticated customer. Path Parameters Parameter Type Description docId string The ID of the assessment event to retrieve. Behavior Returns only events belonging to the authenticated user''s customer_id Returns null if the event exists but does not belong to your customer scope Responses Status Description 200 OK Returns the event object, or null if not found under your customer scope. 400 Bad Request docId path parameter is missing. 401 Unauthorized User is not authenticated or token is invalid.' parameters: - name: eventId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - Third Party Accounts summary: Delete one assessment event operationId: deleteOneAssessmentEvent description: 'Folder: Assessments / assessmentevents. Delete an existing assessment event, scoped to the authenticated customer. Path Parameters Parameter Type Description docId string The ID of the assessment event to delete. Responses Status Description 200 OK Event successfully deleted. 400 Bad Request docId path parameter is missing. 401 Unauthorized User is not authenticated or token is invalid. 200 Response Example: { "message": "Assessment event successfully deleted" }' parameters: - name: eventId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Third Party Accounts summary: Update one assessment event operationId: putUpdateOneAssessmentEvent description: 'Folder: Assessments / assessmentevents. Update selected fields of an existing assessment event, scoped to the authenticated customer. Path Parameters Parameter Type Description docId string The ID of the assessment event to update. Request Body Only the following fields may be updated: Field Type Description action string The action associated with the event. assessor_notes string Notes added by the assessor. company_notes string Notes added by the company. file_link string URL link to a related file. assessment_data_file_id string ID of an associated assessment data file. complete boolean Marks the event as complete or incomplete. Example: { "assessor_notes": "Reviewed and approved", "complete": true } Responses Status Description 200 OK Returns the updated event object. 400 Bad Request docId path parameter is missing. 401 Unauthorized User is not authenticated or token is invalid. 404 Not Found Event not found within your customer scope.' parameters: - name: eventId in: path required: true schema: type: string requestBody: required: true content: application/json: schema: type: object properties: assessor_notes: type: string example: assessor_notes: Initial review completed. Waiting on vendor responses. Overdue responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentinvites: post: tags: - Third Party Accounts summary: Create invite operationId: postCreateInvite description: 'Folder: Assessments / assessmentinvites. Create Invite Purpose: Create a new invite/share record for a target item. Request Body Required Fields Field Type Description email string Email address of the person being invited itemType string Type of item being shared (e.g. "assessment" ) item_id string ID of the item being shared Optional Fields Field Type Description assessment_id string Associated assessment ID breach_id string Associated breach ID company_id string Associated company ID expiration_date string Explicit expiration date for the invite expireAfterDays number Number of days until the invite expires invited_user_id string ID of the user being invited (if already known) Convenience mapping: If company_id or breach_id is provided, the API will automatically set itemType and item_id — you do not need to set them manually in that case. Body Example { "email": "user@example.com", "itemType": "assessment", "item_id": "64f1c8...", "assessment_id": "64f1c8...", "expireAfterDays": 30 } Validation Condition Response Invalid itemType 400 Bad Request Invalid email 401 with validation message Responses Status Description 200 Created invite object (sanitized) 401 Unauthorized or missing required data' requestBody: required: true content: application/json: schema: type: object properties: assessment_id: type: string email: type: string company_id: type: string expiration_date: type: string example: assessment_id: 69a73dc2c0deb2b4840f44fc email: assessor@example.com company_id: 5b68ac28ab23eac48031a8fc expiration_date: '2025-03-31T23:59:59.000Z' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentinvites/activate/{inviteCode}: post: tags: - Third Party Accounts summary: Activate invite operationId: postActivateInvite description: 'Folder: Assessments / assessmentinvites. Activate Invite Purpose: Mark an invite as activated. Path Parameters Parameter Description inviteCode The unique invite code from the invite link Validation Condition Result Invite does not exist 404 not found inviteCode missing 400 bad request Invite already activated 400 bad request Invite is expired 400 bad request expiration_date has passed Invite is automatically marked expired=true and request fails with 400 Responses Status Description 200 Updated invite object (sanitized), including activation fields 400 Missing code, already activated, or expired 404 Invite not found' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] parameters: - name: inviteCode in: path required: true schema: type: string /assessmentinvites/code/{inviteCode}: get: tags: - Third Party Accounts summary: Read invite by code operationId: getReadInviteByCode description: 'Folder: Assessments / assessmentinvites. Read Invite by Code Purpose: Resolve invite details from an invite code, used during the invite landing/acceptance flow. Path Parameters Parameter Description inviteCode The unique invite code from the invite link Responses Status Description 200 Invite object (sanitized) 400 Missing inviteCode path parameter 404 Invite not found for the provided code' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] parameters: - name: inviteCode in: path required: true schema: type: string /assessmentinvites/count: post: tags: - Third Party Accounts summary: Count invites operationId: postCountInvites description: 'Folder: Assessments / assessmentinvites. Count Invites Purpose: Count invites for the authenticated customer with optional filters. Request Body (Optional Filters) Field Type Description assessment_id string Filter by associated assessment ID breach_id string Filter by associated breach ID company_id string Filter by associated company ID itemType string Filter by item type (e.g. "assessment" ) activated boolean Filter by whether the invite has been activated expired boolean Filter by whether the invite has expired term string Case-insensitive regex search on email address Body Example { "itemType": "assessment", "activated": false, "term": "example.com" } Responses Status Description 200 Numeric count of matching invites 401 Unauthorized user 200 Response Example 18' requestBody: required: true content: text/plain: schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentinvites/mine: get: tags: - Third Party Accounts summary: My invites (invited user view) operationId: getMyInvitesInvitedUserView description: 'Folder: Assessments / assessmentinvites. My Invites Purpose: Return invites available to the logged-in invited user. Behavior Filters results to invites where invited_user_id matches the current authenticated user Includes only non-expired invites (based on expiration_date ) or invites created within the last 30 days as a fallback Enriches each invite with: customer_name — resolved from the inviting customer invited_by_name — resolved from the inviting user Removes raw customer_id and invited_by fields from the output Responses Status Description 200 Array of invite objects (possibly empty) 401 Unauthorized user' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentinvites/page/{pageNum}: post: tags: - Third Party Accounts summary: List invites (paginated) operationId: postListInvitesPaginated description: 'Folder: Assessments / assessmentinvites. List Invites (Paginated) Purpose: List customer invites with optional filtering. Path Parameters Parameter Description pageNum Zero-based page index. Page 0 is the first page. Request Body (Optional Filters) Field Type Description assessment_id string Filter by associated assessment ID breach_id string Filter by associated breach ID company_id string Filter by associated company ID itemType string Filter by item type (e.g. "assessment" ) activated boolean Filter by whether the invite has been activated expired boolean Filter by whether the invite has expired term string Case-insensitive regex search on email address Body Example { "itemType": "assessment", "activated": false, "term": "example.com" } Behavior Results are scoped to the authenticated customer Sorted by timestamp descending (newest first) Page size is fixed at 50 records maximum Sensitive fields are removed from returned records Responses Status Description 200 Array of invite objects (sanitized) 401 Unauthorized user' parameters: - name: pageNum in: path required: true schema: type: integer requestBody: required: true content: application/json: schema: type: object properties: {} example: {} responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentinvites/{inviteId}: get: tags: - Third Party Accounts summary: Read invite by ID operationId: getReadInviteById description: 'Folder: Assessments / assessmentinvites. Read Invite by ID Purpose: Fetch one invite by DB ID (customer-scoped). Path Parameters Parameter Description docId The database ID of the invite to retrieve Responses Status Description 200 Invite object (sanitized) 400 Missing docId 401 Unauthorized' parameters: - name: inviteId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - Third Party Accounts summary: Delete invite by ID operationId: deleteInviteById description: 'Folder: Assessments / assessmentinvites. Delete Invite by ID Purpose: Delete an invite record (customer-scoped hard delete). Path Parameters Parameter Description docId The ID of the invite to delete Responses Status Description 200 Invite successfully deleted 400 Missing docId path parameter 401 Unauthorized user 200 Response Example { "message": "Share successfully deleted" }' parameters: - name: inviteId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Third Party Accounts summary: Update invite by ID operationId: putUpdateInviteById description: 'Folder: Assessments / assessmentinvites. Update Invite by ID Purpose: Update invite state or details (customer-scoped). Path Parameters Parameter Description docId The ID of the invite to update Request Body (Allowed Fields Only) Field Type Description activated boolean Whether the invite has been activated activated_date string Date the invite was activated expired boolean Whether the invite is marked as expired expiration_date string Expiration date for the invite breach_id string Associated breach ID assessment_id string Associated assessment ID company_id string Associated company ID Body Example { "expired": true, "expiration_date": "2024-12-31T00:00:00.000Z" } Responses Status Description 200 Updated invite object (sanitized) 400 Missing docId path parameter 401 Unauthorized user 404 Share/invite not found' parameters: - name: inviteId in: path required: true schema: type: string requestBody: required: true content: application/json: schema: type: object properties: breach_id: type: string example: breach_id: breach_id responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmentpreferences: post: tags: - Third Party Accounts summary: Create preferences operationId: postCreatePreferences description: 'Folder: Assessments / assessmentpreferences. Create Preferences Purpose: Create the initial assessment preferences document for the authenticated customer. Note: This endpoint will fail if preferences already exist for this customer. Use the update endpoint instead. Request Body Field Type Description auto_create_enabled boolean Whether assessments are auto-created auto_create_frequency string Frequency for auto-creation (e.g. "quarterly" ) default_template_id string Default template used for new assessments default_assessment_duration number Default duration for assessments (in days) tier_preferences array Per-tier configuration objects on_hack_alert boolean Trigger assessment on hack alert hack_alert_template_id string Template to use on hack alert on_ransomware_event boolean Trigger assessment on ransomware event ransomware_template_id string Template to use on ransomware event active boolean Whether preferences are active (defaults to true ) Body Example { "auto_create_enabled": true, "auto_create_frequency": "quarterly", "default_template_id": "64f1c8...", "default_assessment_duration": 30, "tier_preferences": [ { "tier": "critical", "template_id": "64f1c8...", "frequency": "quarterly", "enabled": true }, { "tier": "high", "template_id": "64f1c8...", "frequency": "semi_annual", "enabled": true }, { "tier": "medium", "template_id": "64f1c8...", "frequency": "annual", "enabled": true }, { "tier": "low", "template_id": "64f1c8...", "frequency": "annual", "enabled": false } ], "on_hack_alert": true, "hack_alert_template_id": "64f1c8...", "on_ransomware_event": true, "ransomware_template_id": "64f1c8...", "active": true } Server-Managed Fields The following fields are set automatically by the API and should not be included in the request body: Field Description customer_id Set from authenticated session timestamp Set at creation time updated Set at creation time Default: active is set to true if omitted. Responses Status Description 200 Created preferences object 40' requestBody: required: true content: application/json: schema: type: object properties: auto_create_enabled: type: boolean auto_create_frequency: type: string default_template_id: type: string tier_preferences: type: array on_hack_alert: type: boolean hack_alert_template_id: type: string on_ransomware_event: type: boolean ransomware_template_id: type: string example: auto_create_enabled: true auto_create_frequency: quarterly default_template_id: YOUR_TEMPLATE_ID tier_preferences: - tier: critical template_id: YOUR_TEMPLATE_ID frequency: quarterly enabled: true - tier: high template_id: YOUR_TEMPLATE_ID frequency: semi_annual enabled: true - tier: medium template_id: YOUR_TEMPLATE_ID frequency: annual enabled: true - tier: low template_id: YOUR_TEMPLATE_ID frequency: annual enabled: false on_hack_alert: true hack_alert_template_id: YOUR_TEMPLATE_ID on_ransomware_event: true ransomware_template_id: YOUR_TEMPLATE_ID responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] get: tags: - Third Party Accounts summary: Get preferences operationId: getPreferences description: 'Folder: Assessments / assessmentpreferences. Get Preferences Purpose: Retrieve the current customer''s assessment preferences. Behavior Returns the preferences object associated with the authenticated customer. If no preferences have been set yet, returns an empty object {} — not a 404 . Responses Status Description 200 Preferences object, or {} if none exists 401 Unauthorized user' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - Third Party Accounts summary: Delete preferences operationId: deletePreferences description: 'Folder: Assessments / assessmentpreferences. Delete Preferences Purpose: Delete the current customer''s assessment preferences document. Responses Status Description 200 Preferences successfully deleted 401 Unauthorized user 200 Response Example { "message": "Assessment preferences successfully deleted" }' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Third Party Accounts summary: Update preferences operationId: putUpdatePreferences description: 'Folder: Assessments / assessmentpreferences. Update Preferences Purpose: Update existing assessment preferences for the authenticated customer. Precondition: Preferences must already exist for this customer. Use the create endpoint if no preferences have been set yet. Request Body (Allowed Fields Only) Field Type Description auto_create_enabled boolean Whether assessments are auto-created auto_create_frequency string Frequency for auto-creation (e.g. "quarterly" ) default_template_id string Default template used for new assessments default_assessment_duration number Default duration for assessments (in days) tier_preferences array Per-tier configuration objects on_hack_alert boolean Trigger assessment on hack alert hack_alert_template_id string Template to use on hack alert on_ransomware_event boolean Trigger assessment on ransomware event ransomware_template_id string Template to use on ransomware event active boolean Whether preferences are active Body Example { "default_assessment_duration": 45, "auto_create_enabled": true, "on_hack_alert": false } Server-Managed Fields The updated timestamp is always refreshed automatically on every successful update — do not include it in the request body. Responses Status Description 200 Updated preferences object 401 Unauthorized user 404 Preferences not found for this customer' requestBody: required: true content: application/json: schema: type: object properties: default_assessment_duration: type: integer example: default_assessment_duration: 45 responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessments: post: tags: - Third Party Accounts summary: Create a doc operationId: postCreateADoc4 description: 'Folder: Assessments / assessments. Create a new assessment document.' requestBody: required: true content: application/json: schema: type: object properties: company_id: type: string name: type: string description: type: string status: type: string active: type: boolean start_date: type: string due_date: type: string assessment_cycle: type: string risk_tier: type: string invited_emails: type: array example: company_id: 5b68ac28ab23eac48031a8fc name: Q1 2025 Security Assessment description: Annual third-party security review for Acme Corp. status: not_started active: true start_date: '2025-01-15T00:00:00.000Z' due_date: '2025-02-28T23:59:59.000Z' assessment_cycle: annual risk_tier: high invited_emails: - assessor@example.com responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessments/count: post: tags: - Third Party Accounts summary: post the count of documents operationId: postTheCountOfDocuments description: 'Folder: Assessments / assessments. Get the total count of assessment documents.' requestBody: required: true content: text/plain: schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessments/invited/{documentId}: get: tags: - Third Party Accounts summary: Read an invite operationId: getReadAnInvite description: 'Folder: Assessments / assessments / invited. Retrieve an assessment invitation by its ID.' parameters: - name: documentId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Third Party Accounts summary: update invite operationId: putUpdateInvite description: 'Folder: Assessments / assessments / invited. Update an existing assessment invitation by its ID.' parameters: - name: documentId in: path required: true schema: type: string requestBody: required: true content: application/json: schema: type: object properties: breach_id: type: string example: breach_id: 69a766c1de7caace19b3d070 responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessments/page/{pageNum}: post: tags: - Third Party Accounts summary: post a page of documents operationId: postAPageOfDocuments description: 'Folder: Assessments / assessments. Retrieve a paginated list of assessments. Use the page number in the URL to navigate through results.' parameters: - name: pageNum in: path required: true schema: type: integer requestBody: required: true content: text/plain: schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessments/projection: post: tags: - Third Party Accounts summary: projection operationId: postProjection description: 'Folder: Assessments / assessments. Retrieve a projected subset of fields from assessment documents.' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessments/{assessmentId}: get: tags: - Third Party Accounts summary: Read a doc operationId: getReadADoc5 description: 'Folder: Assessments / assessments. Retrieve an assessment document by its ID.' parameters: - name: assessmentId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - Third Party Accounts summary: Delete a doc operationId: deleteADoc5 description: 'Folder: Assessments / assessments. Delete an assessment document by its ID.' parameters: - name: assessmentId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Third Party Accounts summary: update a doc operationId: putUpdateADoc3 description: 'Folder: Assessments / assessments. Update an existing assessment document by its ID.' parameters: - name: assessmentId in: path required: true schema: type: string requestBody: required: true content: application/json: schema: type: object properties: breach_id: type: string example: breach_id: 69a766c1de7caace19b3d070 responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmenttemplates: post: tags: - Third Party Accounts summary: Create template operationId: postCreateTemplate description: 'Folder: Assessments / assessmenttemplates. Create Assessment Template Purpose: Create a new customer-owned assessment template. Request Body Field Type Required Description name string ✅ Yes Name of the template description string No Human-readable description version number No Template version (default: 1 ) questions array No List of question objects active boolean No Whether the template is active (default: true ) frameworks array No List of associated framework names Body Example { "name": "Vendor Security Baseline", "description": "Core security due diligence template", "version": 1, "questions": [], "active": true, "frameworks": ["SOC 2", "ISO 27001"] } Server-Managed Fields These fields are set automatically by the API and should not be included in the request body: customer_id · user_id · timestamp · updated Defaults Field Default active true version 1 Responses Status Description 200 Created template object 400 name field is missing 401 Unauthorized user' requestBody: required: true content: application/json: schema: type: object properties: name: type: string description: type: string version: type: integer active: type: boolean frameworks: type: array questions: type: array example: name: Ransomware Assessment description: A security posture assessment focused on the controls most relevant to ransomware attack vectors, including vulnerability and patch management, credential and access controls, remote access, endpoint and mobile device security, network segmentation, backup and recovery, and incident detection and response. version: 1 active: true frameworks: [] questions: - question: Have all critical and high-risk security patches been applied and validated across network devices? question_type: yes_no options: - 'Yes' - 'No' required: true order: 1 - question: Are documented security standards enforced for network device configuration, patching, access control, password strength, and change authorization? question_type: yes_no options: - 'Yes' - 'No' required: true order: 2 - question: Does a centrally managed vulnerability management program exist that covers system scanning, timely remediation, and exception handling? question_type: yes_no options: - 'Yes' - 'No' required: true order: 3 - question: Are all systems and applications kept current through a regular patching cadence? question_type: yes_no options: - 'Yes' - 'No' required: true order: 4 - question: Has leadership approved an access control policy governing system access rights based on data sensitivity and scope? question_type: yes_no options: - 'Yes' - 'No' required: true order: 5 - question: Is a leadership-approved password policy in place that defines requirements for password creation, safeguarding, and lifecycle management? question_type: yes_no options: - 'Yes' - 'No' required: true order: 6 - question: Does the password policy mandate that credentials remain confidential and are not shared? question_type: yes_no options: - 'Yes' - 'No' required: true order: 7 - question: Are factory-default credentials on network devices changed or disabled before deployment to production? question_type: yes_no options: - 'Yes' - 'No' required: true order: 8 - question: Are vendor-supplied default passwords eliminated or changed on all systems before they enter production use? question_type: yes_no options: - 'Yes' - 'No' required: true order: 9 - question: Are controls in place to restrict personally-owned mobile devices from connecting to corporate systems and networks? question_type: yes_no options: - 'Yes' - 'No' required: true order: 10 - question: Has a mobile device management program been implemented that enforces minimum security standards for accessing organizational systems, applications, and email? question_type: yes_no options: - 'Yes' - 'No' required: true order: 11 - question: Do any unmanaged or non-corporate computing devices connect to the organization's network? question_type: yes_no options: - 'Yes' - 'No' required: true order: 12 - question: Are any personally-owned (BYOD) mobile devices used to access scoped or sensitive data? question_type: yes_no options: - 'Yes' - 'No' required: true order: 13 - question: Is a leadership-approved remote access policy in place for scoped systems and data, and is it reviewed at least annually? question_type: yes_no options: - 'Yes' - 'No' required: true order: 14 - question: Does a DMZ exist to isolate internet-facing or externally accessible systems from the internal network? question_type: yes_no options: - 'Yes' - 'No' required: true order: 15 - question: Is scoped data regularly backed up and stored at a separate offsite location? question_type: yes_no options: - 'Yes' - 'No' required: true order: 16 - question: Does a documented incident response plan exist that clearly defines escalation procedures? question_type: yes_no options: - 'Yes' - 'No' required: true order: 17 - question: Does ongoing security monitoring generate alerts for malware detections and anomalous or suspicious behavior? question_type: yes_no options: - 'Yes' - 'No' required: true order: 18 - question: Are policies and procedures in place for detecting and reporting unauthorized access, use, or disclosure of scoped data? question_type: yes_no options: - 'Yes' - 'No' required: true order: 19 - question: Are documented procedures maintained for identifying and reporting privacy incidents involving potential or actual compromise of client data? question_type: yes_no options: - 'Yes' - 'No' required: true order: 20 responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmenttemplates/count: post: tags: - Third Party Accounts summary: Count templates operationId: postCountTemplates description: 'Folder: Assessments / assessmenttemplates. Count Templates Purpose: Return the total number of visible templates (customer-owned + global), optionally filtered. Request Body (Optional Filters) Field Type Description active boolean Filter by active status term string Case-insensitive search on name framework string Exact match inside the frameworks array Body Example { "active": true, "term": "vendor", "framework": "SOC 2" } Responses Status Description 200 Numeric count of matching templates (e.g. 42 ) 401 Unauthorized user' requestBody: required: true content: text/plain: schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmenttemplates/frameworks: get: tags: - Third Party Accounts summary: List available frameworks operationId: getListAvailableFrameworks description: 'Folder: Assessments / assessmenttemplates. List Available Frameworks Purpose: Return distinct framework values from all visible templates (customer-owned + global), sorted alphabetically. Behavior Aggregates all unique values from the frameworks field across both customer-owned and global templates Results are returned sorted alphabetically Responses Status Description 200 Sorted array of distinct framework strings 401 Unauthorized user 500 Internal server error 200 Response Example ["ISO 27001", "NIST", "SOC 2"]' requestBody: required: true content: application/json: schema: type: object properties: assessment_id: type: string example: assessment_id: 69a73dc2c0deb2b4840f44fc responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmenttemplates/page/{pageNum}: post: tags: - Third Party Accounts summary: List templates (paginated) operationId: postListTemplatesPaginated description: 'Folder: Assessments / assessmenttemplates. List Templates (Paginated) Purpose: Return a paginated list of assessment templates visible to the authenticated user — includes both customer-owned and global HackNotice templates. Path Parameters Parameter Description pageNum Zero-based page index. Page 0 is the first page. Page size is fixed at 50 . Request Body (Optional Filters) Field Type Description active boolean Filter by active status term string Case-insensitive search on name framework string Exact match inside the frameworks array Body Example { "active": true, "term": "vendor", "framework": "SOC 2" } Behavior Returns templates where customer_id matches the authenticated user''s customer or customer_id is empty (global templates) Results are sorted by timestamp descending (newest first) Page size is fixed at 50 results per page Responses Status Description 200 Array of template objects 401 Unauthorized user' parameters: - name: pageNum in: path required: true schema: type: integer requestBody: required: true content: text/plain: schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /assessmenttemplates/{templateId}: get: tags: - Third Party Accounts summary: Read one template operationId: getReadOneTemplate description: 'Folder: Assessments / assessmenttemplates. Read One Template Purpose: Fetch a single assessment template by ID, if it is visible to the authenticated customer (customer-owned or global). Path Parameters Parameter Description docId The ID of the template to retrieve Behavior Returns the template if it belongs to the authenticated customer or is a global HackNotice template ( customer_id is empty) Returns null if no matching template is found within the customer''s visible scope Responses Status Description 200 Template object, or null if not found within visible scope 400 docId path parameter is missing 401 Unauthorized user' parameters: - name: templateId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - Third Party Accounts summary: Delete one template operationId: deleteOneTemplate description: 'Folder: Assessments / assessmenttemplates. Delete One Template Purpose: Delete a customer-owned assessment template by ID. Path Parameters Parameter Description docId The ID of the template to delete Responses Status Description 200 Template successfully deleted 400 docId path parameter is missing 401 Unauthorized user 200 Response Example { "message": "Assessment template successfully deleted" }' parameters: - name: templateId in: path required: true schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Third Party Accounts summary: Update one template operationId: putUpdateOneTemplate description: 'Folder: Assessments / assessmenttemplates. Update One Template Purpose: Update a customer-owned assessment template by ID. Path Parameters Parameter Description docId The ID of the template to update Request Body (Allowed Fields Only) Field Type Description name string Name of the template description string Human-readable description version number Template version questions array List of question objects active boolean Whether the template is active frameworks array List of associated framework names Body Example { "name": "Vendor Security Baseline v2", "description": "Updated security due diligence template", "version": 2, "active": true, "frameworks": ["SOC 2", "ISO 27001", "NIST"] } Server-Managed Fields The updated timestamp is always refreshed automatically on every successful update — do not include it in the request body. Responses Status Description 200 Updated template object 400 docId path parameter is missing 401 Unauthorized user 404 Template not found, or not owned by this customer' parameters: - name: templateId in: path required: true schema: type: string requestBody: required: true content: application/json: schema: type: object properties: description: type: string example: description: Standard security assessment for vendors responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /auth/sign_in: post: tags: - All Business Accounts summary: Sign In operationId: postSignIn description: 'Folder: Authentication.' requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: email: type: string description: Must be an existing account without 2FA turned on. password: type: string description: Must be at least 14 characters responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /auth/sign_out: get: tags: - All Business Accounts summary: Sign out operationId: getSignOut description: 'Folder: Authentication.' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /auth/sign_out_all: get: tags: - All Business Accounts summary: Sign out all sessions operationId: getSignOutAllSessions description: 'Folder: Authentication.' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /auth/twofa_sign_in: post: tags: - All Business Accounts summary: 2FA Sign In operationId: post2FaSignIn description: 'Folder: Authentication.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: email: type: string description: Must be an existing account with 2FA turned on. password: type: string description: Must be at least 14 characters token: type: string description: Google Authenticator Token responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breachcalcs/aggregatedates: post: tags: - Calc endpoints summary: POST /breachcalcs/aggregatedates operationId: postBreachcalcsAggregatedates description: 'Folder: Breaches. Mongo $group aggregation that sums totals, per-NAICS counts, per-geo-region counts, and per-source counts over the matching docs. Body fields : same date/naics/georegion filters as /count , plus: csv (boolean, optional) — if truthy, response is a CSV download ( Content-Disposition: attachment; filename=breachcalcs.csv ); otherwise JSON. Response : array with one aggregated object containing total , totalIndustries , totalGeographies , naics11 .. naics99 , geoEurope .. geoMiddleEast , sourceSec .. sourceLeakreport .' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string naics: type: string naicsarray: type: array georegions: type: string georegionsarray: type: array csv: type: boolean example: startdate: '2025-04-01' enddate: '2025-05-01' naics: '' naicsarray: [] georegions: '' georegionsarray: [] csv: false responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breachcalcs/count: post: tags: - Calc endpoints summary: POST /breachcalcs/count operationId: postBreachcalcsCount description: 'Folder: Breaches. Returns the count of breach-landscape records matching the filter. Body fields startdate (string, ISO date) — required together with enddate to filter by date range. If either is empty, the date filter is skipped. enddate (string, ISO date) naics (string|number, optional) — single NAICS code filter. If absent, exclusivenaics is set to null (i.e. "all NAICS"). naicsarray (array, optional) — NAICS $in filter; overrides naics when present. georegions (string, optional) — single geo-region filter. georegionsarray (array, optional) — geo-region $in filter; overrides georegions when present. Response : integer count.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string naics: type: string naicsarray: type: array georegions: type: string georegionsarray: type: array example: startdate: '2025-04-01' enddate: '2025-05-01' naics: '' naicsarray: [] georegions: '' georegionsarray: [] responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breachcalcs/listdates: post: tags: - Calc endpoints summary: POST /breachcalcs/listdates operationId: postBreachcalcsListdates description: 'Folder: Breaches. Unpaginated list of breach-landscape records matching the filter, sorted by date desc. Body fields : same as /count . Response : array of breach-landscape records.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string naics: type: string naicsarray: type: array georegions: type: string georegionsarray: type: array example: startdate: '2025-04-01' enddate: '2025-05-01' naics: '' naicsarray: [] georegions: '' georegionsarray: [] responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breachcalcs/page/{pageNum}: post: tags: - Calc endpoints summary: POST /breachcalcs/page/:pageNum operationId: postBreachcalcsPagePagenum description: 'Folder: Breaches. Paginated list of breach-landscape records (50 per page, sorted by date desc). Path params pageNum (integer) — zero-indexed page. Body fields : naics , naicsarray , georegions , georegionsarray — same semantics as /count . Note: this handler does not apply a date filter. Response : array of breach-landscape records.' parameters: - name: pageNum in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: naics: type: string naicsarray: type: array georegions: type: string georegionsarray: type: array example: naics: '' naicsarray: [] georegions: '' georegionsarray: [] responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breachcalcs/{docId}: get: tags: - Calc endpoints summary: GET /breachcalcs/:docId operationId: getBreachcalcsDocid description: 'Folder: Breaches. Fetch a single breach-landscape record by _id . Path params docId — Mongo ObjectId of the breach-landscape record. Response : the breach-landscape record.' parameters: - name: docId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breaches/count/range: post: tags: - Third Party Accounts summary: Read count of documents within a date range operationId: postReadCountOfDocumentsWithinADateRange description: 'Folder: All Hacks.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: start_date: type: string description: Required. Date in YYYY-MM-DD format responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breaches/new/count/: post: tags: - Third Party Accounts summary: Read count of all documents operationId: postReadCountOfAllDocuments description: 'Folder: All Hacks.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: sourcetype: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breaches/new/page/{pageNum}: post: tags: - Third Party Accounts summary: Read a page of documents operationId: postReadAPageOfDocuments description: 'Folder: All Hacks.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breaches/new/timestamp/page/{pageNum}: get: tags: - Third Party Accounts summary: Read a page of documents sorted by timestamp (creation) operationId: getReadAPageOfDocumentsSortedByTimestampCreation description: 'Folder: All Hacks.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breaches/new/{documentId}: get: tags: - Third Party Accounts summary: Read a document operationId: getReadADocument6 description: 'Folder: All Hacks. Get a document by the document ID.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breaches/search/page/{pageNum}: post: tags: - Third Party Accounts summary: Search a page operationId: postSearchAPage description: 'Folder: All Hacks. Searches all documents and returns documents in reverse chronological order.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: Inclusive string search for the value in the domain or title responses: '200': description: Search a page content: application/json: schema: type: array example: - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: - business _id: 685ee5b03d84924964b85827 processed: true domain: morningsideservices.com company_name: US:Morningsideservices published_date: '2025-06-27T18:39:31.902Z' published_mo_yr: '2025-06-01T00:00:00.000Z' records: 0 hacker: '' breach_type: '' breach_cause: '' location: '' industry: '' news_source: '' description: 'Company allegedly hacked as reported by Kawa4096 with details: 2025-06-20' source: http://kawasa2qo7345dt7ogxmx7qmn6z2hnwaoi3h5aeosupozkddqwp6lqqd.onion/ sourcetype: ransomware harvester: harvest_ransomware_kawa4096 breachDimensions: - _id: 685ee7f01929b24fb3ae8b1e key: breachScope value: full displayName: Breach Scope - _id: 685ee7f01929b24fb3ae8b1f key: breachIntention value: intentional displayName: Breach Intention - _id: 685ee7f01929b24fb3ae8b20 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685ee7f01929b24fb3ae8b21 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: - _id: 685ee7f01929b24fb3ae8b1c tags: confidential-information confidence: $numberDecimal: '1' timestamp: '2025-06-27T18:41:41.381Z' geoindattempted: true breachScreenshot: screenshot_685ee5b03d84924964b85827_1751050073.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-27T18:48:01.052Z' openAIProcessAttempted: true analysisDate: '2025-06-27T18:50:24.172Z' tag_date: '2025-06-27T18:50:24.170Z' isOpenAIProcessing: false severity: 5 severityupdateddate: '2025-06-27T18:58:02.737Z' severityalertsupdated: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: - PII - business - financial _id: 685ee38695c98b52af11f2d9 processed: true company_name: Islington Golf Club harvester: harvest_ransomware_play_news source: http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion/topic.php?id=4kpOHpTbWy01r published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-27T18:36:22.026Z' description: 'Company allegedly hacked as reported by Play News ransomware with details: Amusement Parks, Arcades & Attractions Private and personal confidential data, clients documents, budget, payroll, accounting, taxes, IDs, finance information and etc.' sourcetype: ransomware implied: true published_date: '2025-06-27T18:36:22.026Z' domain: islingtongolfclub.com breachDimensions: - _id: 685ee7f51929b24fb3ae8b52 key: breachScope value: full displayName: Breach Scope - _id: 685ee7f51929b24fb3ae8b53 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: - _id: 685ee7f51929b24fb3ae8b4a tags: id-names confidence: $numberDecimal: '1' - _id: 685ee7f51929b24fb3ae8b4b tags: id-dobs confidence: $numberDecimal: '1' - _id: 685ee7f51929b24fb3ae8b4c tags: id-address confidence: $numberDecimal: '1' - _id: 685ee7f51929b24fb3ae8b4d tags: financial-details confidence: $numberDecimal: '1' - _id: 685ee7f51929b24fb3ae8b4e tags: customer-details confidence: $numberDecimal: '1' - _id: 685ee7f51929b24fb3ae8b4f tags: employment-details confidence: $numberDecimal: '1' - _id: 685ee7f51929b24fb3ae8b50 tags: confidential-information confidence: $numberDecimal: '1' severity: 5 severityupdateddate: '2025-06-27T18:37:51.414Z' geoindattempted: true severityalertsupdated: true breachScreenshot: screenshot_685ee38695c98b52af11f2d9_1751050099.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-27T18:48:27.134Z' openAIProcessAttempted: true analysisDate: '2025-06-27T18:50:29.653Z' tag_date: '2025-06-27T18:50:29.652Z' isOpenAIProcessing: false geoindupdated: false topnaicscode: null region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: - PII - business - financial _id: 685ee38595c98b52af11f0f6 processed: true company_name: Cartel Communication Systems harvester: harvest_ransomware_play_news source: http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion/topic.php?id=Q1CmiLcAEoPHVo published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-27T18:36:21.844Z' description: 'Company allegedly hacked as reported by Play News ransomware with details: Manufacturing Private and personal confidential data, clients documents, budget, payroll, accounting, taxes, IDs, finance information and etc.' sourcetype: ransomware implied: true published_date: '2025-06-27T18:36:21.844Z' domain: cartelsys.com breachDimensions: - _id: 685ee7f91929b24fb3ae8b65 key: breachScope value: partial displayName: Breach Scope - _id: 685ee7f91929b24fb3ae8b66 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: - _id: 685ee7f91929b24fb3ae8b60 tags: confidential-information confidence: $numberDecimal: '1' - _id: 685ee7f91929b24fb3ae8b61 tags: customer-details confidence: $numberDecimal: '1' - _id: 685ee7f91929b24fb3ae8b62 tags: financial-details confidence: $numberDecimal: '1' - _id: 685ee7f91929b24fb3ae8b63 tags: id-names confidence: $numberDecimal: '1' severity: 5 severityupdateddate: '2025-06-27T18:37:51.414Z' geoindattempted: true severityalertsupdated: true breachScreenshot: screenshot_685ee38595c98b52af11f0f6_1751050116.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-27T18:48:44.743Z' openAIProcessAttempted: true analysisDate: '2025-06-27T18:50:33.253Z' tag_date: '2025-06-27T18:50:33.251Z' isOpenAIProcessing: false geoindupdated: false topnaicscode: null region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: - PII - business - financial _id: 685ee38595c98b52af11f0ac processed: true company_name: Carter Manufacturing harvester: harvest_ransomware_play_news source: http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion/topic.php?id=LOGDjmJfBG2CyR published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-27T18:36:21.667Z' description: 'Company allegedly hacked as reported by Play News ransomware with details: Industrial Machinery & Equipment Private and personal confidential data, clients documents, budget, payroll, accounting, taxes, IDs, finance information and etc.' sourcetype: ransomware implied: true published_date: '2025-06-27T18:36:21.667Z' domain: carterbearings.com breachDimensions: - _id: 685ee7fc1929b24fb3ae8b76 key: breachScope value: full displayName: Breach Scope - _id: 685ee7fc1929b24fb3ae8b77 key: breachIntention value: intentional displayName: Breach Intention - _id: 685ee7fc1929b24fb3ae8b78 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685ee7fc1929b24fb3ae8b79 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: - _id: 685ee7fc1929b24fb3ae8b70 tags: confidential-information confidence: $numberDecimal: '1' - _id: 685ee7fc1929b24fb3ae8b71 tags: customer-details confidence: $numberDecimal: '1' - _id: 685ee7fc1929b24fb3ae8b72 tags: financial-details confidence: $numberDecimal: '1' - _id: 685ee7fc1929b24fb3ae8b73 tags: employment-details confidence: $numberDecimal: '1' - _id: 685ee7fc1929b24fb3ae8b74 tags: id-names confidence: $numberDecimal: '1' severity: 5 severityupdateddate: '2025-06-27T18:37:51.414Z' geoindupdated: false geoindattempted: true topnaicscode: 31 region: North America severityalertsupdated: true breachScreenshot: screenshot_685ee38595c98b52af11f0ac_1751050134.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-27T18:49:02.781Z' openAIProcessAttempted: true analysisDate: '2025-06-27T18:50:36.846Z' tag_date: '2025-06-27T18:50:36.217Z' isOpenAIProcessing: false - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: - PII - business - financial _id: 685ee38595c98b52af11ee5f processed: true company_name: View Zuellig Industrial harvester: harvest_ransomware_play_news source: http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion/topic.php?id=pixmDSseNm5dx2 published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-27T18:36:21.491Z' description: 'Company allegedly hacked as reported by Play News ransomware with details: Transportation, Logistics Private and personal confidential data, clients documents, budget, payroll, accounting, taxes, IDs, finance information and etc.' sourcetype: ransomware implied: true published_date: '2025-06-27T18:36:21.491Z' domain: zuelligindustrial.com breachDimensions: - _id: 685ee8001929b24fb3ae8b8d key: breachScope value: partial displayName: Breach Scope - _id: 685ee8001929b24fb3ae8b8e key: breachIntention value: intentional displayName: Breach Intention - _id: 685ee8001929b24fb3ae8b8f key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685ee8001929b24fb3ae8b90 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: - _id: 685ee8001929b24fb3ae8b86 tags: id-names confidence: $numberDecimal: '1' - _id: 685ee8001929b24fb3ae8b87 tags: id-address confidence: $numberDecimal: '1' - _id: 685ee8001929b24fb3ae8b88 tags: id-dateofbirth confidence: $numberDecimal: '1' - _id: 685ee8001929b24fb3ae8b89 tags: financial-details confidence: $numberDecimal: '1' - _id: 685ee8001929b24fb3ae8b8a tags: customer-details confidence: $numberDecimal: '1' - _id: 685ee8001929b24fb3ae8b8b tags: confidential-information confidence: $numberDecimal: '1' severity: 5 severityupdateddate: '2025-06-27T18:37:51.414Z' geoindattempted: true severityalertsupdated: true breachScreenshot: screenshot_685ee38595c98b52af11ee5f_1751050154.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-27T18:49:22.615Z' openAIProcessAttempted: true analysisDate: '2025-06-27T18:50:40.198Z' tag_date: '2025-06-27T18:50:40.196Z' isOpenAIProcessing: false geoindupdated: false topnaicscode: null region: Asia - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: - PII - business - financial _id: 685ee38595c98b52af11ee02 processed: true company_name: Sunrise Springs Spa Resort harvester: harvest_ransomware_play_news source: http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion/topic.php?id=R6QHHXlR0zOWjj published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-27T18:36:21.479Z' description: 'Company allegedly hacked as reported by Play News ransomware with details: Spa, Aqua Wellness Private and personal confidential data, clients documents, budget, payroll, accounting, taxes, IDs, finance information and etc.' sourcetype: ransomware implied: true published_date: '2025-06-27T18:36:21.479Z' domain: ojosparesorts.com breachDimensions: - _id: 685ee8071929b24fb3ae8ba5 key: breachScope value: full displayName: Breach Scope - _id: 685ee8071929b24fb3ae8ba6 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: - _id: 685ee8071929b24fb3ae8b9e tags: id-names confidence: $numberDecimal: '1' - _id: 685ee8071929b24fb3ae8b9f tags: id-address confidence: $numberDecimal: '1' - _id: 685ee8071929b24fb3ae8ba0 tags: id-dobs confidence: $numberDecimal: '1' - _id: 685ee8071929b24fb3ae8ba1 tags: financial-details confidence: $numberDecimal: '1' - _id: 685ee8071929b24fb3ae8ba2 tags: customer-details confidence: $numberDecimal: '1' - _id: 685ee8071929b24fb3ae8ba3 tags: customer-kyc confidence: $numberDecimal: '1' severity: 5 severityupdateddate: '2025-06-27T18:37:51.414Z' geoindattempted: true severityalertsupdated: true breachScreenshot: screenshot_685ee38595c98b52af11ee02_1751050172.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-27T18:49:40.618Z' openAIProcessAttempted: true analysisDate: '2025-06-27T18:50:47.668Z' tag_date: '2025-06-27T18:50:47.667Z' isOpenAIProcessing: false - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: - PII - business - financial _id: 685ee38595c98b52af11ed46 processed: true company_name: CGP&H harvester: harvest_ransomware_play_news source: http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion/topic.php?id=goyZqeZhOVSI0Z published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-27T18:36:21.311Z' description: 'Company allegedly hacked as reported by Play News ransomware with details: Business Services Private and personal confidential data, clients documents, budget, payroll, accounting, taxes, IDs, finance information and etc.' sourcetype: ransomware implied: true published_date: '2025-06-27T18:36:21.311Z' domain: cgph.net breachDimensions: - _id: 685ee8101929b24fb3ae8bb9 key: breachScope value: full displayName: Breach Scope - _id: 685ee8101929b24fb3ae8bba key: breachIntention value: intentional displayName: Breach Intention - _id: 685ee8101929b24fb3ae8bbb key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685ee8101929b24fb3ae8bbc key: breachStatus value: ongoing displayName: Breach Status predicted_tags: - _id: 685ee8101929b24fb3ae8bb2 tags: financial-details confidence: $numberDecimal: '1' - _id: 685ee8101929b24fb3ae8bb3 tags: id-identifier confidence: $numberDecimal: '1' - _id: 685ee8101929b24fb3ae8bb4 tags: id-names confidence: $numberDecimal: '1' - _id: 685ee8101929b24fb3ae8bb5 tags: customer-details confidence: $numberDecimal: '1' - _id: 685ee8101929b24fb3ae8bb6 tags: employment-details confidence: $numberDecimal: '1' - _id: 685ee8101929b24fb3ae8bb7 tags: confidential-information confidence: $numberDecimal: '1' severity: 5 severityupdateddate: '2025-06-27T18:37:51.414Z' geoindattempted: true severityalertsupdated: true breachScreenshot: screenshot_685ee38595c98b52af11ed46_1751050190.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-27T18:49:58.434Z' openAIProcessAttempted: true analysisDate: '2025-06-27T18:50:56.549Z' tag_date: '2025-06-27T18:50:56.387Z' isOpenAIProcessing: false geoindupdated: false topnaicscode: null region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685ee38595c98b52af11ecca processed: false company_name: Emtech Inc harvester: harvest_ransomware_play_news source: http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion/topic.php?id=V5Nvy4FGEDOvn0 published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-27T18:36:21.145Z' description: 'Company allegedly hacked as reported by Play News ransomware with details: Consumer Services, Business Services Private and personal confidential data, clients documents, budget, payroll, accounting, taxes, IDs, finance information and etc.' sourcetype: ransomware implied: true published_date: '2025-06-27T18:36:21.145Z' domain: em-techinc.com breachDimensions: - _id: 685ee8101929b24fb3ae8bc9 key: breachIntention value: intentional displayName: Breach Intention - _id: 685ee8101929b24fb3ae8bca key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685ee8101929b24fb3ae8bcb key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] severity: 5 severityupdateddate: '2025-06-27T18:37:51.414Z' geoindattempted: true severityalertsupdated: true breachScreenshot: screenshot_685ee38595c98b52af11ecca_1751050208.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-27T18:50:16.156Z' openAIProcessAttempted: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: - PII - business - financial _id: 685eded395c98b52aff5e3d7 processed: true company_name: Associated Packaging harvester: harvest_ransomware_play_news source: http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion/topic.php?id=pILwaUV2XF0PoN published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-27T18:36:21.132Z' description: 'Company allegedly hacked as reported by Play News ransomware with details: Manufacturing Private and personal confidential data, clients documents, budget, payroll, accounting, taxes, IDs, finance information and etc.' sourcetype: ransomware implied: true published_date: '2025-06-27T18:36:21.132Z' domain: associatedpackaging.com breachDimensions: - _id: 685ee8121929b24fb3ae8bd8 key: breachScope value: partial displayName: Breach Scope - _id: 685ee8121929b24fb3ae8bd9 key: breachIntention value: intentional displayName: Breach Intention - _id: 685ee8121929b24fb3ae8bda key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685ee8121929b24fb3ae8bdb key: breachStatus value: ongoing displayName: Breach Status predicted_tags: - _id: 685ee8121929b24fb3ae8bd2 tags: id-names confidence: $numberDecimal: '1' - _id: 685ee8121929b24fb3ae8bd3 tags: id-address confidence: $numberDecimal: '1' - _id: 685ee8121929b24fb3ae8bd4 tags: id-dobs confidence: $numberDecimal: '1' - _id: 685ee8121929b24fb3ae8bd5 tags: financial-details confidence: $numberDecimal: '1' - _id: 685ee8121929b24fb3ae8bd6 tags: customer-details confidence: $numberDecimal: '1' severity: 5 severityupdateddate: '2025-06-27T18:37:51.414Z' geoindupdated: false geoindattempted: true topnaicscode: 31 region: North America severityalertsupdated: true breachScreenshot: screenshot_685eded395c98b52aff5e3d7_1751050226.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-27T18:50:34.066Z' openAIProcessAttempted: true analysisDate: '2025-06-27T18:50:58.394Z' tag_date: '2025-06-27T18:50:58.393Z' isOpenAIProcessing: false - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: [] _id: 685df31795c98b52afa47f34 processed: false company_name: Woodtect harvester: harvest_ransomware_lynx source: http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/ description: 'Company allegedly hacked as reported by Lynx ransomware with details: PRECISION ENGINEERING CO., LTD. is a specialist in hard oil, polyurethane, and wood stain and wood preservatives since 1972. The company aims to distribute only premium quality products that can be used for both exterior and interior woodwork, as well as many other home care products. Since its establishment, the company has been appointed as the sole distributor of LORD CORPORATION products from the United States in Thailand. The main product imported from LORD Corporation is Chemglaze Polyurethane (CHEMGLAZE), a hard oil for interior woodwork and wood floors.' published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-27T10:18:43.500Z' sourcetype: ransomware implied: true published_date: '2025-06-27T01:15:45.796Z' domain: woodtect.com breachDimensions: - _id: 685e72761929b24fb3ae89e2 key: breachIntention value: intentional displayName: Breach Intention - _id: 685e72761929b24fb3ae89e3 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685e72761929b24fb3ae89e4 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] geoindattempted: true breachScreenshot: screenshot_685df31795c98b52afa47f34_1751020090.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-27T10:28:18.175Z' openAIProcessAttempted: true analysisDate: '2025-06-27T10:29:10.728Z' isOpenAIProcessing: false severity: 5 severityupdateddate: '2025-06-27T10:33:40.616Z' severityalertsupdated: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: [] _id: 685dee5095c98b52af92a3b9 processed: false company_name: The Kingdom of Tonga's Ministry of Health harvester: harvest_ransomware_inc timestamp: '2025-06-27T10:18:43.533Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' description: 'Company allegedly hacked as reported by INC ransomware with details: Tonga''s health system includes central hospitals peripheral health centres and communitybased services. Key health challenges include rising rates of NCDs such as diabetes obesity heart disease and cancer. Communicable diseases such as tuberculosis STIs and VPDs persist.' source: http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/685ded5bba6890801344e878 published_date: '2025-06-27T01:01:15.479Z' implied: true domain: health.gov.to breachDimensions: - _id: 685e72761929b24fb3ae89db key: breachScope value: partial displayName: Breach Scope - _id: 685e72761929b24fb3ae89dc key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] geoindattempted: true breachScreenshot: screenshot_685dee5095c98b52af92a3b9_1751020069.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-27T10:27:57.352Z' openAIProcessAttempted: true analysisDate: '2025-06-27T10:29:10.173Z' isOpenAIProcessing: false severity: 5 severityupdateddate: '2025-06-27T10:33:40.616Z' severityalertsupdated: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685e7da495c98b52af312a2b processed: false company_name: Southwest CARE Center harvester: harvest_ransomware_medusa breachScreenshot: medusa_Southwest CARE Center.png timestamp: '2025-06-27T11:59:00.525Z' language: en sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-27T00:00:00.000Z' source: http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/detail?id=REDACTED_EXAMPLE_TOKEN description: 'Company allegedly hacked as reported by Medusa Blog ransomware with details: Founded in 1996, Southwest CARE Center (SCC) is well known as a center of excellence for the care and treatment of people living with HIV in New Mexico. SCC is the largest provider of treatment for people living with Hepatitis C in northern New Mexico. SCC is also the largest clinical research site in New Mexico for studies of new treatments for both HIV and Hepatitis C. In September of 2015 SCC opened its doors in Albuquerque providing the same high standard of HIV care SCC is known for. Southwest CARE Center''s focus is to provide a compassionate, patient-centered environment where everyone can feel comfortable and respected while receiving the highest quality health care available. company is headquartered in 901 W Alameda Street Santa Fe, NM 87501. The total amount of data leakage is 143.9 GB' implied: true domain: southwestcare.org breachDimensions: - _id: 685e89ec1929b24fb3ae8a11 key: breachIntention value: intentional displayName: Breach Intention - _id: 685e89ec1929b24fb3ae8a12 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685e89ec1929b24fb3ae8a13 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] geoindattempted: true openAIProcessAttempted: true severity: 5 severityupdateddate: '2025-06-27T12:14:29.232Z' severityalertsupdated: true geoindupdated: false topnaicscode: null region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685eb33095c98b52affa75e0 processed: false predicted_tags: [] breachDimensions: - _id: 685ebda21929b24fb3ae8aaa key: breachIntention value: intentional displayName: Breach Intention - _id: 685ebda21929b24fb3ae8aab key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685ebda21929b24fb3ae8aac key: breachStatus value: ongoing displayName: Breach Status company_name: SILOKING harvester: harvest_ransomware_qilin breachScreenshot: qilin_siloking.com.png timestamp: '2025-06-27T15:47:14.594Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-27T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=71f68468-3afb-3ed8-a1ea-309a25afdaa8 description: 'Company allegedly hacked as reported by Qilin ransomware with details: SILOKING is the brand for innovative feeding technology. SILOKING Mayer Maschinenbau GmbH produces innovative feeding technology and sells it in over 50 countries worldwide. The owner-managed family company is based in Tittmoning, Bavaria. With over 500 employees and state-of-the-art production methods, agricultural machinery "Made in Germany" is developed and manufactured with high quality standards. An entire range of SILOKING feed mixing technology as well as removal and distribution technology is mass-produced and offers the appropriate product at the right time for every farm. As an international market leader for feeding technology and a growth-oriented, medium-sized family farm, the "WE-feeling" and the shared passion for progressive agriculture belong to the foundations of SILOKING. ' domain: siloking.com implied: true geoindattempted: true openAIProcessAttempted: true severity: 5 severityupdateddate: '2025-06-27T15:56:24.286Z' severityalertsupdated: true geoindupdated: false topnaicscode: null region: Europe - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685ed3a495c98b52afb2a321 processed: false company_name: ARTEXMANAGEMENT.COM harvester: harvest_ransomware_qilin breachScreenshot: qilin_http.png timestamp: '2025-06-27T17:55:45.528Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-27T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=52a111ab-f97a-3591-bdfc-10e13d04a0c2 description: 'Company allegedly hacked as reported by Qilin ransomware with details: Artex Management was founded in 2005 to meet the industry''s demand for reliable and hassle-free property management.Our mission is to achieve the standard of living you desire for each property. 1.The document is a Payment Agreement (Payment Agreement) for Account No. 3000346685001, executed on March 26, 2025. 2.The document is a residential lease agreement dated January 1, 2025 between landlord Sam Amboy LLC and tenant Stanley Hughes. 3.The document represents the final settlement invoice for the closing of a real estate purchase and sale transaction (Closing Invoice) related to the property at 551 Liberty Avenue, Brooklyn, NY. The closing took place on June 16, 2025. 4.The document is a declaration of insurance policy renewal (Policy Declarations) for 2025-2026 for BRONX ESTATES LLC for the property at 951 College Ave, Bronx, NY 10456. 5.The document is an ACORD 25 Certificate of Liability Insurance (Certificate of Liability Insurance) issued June 5, 2025 for Harrison Avenue Homes Condominium Association, executed through Artek Insurance. ' domain: artexmanagement.com implied: true breachDimensions: - _id: 685ede831929b24fb3ae8b07 key: breachIntention value: intentional displayName: Breach Intention - _id: 685ede831929b24fb3ae8b08 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685ede831929b24fb3ae8b09 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] severity: 5 severityupdateddate: '2025-06-27T17:57:30.583Z' geoindattempted: true severityalertsupdated: true openAIProcessAttempted: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685edd7e95c98b52afed4860 processed: false predicted_tags: [] breachDimensions: - _id: 685ee7f01929b24fb3ae8b41 key: breachIntention value: intentional displayName: Breach Intention - _id: 685ee7f01929b24fb3ae8b42 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685ee7f01929b24fb3ae8b43 key: breachStatus value: ongoing displayName: Breach Status company_name: NORSK.GLOBAL harvester: harvest_ransomware_qilin breachScreenshot: qilin_norsk.global.png timestamp: '2025-06-27T18:36:22.158Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-27T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=461fb97f-e836-3935-a3df-a607aa8ab2da description: 'Company allegedly hacked as reported by Qilin ransomware with details: Norsk is a privately owned independent company. With 30 years of experience in international shipping. 1.Invoice for the purchase of an Audi Q8 Sportback Sport 55 e-t by Norsk European Wholesale Ltd. 2.UPS international shipments, including statuses, types of service, dates, and weights. 3.Agreement The Best Connection Group Limited (TBC) - temporary staffing agency Norsk European Wholesale Limited (Norsk) - client receiving temporary staffing services Agreement effective from April 01, 2023 for a period of 12 months ' domain: norsk.global implied: true severity: 5 severityupdateddate: '2025-06-27T18:37:51.414Z' geoindattempted: true severityalertsupdated: true openAIProcessAttempted: true geoindupdated: false topnaicscode: null region: Europe - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685edd7e95c98b52afed4863 processed: false predicted_tags: [] breachDimensions: - _id: 685ee7f01929b24fb3ae8b39 key: breachIntention value: intentional displayName: Breach Intention - _id: 685ee7f01929b24fb3ae8b3a key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685ee7f01929b24fb3ae8b3b key: breachStatus value: ongoing displayName: Breach Status company_name: BUFFALOMARINE.COM harvester: harvest_ransomware_qilin breachScreenshot: qilin_buffalomarine.com.png timestamp: '2025-06-27T18:36:22.208Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-27T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=2ac8299a-2e07-3403-a1f9-e5cbbea219c6 description: 'Company allegedly hacked as reported by Qilin ransomware with details: Buffalo Marine Service, Inc. founded in 1935, is a bunkering and marine transportation company specializing in inland waterway towing with a focus on the Intracoastal Waterway System. 1.The document is a Professional Services Agreement (Professional Services Agreement) entered into on January 1, 2025 between Seamen''s Church Institute of New York and New Jersey (SCI) and Buffalo Marine Service, Inc. 2.The document is Invoice No. 2503-14 issued on March 26, 2025, by Universal Services & Associates (FMT Shipyard & Repair) to Buffalo Marine for services rendered on the Buffalo 803 project. 3.The document is a balance sheet of Buffalo Marine Service, Inc. as of February 28, 2025. 4.The document represents the complete financial statements of Shamrock Marine, LLC for the three months ended March 31, 2025. 5.The document is a Fuel Purchase Activity Report (Purchase Activity Report) for Buffalo Marine Service for the period April 8 through May 7, 2025. ' domain: buffalomarine.com implied: true severity: 5 severityupdateddate: '2025-06-27T18:37:51.414Z' geoindattempted: true severityalertsupdated: true openAIProcessAttempted: true geoindupdated: false topnaicscode: null region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685edd7e95c98b52afed4878 processed: false predicted_tags: [] breachDimensions: - _id: 685ee7f01929b24fb3ae8b31 key: breachIntention value: intentional displayName: Breach Intention - _id: 685ee7f01929b24fb3ae8b32 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685ee7f01929b24fb3ae8b33 key: breachStatus value: ongoing displayName: Breach Status company_name: BROADLEAFGAME.COM harvester: harvest_ransomware_qilin breachScreenshot: qilin_broadleafgame.com.png timestamp: '2025-06-27T18:36:22.381Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-27T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=5fe3b44c-30a0-3b1d-9609-278e900275fc description: 'Company allegedly hacked as reported by Qilin ransomware with details: Broadleaf is a family-owned food distribution company supplying high-quality meats and deli meats to distributors and retailers throughout the United States and abroad.Founded in 1988, Broadleaf entered the U.S. market as a major importer and distributor of New Zealand game meats, primarily venison. 1.This document is a safety and quality assurance letter for meat products from Perdue Premium Meat Company to Broadleaf Game, dated March 10, 2025. 2.The document is an official letter of compliance with the HACCP system issued on February 4, 2023 by Dakota Pure Meats dba Western Buffalo, LLC. 3.The document is a shipment report dated January 2, 2025, which lists shipments of delayed goods. 4.The document is a set of financial statements of Broadleaf Venison (USA), Inc. for January 2025. 5.The document is an official invoice from Broadleaf Venison (USA), Inc. issued on June 18, 2025 for client Dairyland (Ridgefield, Connecticut). ' domain: broadleafgame.com implied: true severity: 5 severityupdateddate: '2025-06-27T18:37:51.414Z' geoindupdated: false geoindattempted: true topnaicscode: 31 region: North America severityalertsupdated: true openAIProcessAttempted: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685ee18f95c98b52af05cdac processed: false predicted_tags: [] breachDimensions: - _id: 685ee7f01929b24fb3ae8b29 key: breachIntention value: intentional displayName: Breach Intention - _id: 685ee7f01929b24fb3ae8b2a key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685ee7f01929b24fb3ae8b2b key: breachStatus value: ongoing displayName: Breach Status company_name: GREATCDLTRAINING.COM harvester: harvest_ransomware_qilin breachScreenshot: qilin_greatcdltraining.com.png timestamp: '2025-06-27T18:36:22.501Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-27T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=41005975-7373-333d-bc45-7a2c25708b6b description: 'Company allegedly hacked as reported by Qilin ransomware with details: Over more than 30 years, Driver Solutions has specialized in providing affordable driver training and quality trucking job opportunities to new drivers. We do this by offering a company-sponsored CDL training program that allows new drivers to learn the skills needed to get a CDL license without upfront tuition costs. This makes the dream of becoming a truck driver far more attainable for those who never could have previously afforded the $6,000 - $8,000 that trucking school can cost. 1.The document is a bank statement (checking statement) of White River Management Corp''s account with Regions Bank for the period January 1 through January 31, 2025. 2.The document is an insurance policy (Partnership Liability Insurance Policy) issued to Madeira Partners LP by Chubb Insurance Company, with an effective date of January 25, 2025. 3.Financial report prepared for Indianapolis Film Project, Inc. for the March 19, 2025 board meeting. 4.This document is the official Indiana Commercial Driver''s License (CDL Skills Test Score Sheet) for the State of Indiana. It certifies that Jordan G. Owens passed the Class B CDL test with full air brakes on May 13, 2025, at the test site under the supervision of Charles Runyan, examiner. 5.This document is a driver''s license verification report prepared by HireRight, LLC at the request of employer Kari Yerkes for candidate Vic Koerner (Victor Charles Koerner) as part of employment in Indianapolis, Indiana. ' domain: greatcdltraining.com implied: true severity: 5 severityupdateddate: '2025-06-27T18:37:51.414Z' geoindattempted: true severityalertsupdated: true openAIProcessAttempted: true geoindupdated: false topnaicscode: null region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d8d5395c98b52af017b1c processed: false company_name: Merlin Industries harvester: harvest_ransomware_play_news source: http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion/topic.php?id=CFJvUC8uOAOchh published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-26T18:40:35.301Z' description: 'Company allegedly hacked as reported by Play News ransomware with details: Merlin Industries is a premier manufacturer of pool safety covers, vinyl liners, and spa covers, established in 1988. Private and personal confidential data, clients documents, budget, payroll, accounting, taxes, IDs, finance information and etc.' sourcetype: ransomware implied: true published_date: '2025-06-26T18:40:35.301Z' domain: merlinindustries.com breachDimensions: - _id: 685d95b61929b24fb3ae87c0 key: breachIntention value: intentional displayName: Breach Intention - _id: 685d95b61929b24fb3ae87c1 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d95b61929b24fb3ae87c2 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] geoindupdated: false geoindattempted: true topnaicscode: 54 region: North America severity: 5 severityupdateddate: '2025-06-26T18:45:32.314Z' openAIProcessAttempted: true breachScreenshot: screenshot_685d8d5395c98b52af017b1c_1750963671.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-26T18:47:59.742Z' severityalertsupdated: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d86b095c98b52afdd4dd3 processed: false predicted_tags: [] breachDimensions: - _id: 685d8c521929b24fb3ae8752 key: breachIntention value: intentional displayName: Breach Intention - _id: 685d8c521929b24fb3ae8753 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d8c521929b24fb3ae8754 key: breachStatus value: ongoing displayName: Breach Status company_name: McParlane & Associates harvester: harvest_ransomware_kairos sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-26T17:55:27.996Z' published_date: '2025-06-26T17:43:00.000Z' description: Company allegedly hacked as reported by Kairos domain: mcparlane.com source: http://nerqnacjmdy3obvevyol7qhazkwkv57dwqvye5v46k5bcujtfa6sduad.onion/ implied: true geoindattempted: true severity: 5 severityupdateddate: '2025-06-26T18:05:08.328Z' openAIProcessAttempted: true breachScreenshot: screenshot_685d86b095c98b52afdd4dd3_1750961403.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-26T18:10:11.314Z' severityalertsupdated: true geoindupdated: false topnaicscode: null region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d6fd795c98b52af542d25 processed: false company_name: hubermanlaw.co.il harvester: harvest_ransomware_lynx source: http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/ description: 'Company allegedly hacked as reported by Lynx ransomware with details: With our recognized leadership in applying legal service and technology innovation, we deliver commercial advantage to clients. Our lawyers offer clients a range of integrated global capabilities, including some of the world’s most active M&A, real estate, financial services, litigation and corporate risk practices.' published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-26T16:57:31.485Z' sourcetype: ransomware implied: true published_date: '2025-06-26T16:02:48.261Z' domain: hubermanlaw.co.il breachDimensions: - _id: 685d7e3e1929b24fb3ae86ff key: breachIntention value: intentional displayName: Breach Intention - _id: 685d7e3e1929b24fb3ae8700 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d7e3e1929b24fb3ae8701 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] geoindattempted: true severity: 5 severityupdateddate: '2025-06-26T17:04:38.358Z' openAIProcessAttempted: true breachScreenshot: screenshot_685d6fd795c98b52af542d25_1750957821.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-26T17:10:29.405Z' severityalertsupdated: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d135d95c98b52affcceac processed: false predicted_tags: [] breachDimensions: - _id: 685d2e5c1929b24fb3ae85eb key: breachIntention value: intentional displayName: Breach Intention - _id: 685d2e5c1929b24fb3ae85ec key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d2e5c1929b24fb3ae85ed key: breachStatus value: ongoing displayName: Breach Status company_name: Ubon Ratchathani University harvester: harvest_ransomware_eldorado sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-26T11:19:46.813Z' published_date: '2025-06-26T11:11:07.594Z' description: Company allegedly hacked as reported by El Dorado / BlackLock source: http://zdkexsh2e7yihw5uhg5hpsgq3dois2m5je7lzfagij2y6iw5ptl35gyd.onion/Data_Download/e-tech.ac.th domain: ubu.ac.th implied: true severity: 5 severityupdateddate: '2025-06-26T11:21:36.737Z' severityalertsupdated: true geoindattempted: true openAIProcessAttempted: true breachScreenshot: screenshot_685d135d95c98b52affcceac_1750937353.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-26T11:29:21.661Z' geoindupdated: false topnaicscode: 31 region: Asia - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685cb04095c98b52afeb87d8 processed: false company_name: QHR Ltd Hacked harvester: harvest_ransomware_handala breachScreenshot: handala_QHR Ltd Hacked.png timestamp: '2025-06-26T11:21:38.853Z' language: en sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-26T00:00:00.000Z' source: http://vmjfieomxhnfjba57sd6jjws2ogvowjgxhhfglsikqvvrnrajbmpxqqd.onion/?p=397 description: 'Company allegedly hacked as reported by Handala Team with details: QHR Ltd Hacked After Job Info and Job Place, QHR was next. One by one, the pillars fall. You built your walls high. You trusted in silence, in firewalls, in forgetfulness. But the echoes of the unseen do not fade. Your gates were not as closed as you believed. Some doors are meant to stay shut , yet you left them ajar. We watched. We listened. And we entered. This is only the beginning. All recruitment companies under the Zionist regime are now in the hands of Handala. The data, the networks, the connections , all seen, all seized. We seek no ransom. We seek no fame. We are memory. We are the voice of the silenced. We came to remind. And the marvel of the resistance will soon reveal itself not only in the shadows of code, but in the light of the real world. Handala does not forget. In the dark, we wait. Dumped Data= 403 GB PoC Leaked More info: https://t.me/handala_channel Password: handala Download PoC' implied: true domain: qhrtechnologies.com breachDimensions: - _id: 685d2e5c1929b24fb3ae85e3 key: breachIntention value: intentional displayName: Breach Intention - _id: 685d2e5c1929b24fb3ae85e4 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d2e5c1929b24fb3ae85e5 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] news_source: '' industry: '' location: '' breach_cause: '' breach_type: '' hacker: '' records: 0 geoindupdated: false geoindattempted: true topnaicscode: 51 region: North America openAIProcessAttempted: true severity: 5 severityupdateddate: '2025-06-26T11:41:46.364Z' severityalertsupdated: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d36c195c98b52af5eb102 processed: false company_name: MultiStone harvester: harvest_ransomware_akira breachScreenshot: akiraNews_MultiStone.png timestamp: '2025-06-26T12:55:36.650Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-26T00:00:00.000Z' source: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ description: 'Company allegedly hacked as reported by Akira ransomware with details: MultiStone is the Low Country''s leader in fabrication and installation of Natural and Engineered stone countertops.We are ready to upload more than 8 GB of documents such as: employee documents, financial data, lots of projects, confidentialityagreements, etc.' implied: true domain: multistoneinc.com breachDimensions: - _id: 685d45d01929b24fb3ae8633 key: breachIntention value: intentional displayName: Breach Intention - _id: 685d45d01929b24fb3ae8634 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d45d01929b24fb3ae8635 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] geoindattempted: true severity: 5 severityupdateddate: '2025-06-26T13:02:25.796Z' openAIProcessAttempted: true severityalertsupdated: true geoindupdated: false topnaicscode: null region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d610195c98b52af078232 processed: false company_name: Martin Showers Smith& McDonald harvester: harvest_ransomware_akira breachScreenshot: akiraNews_Martin Showers Smith.png timestamp: '2025-06-26T15:39:50.446Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-26T00:00:00.000Z' source: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ description: 'Company allegedly hacked as reported by Akira ransomware with details: Martin, Showers, Smith McDonald, LLC is a law firm specializing in civil litigation, trial law, personal injury, and family law.We are ready to upload more than 8 GB of documents. More than half of the data are scans of client personal documents (passports,SSNs, death/birth certificates, DLs and more), employee information, confidential documents, court reports.' implied: true domain: mssm-law.com breachDimensions: - _id: 685d6b741929b24fb3ae86cb key: breachIntention value: intentional displayName: Breach Intention - _id: 685d6b741929b24fb3ae86cc key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d6b741929b24fb3ae86cd key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] geoindattempted: true severity: 5 severityupdateddate: '2025-06-26T15:43:49.641Z' openAIProcessAttempted: true geoindupdated: false topnaicscode: null region: North America severityalertsupdated: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d610195c98b52af078231 processed: false company_name: Imblum Law Offices harvester: harvest_ransomware_akira breachScreenshot: akiraNews_Imblum Law Offices.png timestamp: '2025-06-26T15:39:50.600Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-26T00:00:00.000Z' source: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ description: 'Company allegedly hacked as reported by Akira ransomware with details: Imblum Law Offices PC specializes in bankruptcy law, offering services such as Chapter 7, Chapter 11, and Chapter 13 bankruptcy filing, as well as foreclosure defense and debt relief.We are ready to upload more than 20 GB of documents such as: client personal documents (passports, SSNs, death/birth certificates,financial information), court hearings, protocols, employee information, other confidential documents.' implied: true domain: imblumlaw.com breachDimensions: - _id: 685d6b741929b24fb3ae86c3 key: breachIntention value: intentional displayName: Breach Intention - _id: 685d6b741929b24fb3ae86c4 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d6b741929b24fb3ae86c5 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] geoindattempted: true severity: 5 severityupdateddate: '2025-06-26T15:43:49.641Z' openAIProcessAttempted: true geoindupdated: false topnaicscode: null region: North America severityalertsupdated: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d61ca95c98b52af0bab69 processed: false predicted_tags: [] breachDimensions: - _id: 685d6b741929b24fb3ae86bb key: breachIntention value: intentional displayName: Breach Intention - _id: 685d6b741929b24fb3ae86bc key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d6b741929b24fb3ae86bd key: breachStatus value: ongoing displayName: Breach Status company_name: TAPPOO GROUP OF COMPANIES harvester: harvest_ransomware_qilin breachScreenshot: qilin_tappoo.com.fj.png timestamp: '2025-06-26T15:39:50.621Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-26T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=8ccaa176-e8d6-3b3e-8e90-92a8207b312a description: 'Company allegedly hacked as reported by Qilin ransomware with details: The Essence of Tappoo The Tappoo Group of Companies retails, wholesales and supports an extensive range of high-quality products. RETAIL SERVICES Tappoo Department Stores are located at the key commercial centres of Suva, Nadi and Sigatoka. These stores offer an exclusive range of selected international brands to satisfy the most demanding taste. The Hotel stores offer upmarket luxury goods, resort-wear boutiques, gift & news shops as well as convenience stores and other specialised concessions at Fiji''s major resorts. NATIONAL DISTRIBUTION The Tappoo Group is entrusted with distributing and marketing a wide range of distinguished brands and accomplishes this with innovative approaches to distribution and a meaningful partnership commitment to its customers and suppliers. MANUFACTURING Tappoo is the supplier of Pepsi products in Fiji. The Tappoo Group bottles Pepsi and Pepsi products for the local market at its factory in Lautoka. A bigger factory is in the pipeline to enable the Group to distribute to neighbouring countries soon. Tappoo also has a number of other carbonated drinks in its distribution line-up. Tappoo is also the franchisee for Tarumba, a popular fruit drink which is bottled at its factory in Lautoka under license. FASHION & ELEGANT LIVING If one word could sum up the quality that imbues the Tappoo Group, it would be style. The Group is dedicated to creating shops that look as good as the products it sells."We have always believed that the shopping experience is as important as the product we sell." says Tappoo Group CEO & Exective Director, Madhu Tappoo.Tappoo Department Stores offer perfumes, jewellery, fashion accessories and a wide range of quality merchandise from around the world. Tappoo Home & Leisure Stores in main urban centres of Fiji offer extensive range of branded white goods, home appliances, top-of-the-range electronics and health and fitness equipment. ' domain: tappoo.com.fj implied: true geoindattempted: true severity: 5 severityupdateddate: '2025-06-26T15:43:49.641Z' openAIProcessAttempted: true severityalertsupdated: true geoindupdated: false topnaicscode: 44 region: null - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d6fdd95c98b52af547daf processed: false predicted_tags: [] breachDimensions: - _id: 685d7e3e1929b24fb3ae86f7 key: breachIntention value: intentional displayName: Breach Intention - _id: 685d7e3e1929b24fb3ae86f8 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d7e3e1929b24fb3ae86f9 key: breachStatus value: ongoing displayName: Breach Status company_name: MELILLA.ES harvester: harvest_ransomware_qilin breachScreenshot: qilin_melilla.es.png timestamp: '2025-06-26T16:57:31.649Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-26T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=dc5a4086-46e4-3323-8863-ed47db33a512 description: 'Company allegedly hacked as reported by Qilin ransomware with details: The other day we learned with interest that the autonomous city of Melilla was subjected to a serious hacker attack =) But what surprised us even more was that none of the authorities even tried to contact us. So, it''s time for our team to take the first step =) To begin with, we inform the public that in addition to completely destroyed administrative and network infrastructure of the city, we "brought" with us some very interesting information. In the volume of 4-5 terrabytes =) And at the first stage we have to report that now we have in our hands almost a complete list of personal data of all indigenous inhabitants of Melilla. We also have in our possession a significant list of data about tourists (their personal data). And the interesting thing is that the main reason why we are waiting for negotiators is another! For a long time we have had access to the personal computers of very serious people, and we have information about, to put it mildly, “inappropriate” and “corrupt” use of funds. ' domain: melilla.es implied: true geoindattempted: true severity: 5 severityupdateddate: '2025-06-26T17:04:38.358Z' openAIProcessAttempted: true severityalertsupdated: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685da13095c98b52af7bb435 processed: false predicted_tags: [] breachDimensions: - _id: 685da87e1929b24fb3ae8814 key: breachIntention value: intentional displayName: Breach Intention - _id: 685da87e1929b24fb3ae8815 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685da87e1929b24fb3ae8816 key: breachStatus value: ongoing displayName: Breach Status company_name: Dealmed Medical Supplies harvester: harvest_ransomware_dragonforce breachScreenshot: dragonforce_Dealmed Medical Supplies.png timestamp: '2025-06-26T19:50:17.359Z' language: en sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-26T00:00:00.000Z' source: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog description: 'Company allegedly hacked as reported by DragonForce ransomware with details: (Data of the entire group of companies) Dealmed provides a comprehensive range of medical supplies designed for healthcare professionals. Their products cater t...' domain: dealmed.com implied: true geoindattempted: true severity: 5 severityupdateddate: '2025-06-26T20:06:15.094Z' openAIProcessAttempted: true severityalertsupdated: true geoindupdated: false topnaicscode: null region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685da13095c98b52af7bb46d processed: false company_name: Johnstone Supply Dallas-Fort Worth harvester: harvest_ransomware_dragonforce breachScreenshot: dragonforce_Johnstone Supply Dallas-Fort Worth.png timestamp: '2025-06-26T19:50:17.369Z' language: en sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-26T00:00:00.000Z' source: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog description: 'Company allegedly hacked as reported by DragonForce ransomware with details: Our team is driven by the opportunity to deliver outstanding service to everyone who may visit our stores. Ethics, partnership and integrity are the main values...' domain: johnstonesupply.com implied: true breachDimensions: - _id: 685da87e1929b24fb3ae880c key: breachIntention value: intentional displayName: Breach Intention - _id: 685da87e1929b24fb3ae880d key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685da87e1929b24fb3ae880e key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] geoindupdated: false geoindattempted: true topnaicscode: 42 region: North America severity: 5 severityupdateddate: '2025-06-26T20:06:15.094Z' openAIProcessAttempted: true severityalertsupdated: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685da13095c98b52af7bb46e processed: false predicted_tags: [] breachDimensions: - _id: 685da87d1929b24fb3ae8804 key: breachIntention value: intentional displayName: Breach Intention - _id: 685da87d1929b24fb3ae8805 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685da87d1929b24fb3ae8806 key: breachStatus value: ongoing displayName: Breach Status company_name: Antigo Construction harvester: harvest_ransomware_dragonforce breachScreenshot: dragonforce_Antigo Construction.png timestamp: '2025-06-26T19:50:17.543Z' language: en sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-26T00:00:00.000Z' source: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog description: 'Company allegedly hacked as reported by DragonForce ransomware with details: (including email) Antigo Construction is located in Antigo, Wisconsin, and is the company headquarters for the North American and international business operati...' domain: antigoconstruction.com implied: true geoindattempted: true severity: 5 severityupdateddate: '2025-06-26T20:06:15.094Z' openAIProcessAttempted: true severityalertsupdated: true geoindupdated: false topnaicscode: null region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: [] _id: 685c05e895c98b52af407b96 processed: false predicted_tags: [] breachDimensions: - _id: 685c19611929b24fb3ae83e6 key: breachScope value: partial displayName: Breach Scope - _id: 685c19611929b24fb3ae83e7 key: breachIntention value: accidental displayName: Breach Intention - _id: 685c19611929b24fb3ae83e8 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685c19611929b24fb3ae83e9 key: breachStatus value: ongoing displayName: Breach Status company_name: Positive Solutions harvester: harvest_ransomware_interlock sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-25T15:27:36.772Z' published_date: '2025-06-25T15:21:31.555Z' description: 'Company allegedly hacked as reported by Interlock with details: https://positivesolutions.schoolPositive Solutions High School offers a flexible learning environment with a split session format and a College Credit Program, enabling students to earn college credits while completing high school. The school empowers students with resources for future employment and personal success, emphasizing academic excellence and student accountability.' source: http://ebhmkoohccl45qesdbvrjqtyro2hmhkmh6vkyfyjjzfllm3ix72aqaid.onion/leaks.php domain: positivesolutions.school implied: true breachScreenshot: screenshot_685c05e895c98b52af407b96_1750865327.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-25T15:28:55.957Z' geoindattempted: true severity: 5 severityupdateddate: '2025-06-25T15:31:44.764Z' severityalertsupdated: true openAIProcessAttempted: true analysisDate: '2025-06-25T15:44:33.653Z' isOpenAIProcessing: false geoindupdated: false topnaicscode: 61 region: null - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685c013b95c98b52af27c523 processed: false company_name: Wilsonville Toyota-Scion harvester: harvest_ransomware_interlock sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' timestamp: '2025-06-25T15:27:59.202Z' published_date: '2025-06-25T15:21:31.555Z' description: 'Company allegedly hacked as reported by Interlock with details: https://www.wilsonvilletoyota.comWilsonville Toyota-Scion is a new and used car dealership company. It provides a variety of vehicles, including coupes, convertibles, hatchbacks, sedans, and passenger vans. The company was formed in 2007 and is based in Wilsonville, Oregon' source: http://ebhmkoohccl45qesdbvrjqtyro2hmhkmh6vkyfyjjzfllm3ix72aqaid.onion/leaks.php domain: wilsonvilletoyota.com implied: true breachDimensions: - _id: 685c195f1929b24fb3ae83c5 key: breachIntention value: intentional displayName: Breach Intention - _id: 685c195f1929b24fb3ae83c6 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685c195f1929b24fb3ae83c7 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] geoindattempted: true severity: 5 severityupdateddate: '2025-06-25T15:31:44.764Z' severityalertsupdated: true openAIProcessAttempted: true breachScreenshot: screenshot_685c013b95c98b52af27c523_1750866912.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-25T15:55:20.520Z' geoindupdated: false topnaicscode: 44 region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685bfd2a95c98b52af12f9a4 processed: false company_name: Medical Center of Marin harvester: harvest_ransomware_inc timestamp: '2025-06-25T13:49:41.509Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' description: 'Company allegedly hacked as reported by INC ransomware with details: Medical Center of Marin provides quality urgent care in the Bay Area. If you need a doctor see the health care experts at their medical clinic. Their experienced doctors and staff are committed to providing fast high-quality care at an affordable price. But they chose to keep their own money over the privacy of their patients'' sensitive data.%0D' source: http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/685bfbeeba689080132ce98d published_date: '2025-06-25T13:38:54.229Z' implied: true breachDimensions: - _id: 685c01de1929b24fb3ae839c key: breachIntention value: intentional displayName: Breach Intention - _id: 685c01de1929b24fb3ae839d key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685c01de1929b24fb3ae839e key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] domain: mcomarin.com severity: 5 severityupdateddate: '2025-06-25T13:50:52.301Z' geoindattempted: true severityalertsupdated: true openAIProcessAttempted: true breachScreenshot: screenshot_685bfd2a95c98b52af12f9a4_1750860548.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-25T14:09:16.981Z' geoindupdated: false topnaicscode: null region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: [] _id: 685bce4f95c98b52af906803 processed: false company_name: Fund for Reformed Companies (FONPER) harvester: harvest_ransomware_inc timestamp: '2025-06-25T10:44:14.762Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' description: 'Company allegedly hacked as reported by INC ransomware with details: The Fondo Patrimonial de las Empresas Reformadas (FONPER) is an institution of the Dominican State created by virtue of Law number 124-01 enacted on July 24 2001 whose fundamental mission is to watch over safeguard and administer the State''s shares in the companies that emerged from the reform and transformation process carried out as of 1997' source: http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/685bcd9dba689080132af15f published_date: '2025-06-25T10:21:17.569Z' implied: true domain: fc-abogados.com breachDimensions: - _id: 685bd7a31929b24fb3ae82ed key: breachScope value: partial displayName: Breach Scope - _id: 685bd7a31929b24fb3ae82ee key: breachIntention value: intentional displayName: Breach Intention - _id: 685bd7a31929b24fb3ae82ef key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685bd7a31929b24fb3ae82f0 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] breachScreenshot: screenshot_685bce4f95c98b52af906803_1750848498.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-25T10:48:26.379Z' geoindattempted: true severity: 5 severityupdateddate: '2025-06-25T10:49:24.375Z' severityalertsupdated: true openAIProcessAttempted: true analysisDate: '2025-06-25T11:04:03.973Z' isOpenAIProcessing: false - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: true taggroups: - PII - business - financial _id: 685bb33f95c98b52af4266b5 processed: true company_name: gmors co., ltd harvester: harvest_ransomware_underground timestamp: '2025-06-25T10:44:14.873Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' description: "Company allegedly hacked as reported by Underground ransomware with details: GMORS (Ge Mao Rubber\ \ Industrial Co., Ltd.), a Taiwanese company established in 1986. GMORS specializes in the design and manufacturing\ \ of high-performance rubber sealing components, serving a diverse range of industries including automotive,\ \ semiconductor, oil & gas, medical, aerospace, and food & beverage.\n\n-Passports of the General Manager's\ \ Office members and shareholders\n-Downloaded VIPs' mailboxes \n-Information from VIP and shareholder profiles\n\ -Children's and employee passports\n-Documents from employee profiles, information on salaries, insurance,\ \ passport numbers, addresses\n-Financial documents: income statements, sales data, invoices, purchase contracts\n\ -Contracts, agreements, NDA's, confidentiality agreements\n-Confidential and proprietary documents\n-Product\ \ technical specifications\n-Financial information on clients, their contact information \n-Project documentation,\ \ information on patents, designs and drawings, 3D models\n-Product testing reports, defect reports \n-Trade\ \ secret and confidential documentation of other companies, proprietary design of other companies \n-Internal\ \ and external business correspondence\n-Boarding meetings, business development plans, sales plans" source: https://47glxkuxyayqrvugfumgsblrdagvrah7gttfscgzn56eyss5wg3uvmqd.onion/packages/0fda348d-7729-4cc9-9b32-28f643dee47e published_date: '2025-06-25T00:00:00.000Z' implied: true domain: gmors.com breachDimensions: - _id: 685bd7a21929b24fb3ae82dc key: breachScope value: partial displayName: Breach Scope - _id: 685bd7a21929b24fb3ae82dd key: breachIntention value: intentional displayName: Breach Intention - _id: 685bd7a21929b24fb3ae82de key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685bd7a21929b24fb3ae82df key: breachStatus value: ongoing displayName: Breach Status predicted_tags: - _id: 685bd7a21929b24fb3ae82d5 tags: id-passports confidence: $numberDecimal: '1' - _id: 685bd7a21929b24fb3ae82d6 tags: id-names confidence: $numberDecimal: '1' - _id: 685bd7a21929b24fb3ae82d7 tags: customer-details confidence: $numberDecimal: '1' - _id: 685bd7a21929b24fb3ae82d8 tags: financial-details confidence: $numberDecimal: '1' - _id: 685bd7a21929b24fb3ae82d9 tags: confidential-information confidence: $numberDecimal: '1' - _id: 685bd7a21929b24fb3ae82da tags: demographic-details confidence: $numberDecimal: '1' breachScreenshot: screenshot_685bb33f95c98b52af4266b5_1750848478.png screenshotAttempted: true screenshotAttemptedDate: '2025-06-25T10:48:06.832Z' geoindupdated: false geoindattempted: true topnaicscode: 31 region: Asia severity: 5 severityupdateddate: '2025-06-25T10:49:24.375Z' severityalertsupdated: true openAIProcessAttempted: true analysisDate: '2025-06-25T11:04:02.565Z' tag_date: '2025-06-25T11:04:02.563Z' isOpenAIProcessing: false - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685bc9e695c98b52af836e46 processed: false predicted_tags: [] breachDimensions: - _id: 685bd79c1929b24fb3ae82cc key: breachIntention value: intentional displayName: Breach Intention - _id: 685bd79c1929b24fb3ae82cd key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685bd79c1929b24fb3ae82ce key: breachStatus value: ongoing displayName: Breach Status company_name: CMI harvester: harvest_ransomware_qilin breachScreenshot: qilin_cmiweb.com.png timestamp: '2025-06-25T10:44:14.898Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=e6118ec1-2c10-3baf-8fff-4cb777329e03 description: 'Company allegedly hacked as reported by Qilin ransomware with details: Credit Mediators Inc. specializes in commercial B2B debt recovery and collection services, offering solutions such as direct collect, letter series, outsourcing, and bankruptcy turnaround services. With over 40 years of experience, CMI serves a diverse client base across various industries including construction, finance, Freight, printing, legal, food and beverage, and commercial insurance. The company''s proprietary collection programs are designed to expedite debt recovery while maintaining strong relationships with clients. CMI is registered, licensed, and bonded in the states where required, and is known for its professionalism and high success rate in debt collection. ' domain: cmiweb.com implied: true geoindattempted: true severity: 5 severityupdateddate: '2025-06-25T10:49:24.375Z' severityalertsupdated: true openAIProcessAttempted: true geoindupdated: false topnaicscode: 31 region: null - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685bd7fd95c98b52afa8c18c processed: false company_name: T.O. Brasil harvester: harvest_ransomware_worldleaks breachScreenshot: worldleaks_T.O. Brasil.png timestamp: '2025-06-25T11:45:46.859Z' language: en sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: https://worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid.onion/companies description: T.O. Brasil allegedly breached as reported by World Leaks ransomware. implied: true domain: to-brasil.com breachDimensions: - _id: 685be5b71929b24fb3ae8309 key: breachIntention value: intentional displayName: Breach Intention - _id: 685be5b71929b24fb3ae830a key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685be5b71929b24fb3ae830b key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] geoindattempted: true severity: 5 severityupdateddate: '2025-06-25T11:49:52.926Z' severityalertsupdated: true openAIProcessAttempted: true geoindupdated: false topnaicscode: 51 region: null - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685be53f95c98b52afd14e7f processed: false company_name: Pennant Park harvester: harvest_ransomware_akira breachScreenshot: akiraNews_Pennant Park.png timestamp: '2025-06-25T12:05:58.875Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ description: 'Company allegedly hacked as reported by Akira ransomware with details: PennantPark is an independent middle market credit provider specializing in targeted exposure to core middle market credit.We are ready to upload more than 6 GB of documents such as: employee documents (SSNs, IDs, passports, DLs, and so on), financial data, confidential reports, client data, etc.' implied: true domain: pennantpark.com breachDimensions: - _id: 685bea681929b24fb3ae8335 key: breachIntention value: intentional displayName: Breach Intention - _id: 685bea681929b24fb3ae8336 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685bea681929b24fb3ae8337 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] severity: 5 severityupdateddate: '2025-06-25T12:10:04.293Z' geoindupdated: false geoindattempted: true topnaicscode: 52 region: North America severityalertsupdated: true openAIProcessAttempted: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685bec8e95c98b52afe714b1 processed: false company_name: Informatika A.D. harvester: harvest_ransomware_worldleaks breachScreenshot: worldleaks_Informatika A.D..png timestamp: '2025-06-25T12:42:13.999Z' language: en sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: https://worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid.onion/companies description: Informatika A.D. allegedly breached as reported by World Leaks ransomware. implied: true breachDimensions: - _id: 685bef191929b24fb3ae8343 key: breachIntention value: intentional displayName: Breach Intention - _id: 685bef191929b24fb3ae8344 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685bef191929b24fb3ae8345 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] domain: informatika.com geoindattempted: true openAIProcessAttempted: true severity: 5 severityupdateddate: '2025-06-25T12:50:23.292Z' severityalertsupdated: true geoindupdated: false topnaicscode: 31 region: null - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685c021f95c98b52af2c80d9 processed: false predicted_tags: [] breachDimensions: - _id: 685c195f1929b24fb3ae83dd key: breachIntention value: intentional displayName: Breach Intention - _id: 685c195f1929b24fb3ae83de key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685c195f1929b24fb3ae83df key: breachStatus value: ongoing displayName: Breach Status company_name: TECORE harvester: harvest_ransomware_qilin breachScreenshot: qilin_tecore.com.png timestamp: '2025-06-25T15:27:36.776Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=7e5df01c-82d8-37a0-8180-1ce03d2f7682 description: 'Company allegedly hacked as reported by Qilin ransomware with details: Founded in 1991 and headquartered in Hanover, Maryland, Tecore Networks has been a supplier of 2G, 3G, 4G and 5G-ready wireless network infrastructure. Tecore Solutions Tecore Networks is a global supplier of All-G mobile networks that provide services from the Core to the Edge. Tecore’s architecture supports standardized open interfaces (O-RAN) between the Radio Unit(RU), Distributed Unit(DU) and the Centralized Unit(CU) that provides an end-to-end solution on the RAN, reducing single-vendor dependency and increasing modularity. ' domain: tecore.com implied: true geoindattempted: true severity: 5 severityupdateddate: '2025-06-25T15:31:44.764Z' severityalertsupdated: true openAIProcessAttempted: true geoindupdated: false topnaicscode: 51 region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685c065595c98b52af42fce2 processed: false predicted_tags: [] breachDimensions: - _id: 685c195f1929b24fb3ae83d5 key: breachIntention value: intentional displayName: Breach Intention - _id: 685c195f1929b24fb3ae83d6 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685c195f1929b24fb3ae83d7 key: breachStatus value: ongoing displayName: Breach Status company_name: GUDECO.DE harvester: harvest_ransomware_qilin breachScreenshot: qilin_gudeco.de.png timestamp: '2025-06-25T15:27:36.959Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=7b4ffe03-653a-3116-95bd-230fc05528d8 description: 'Company allegedly hacked as reported by Qilin ransomware with details: Gudeco Elektronik has been a contractual partner of leading manufacturers in the electronics industry for more than 40 years – well known as a specialist and distributor for electronic components / passive and electromechanical components, devices, connection technology, component preparation – and last but not least for our assembly service. As a supplier of components, we are your reliable partner. Areas of application include mechanical engineering, plant engineering, switchgear construction, industrial electronics, and information technology. Our services: Design-in consulting, delivery even in small quantities outside the VPE, sampling, barcodes, buffer stock for customer-specific special parts, consignment stock and other logistics solutions. ' domain: gudeco.de implied: true geoindupdated: false geoindattempted: true topnaicscode: 42 region: Europe severity: 5 severityupdateddate: '2025-06-25T15:31:44.764Z' severityalertsupdated: true openAIProcessAttempted: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685c06be95c98b52af451b67 processed: false predicted_tags: [] breachDimensions: - _id: 685c195f1929b24fb3ae83cd key: breachIntention value: intentional displayName: Breach Intention - _id: 685c195f1929b24fb3ae83ce key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685c195f1929b24fb3ae83cf key: breachStatus value: ongoing displayName: Breach Status company_name: pilotthomas.com harvester: harvest_ransomware_clop breachScreenshot: clop_pilotthomas.com.png timestamp: '2025-06-25T15:27:37.140Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/pilotthomas-com description: pilotthomas.com allegedly hacked as reported by Clop ransomware. domain: pilotthomas.com implied: true geoindupdated: false geoindattempted: true topnaicscode: 21 region: North America severity: 5 severityupdateddate: '2025-06-25T15:31:44.764Z' severityalertsupdated: true openAIProcessAttempted: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685c1e4f95c98b52afc4577f processed: false predicted_tags: [] breachDimensions: - _id: 685c35911929b24fb3ae8429 key: breachIntention value: intentional displayName: Breach Intention - _id: 685c35911929b24fb3ae842a key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685c35911929b24fb3ae842b key: breachStatus value: ongoing displayName: Breach Status company_name: AEROBLOX harvester: harvest_ransomware_qilin breachScreenshot: qilin_aeroblox.io.png timestamp: '2025-06-25T17:30:41.396Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=68666792-07dc-3fca-b61e-e3962586e952 description: 'Company allegedly hacked as reported by Qilin ransomware with details: Optimizing for What’s Next The AEROBLOX platform is currently undergoing optimization to better serve your tokenized assets. Smart contracts are syncing. Protocols are refining. Value engines are recalibrating. Your wealth is safe. Your future is loading. Ownership is forever. Driven by innovation. Built for the next generation of wealth builders. ' domain: aeroblox.io implied: true geoindattempted: true severity: 5 severityupdateddate: '2025-06-25T17:32:45.240Z' severityalertsupdated: true openAIProcessAttempted: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685c76d195c98b52afeaa43f processed: false predicted_tags: [] breachDimensions: - _id: 685c80ba1929b24fb3ae84dc key: breachIntention value: intentional displayName: Breach Intention - _id: 685c80ba1929b24fb3ae84dd key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685c80ba1929b24fb3ae84de key: breachStatus value: ongoing displayName: Breach Status company_name: HABITAT FOR HUMANITY OF GREATER SIOUX FALLS, INC. harvester: harvest_ransomware_qilin breachScreenshot: qilin_siouxfallshabitat.org.png timestamp: '2025-06-25T22:51:09.449Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=a6829fe3-deda-3c38-9e1c-6daf5a4779db description: 'Company allegedly hacked as reported by Qilin ransomware with details: We build, preserve & advocate for affordable housing. Habitat for Humanity of Greater Sioux Falls is committed to improving the quality of life, health and economic prosperity of our community through shelter. Eligible residents of Minnehaha, Lincoln and Turner counties are encouraged to apply for our affordable homeownership and repairs programs. By working with Habitat, individuals and families can transform their lives. ' domain: siouxfallshabitat.org implied: true geoindattempted: true severity: 5 severityupdateddate: '2025-06-25T22:55:31.701Z' severityalertsupdated: true openAIProcessAttempted: true geoindupdated: false topnaicscode: 52 region: null - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685cb04095c98b52afeb87ed processed: false company_name: JobPlace Ltd Hacked harvester: harvest_ransomware_handala breachScreenshot: handala_JobPlace Ltd Hacked.png timestamp: '2025-06-26T11:25:22.013Z' language: en sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: http://vmjfieomxhnfjba57sd6jjws2ogvowjgxhhfglsikqvvrnrajbmpxqqd.onion/?p=400 description: 'Company allegedly hacked as reported by Handala Team with details: JobPlace Ltd Hacked After the Job Info company, it’s now time for Job Place Today, we confirm that JobPlace, one of the largest Israeli employment and staffing companies, has been successfully breached by the Handala. All internal systems were accessed and fully compromised. We have exfiltrated a comprehensive dataset including employee details, client information, recruitment documents, internal communications, and infrastructure configurations. (+621 GB) This operation forms part of our ongoing campaign to expose and disrupt the economic and administrative systems that support occupation and oppression. Let this serve as a message: those who profit from injustice are not immune. Infrastructure can be rebuilt , but trust, once broken, cannot. +32GB As PoC Leaked More details will follow. As part of our expanding cyber campaign, the Handala has successfully breached JobPlace , a major Israeli recruitment and staffing firm. This is not merely a corporate takedown. Through this operation, we have acquired and extracted the personal and classified data of hundreds of thousands of Zionist individuals, including employees, contractors, and candidates affiliated with Israel’s most sensitive governmental and security institutions. All acquired intelligence has been securely transferred to resistance-aligned intelligence services across the region. The identities, career paths, contact information, and background data of those complicit in the machinery of occupation are no longer safe. This marks a strategic victory in the digital front of resistance. The infrastructure that supports apartheid is vulnerable , and now, exposed. We are not done. +32GB As PoC Leaked Password: handala Download part 1 Download part 2 Downlaod part 3' implied: true domain: job-place.co.il breachDimensions: - _id: 685d2e5c1929b24fb3ae85db key: breachIntention value: intentional displayName: Breach Intention - _id: 685d2e5c1929b24fb3ae85dc key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d2e5c1929b24fb3ae85dd key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] news_source: '' industry: '' location: '' breach_cause: '' breach_type: '' hacker: '' records: 0 openAIProcessAttempted: true geoindattempted: true severity: 5 severityupdateddate: '2025-06-26T11:41:46.364Z' severityalertsupdated: true - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d1f9495c98b52af1cd880 processed: false predicted_tags: [] breachDimensions: - _id: 685d2e5c1929b24fb3ae85d3 key: breachIntention value: intentional displayName: Breach Intention - _id: 685d2e5c1929b24fb3ae85d4 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d2e5c1929b24fb3ae85d5 key: breachStatus value: ongoing displayName: Breach Status company_name: AIREDALE SPRINGS harvester: harvest_ransomware_qilin breachScreenshot: qilin_airedalesprings.co.uk.png timestamp: '2025-06-26T11:25:31.296Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=9ef5eea3-a83d-38bc-9e8e-ebf21b2ea83f description: 'Company allegedly hacked as reported by Qilin ransomware with details: Established in 1945 Airedale Springs Ltd is a successful family business which has gained a World-Wide reputation for up to the minute expertise for the manufacture of quality springs and wire forms for many national and international customers. In 2012 it moved to its purpose built premises in Haworth incorporating innovative and unique facilities, including low energy lighting and solar power generation. We have been a market leader within the industry for over 70 years. Using the very latest computer controlled manufacturing and inspection techniques supported by highly skilled and professional staff, enables us to provide a flexible service for small or large quantity ' domain: airedalesprings.co.uk implied: true openAIProcessAttempted: true geoindattempted: true severity: 5 severityupdateddate: '2025-06-26T11:41:46.364Z' severityalertsupdated: true geoindupdated: false topnaicscode: 21 region: Europe - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d22e695c98b52af261a60 processed: false predicted_tags: [] breachDimensions: - _id: 685d2e5c1929b24fb3ae85cb key: breachIntention value: intentional displayName: Breach Intention - _id: 685d2e5c1929b24fb3ae85cc key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d2e5c1929b24fb3ae85cd key: breachStatus value: ongoing displayName: Breach Status company_name: Pay Tel Communications harvester: harvest_ransomware_dragonforce breachScreenshot: dragonforce_Pay Tel Communications.png timestamp: '2025-06-26T11:25:33.435Z' language: en sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog description: 'Company allegedly hacked as reported by DragonForce ransomware with details: Pay Tel Communications, Inc. specializes in providing technology solutions designed to enhance safety and efficiency within confinement facilities and support t...' domain: paytel.com implied: true openAIProcessAttempted: true geoindattempted: true severity: 5 severityupdateddate: '2025-06-26T11:41:46.364Z' severityalertsupdated: true geoindupdated: false topnaicscode: 51 region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d36c195c98b52af5eb0c4 processed: false company_name: Arbour Volkswagen harvester: harvest_ransomware_akira breachScreenshot: akiraNews_Arbour Volkswagen.png timestamp: '2025-06-26T12:57:15.235Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ description: 'Company allegedly hacked as reported by Akira ransomware with details: Throughout the year your Arbour Volkswagen in Laval offers you alarge choice of special offers, impressive rebates and unbeatablepromotions.We are ready to upload more than 4 GB of documents such as: confidential agreements containing clients personal information, detailed financial data (audits, payment details, reports, invoices),employee and partners information, etc.' implied: true domain: arbourvw.com breachDimensions: - _id: 685d45d01929b24fb3ae862b key: breachIntention value: intentional displayName: Breach Intention - _id: 685d45d01929b24fb3ae862c key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d45d01929b24fb3ae862d key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] severity: 5 severityupdateddate: '2025-06-26T13:02:25.796Z' geoindattempted: true openAIProcessAttempted: true severityalertsupdated: true geoindupdated: false topnaicscode: null region: North America - breachdates: [] tags: [] othersources: [] tmptitles: [] tmplinks: [] othersourcestype: [] othersourcesharvester: [] openAIProcessed: false taggroups: [] _id: 685d36c195c98b52af5eb100 processed: false company_name: Studio Verna SocietàProfessionale harvester: harvest_ransomware_akira breachScreenshot: akiraNews_Studio Verna Società.png timestamp: '2025-06-26T12:57:15.491Z' sourcetype: ransomware published_mo_yr: '2025-06-01T00:00:00.000Z' published_date: '2025-06-25T00:00:00.000Z' source: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ description: 'Company allegedly hacked as reported by Akira ransomware with details: Studio Verna Società Professionale offers integrated economic, tax and legal advice to businesses and third sector entities, witha highly personalized approach to the needs of the client and thesector in which it operates.We are ready to upload more than 7 GB of documents such as: financial data (audits, payment details, reports, invoices), client financial data, agreements, project information, employee information, etc.' implied: true domain: studioverna.it breachDimensions: - _id: 685d45d01929b24fb3ae8623 key: breachIntention value: intentional displayName: Breach Intention - _id: 685d45d01929b24fb3ae8624 key: breachAttackSource value: hacker displayName: Breach Attack - _id: 685d45d01929b24fb3ae8625 key: breachStatus value: ongoing displayName: Breach Status predicted_tags: [] news_source: '' industry: '' location: '' breach_cause: '' breach_type: '' hacker: '' records: 0 severity: 5 severityupdateddate: '2025-06-26T13:02:25.796Z' geoindattempted: true openAIProcessAttempted: true severityalertsupdated: true geoindupdated: false topnaicscode: null region: Europe '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breachupdatedlog/count/: get: tags: - Third Party Accounts summary: Read count of all documents operationId: getReadCountOfAllDocuments description: 'Folder: Hacks Update Log.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breachupdatedlog/page/{pageNum}: get: tags: - Third Party Accounts summary: Read a page of documents operationId: getReadAPageOfDocuments4 description: 'Folder: Hacks Update Log.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breachupdatedlog/search: post: tags: - Third Party Accounts summary: Search all operationId: postSearchAll3 description: 'Folder: Hacks Update Log. Searches all documents and returns documents in reverse chronological order.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: document id to search for responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /breachupdatedlog/{documentId}: get: tags: - Third Party Accounts summary: Read a document operationId: getReadADocument7 description: 'Folder: Hacks Update Log. Get a document by the document ID.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /customerHabits: get: tags: - All Business Accounts summary: Read a document operationId: getReadADocument5 description: 'Folder: Customer Habits. Get a document by the document ID.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - All Business Accounts summary: Update habits operationId: putUpdateHabits description: 'Folder: Customer Habits.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: remediations: type: array example: remediations: - remediated: false remediationTag: financial-creditreports responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /customers: get: tags: - All Business Accounts summary: Read a document operationId: getReadADocument3 description: 'Folder: Customer. Get a document by the document ID.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] post: tags: - All Business Accounts summary: Update a document operationId: postUpdateADocument description: 'Folder: Customer. Get a document by the document ID.' requestBody: required: true content: application/json: schema: type: object properties: contactInformation: type: object preferences: type: object example: contactInformation: phone: 555-555-5555 email: contact@hacknotice.com url: hacknotice.zendesk.com process: Email. preferences: sendWelcome: monthly responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /customers/accounts: get: tags: - All Business Accounts summary: Read accounts operationId: getReadAccounts description: 'Folder: Customer.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /customerstats: get: tags: - All Business Accounts summary: Read a document operationId: getReadADocument4 description: 'Folder: Customer Metrics. Get a document by the document ID.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /darkhashalerts/count: get: tags: - Deprecated summary: Read count for alerts operationId: getReadCountForAlerts3 description: 'Folder: Dark hash alerts.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] deprecated: true post: tags: - Deprecated summary: Read count for term operationId: postReadCountForTerm description: 'Folder: Dark hash alerts.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] deprecated: true /darkhashalerts/count/{number}: get: tags: - Deprecated summary: Read count for a number of previous days of alerts operationId: getReadCountForANumberOfPreviousDaysOfAlerts2 description: 'Folder: Dark hash alerts.' parameters: - name: number in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] deprecated: true /darkhashalerts/page/{pageNum}: get: tags: - Deprecated summary: Read a page of alerts operationId: getReadAPageOfAlerts2 description: 'Folder: Dark hash alerts. Read a page of the most recent alerts.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] deprecated: true post: tags: - Deprecated summary: Post a page of alerts with options operationId: postAPageOfAlertsWithOptions2 description: 'Folder: Dark hash alerts. Main method for getting back pages of alerts for end user and Dark Hash Collisions. If you are using the dark hash collisions service, you can set the hashpass to true to receive back just the hash and the password for alerts that have both. You can also set the pubsort to true to sort by published_date instead of timestamp, which resolves the issue of older published_date alerts being shown before newer published_date alerts, due to the older alerts having a newer timestamp.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: pubsort: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] deprecated: true /darkhashalerts/search/page/{pageNum}: post: tags: - Deprecated summary: Search email within alerts operationId: postSearchEmailWithinAlerts2 description: 'Folder: Dark hash alerts. Returns the first page of alerts for the email. Use the by page to get the next page.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: Inclusive string search for the email in the alert responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] deprecated: true /darkhashalerts/{documentId}: get: tags: - Deprecated summary: Read a document operationId: getReadADocument11 description: 'Folder: Dark hash alerts.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] deprecated: true /domainalertcalcs/aggregatedates: post: tags: - Calc endpoints summary: POST /domainalertcalcs/aggregatedates operationId: postDomainalertcalcsAggregatedates description: 'Folder: First Party Alerts. Aggregates totalcreddump , totalinfostealer , totaltags , totaltaggroups , totalleakfiles , total , plus rolled-up taggroups and per-leakfile counts over the matching docs. Customer types accepted: domain , research , enduser .' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string domainwatchlist_id: type: string example: startdate: '2025-04-01' enddate: '2025-05-01' domainwatchlist_id: '' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalertcalcs/count: post: tags: - Calc endpoints summary: POST /domainalertcalcs/count operationId: postDomainalertcalcsCount description: 'Folder: First Party Alerts. Count of domain credential-exposure records for the authenticated customer. Body fields startdate / enddate (string, ISO date, optional pair) — date range filter. domainwatchlist_id (string, optional) — filter to a single domain watchlist. Response : integer count.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string domainwatchlist_id: type: string example: startdate: '2025-04-01' enddate: '2025-05-01' domainwatchlist_id: '' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalertcalcs/listdates: post: tags: - Calc endpoints summary: POST /domainalertcalcs/listdates operationId: postDomainalertcalcsListdates description: 'Folder: First Party Alerts. Unpaginated list, sorted by date desc, for the authenticated customer.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string domainwatchlist_id: type: string example: startdate: '2025-04-01' enddate: '2025-05-01' domainwatchlist_id: '' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalertcalcs/page/{pageNum}: post: tags: - Calc endpoints summary: POST /domainalertcalcs/page/:pageNum operationId: postDomainalertcalcsPagePagenum description: 'Folder: First Party Alerts. Paginated list (50 per page) for the authenticated customer.' parameters: - name: pageNum in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: domainwatchlist_id: type: string example: domainwatchlist_id: '' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalertcalcs/stats/aggregatedates: post: tags: - Calc endpoints summary: POST /domainalertcalcs/stats/aggregatedates operationId: postDomainalertcalcsStatsAggregatedates description: 'Folder: First Party Alerts. Stats-flavored aggregation over a preset domain-watchlist changeset . Body fields startdate / enddate — date range. changeset (string) — preset name (e.g. "USA" ) selecting a server-side group of domain watchlists; without it the aggregation has no $in set.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string changeset: type: string example: startdate: '2025-04-01' enddate: '2025-05-01' changeset: USA responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalertcalcs/{docId}: get: tags: - Calc endpoints summary: GET /domainalertcalcs/:docId operationId: getDomainalertcalcsDocid description: 'Folder: First Party Alerts. Fetch a single domain credential-exposure record by _id .' parameters: - name: docId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts: put: tags: - Domain Business Accounts summary: Fix domainalerts for a list of alert _ids operationId: putFixDomainalertsForAListOfAlertIds description: 'Folder: Domainalerts.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: alerts: type: array example: alerts: - 5e37602b8d36ce02cbafa505 - 5e3646ff8d36ce02cbafa09f responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/count: post: tags: - Domain Business Accounts summary: Read count for an account operationId: postReadCountForAnAccount description: 'Folder: Domainalerts. Read the alert count across all domains.' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/deleted/page/{pageNum}: get: tags: - Domain Business Accounts summary: Read page of deleted alerts for an account operationId: getReadPageOfDeletedAlertsForAnAccount description: 'Folder: Domainalerts. Read a page of the most recent alerts that have the deleted flag set to true.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/lastdate: get: tags: - Domain Business Accounts summary: Read alerts last date operationId: getReadAlertsLastDate description: 'Folder: Domainalerts.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/page/{pageNum}: post: tags: - Alerts summary: Read first-party alerts page operationId: postReadFirstPartyAlertsPage description: 'Read First-Party Alerts Page Route: POST /domainalerts/page/:pageNum Returns paginated domain/first-party alerts. Common body filters tier , tag , unmatchTier domainwatchlist_id remediated , deleted sort ( timestamp supported) Time filters: start_date , end_date , hours_ago Credential/detail toggles: creds , credsonly , strongonly , allkeys , csv , keyonly Optional leak/credential filters: leaks , infostealer , credentialdump , redact_password , password_length , password_criteria pageNum is zero-based.' requestBody: required: true content: application/json: schema: type: object properties: tier: type: string tag: type: string remediated: type: boolean start_date: type: string end_date: type: string example: tier: high tag: password remediated: false start_date: '2026-03-01T00:00:00.000Z' end_date: '2026-03-26T00:00:00.000Z' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] parameters: - name: pageNum in: path required: true schema: type: integer get: tags: - Domain Business Accounts summary: Read page for an account operationId: getReadPageForAnAccount description: 'Folder: Domainalerts. Read the most recent alerts for a user across all domains.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/search: post: tags: - Domain Business Accounts summary: Search hit value operationId: postSearchHitValue description: 'Folder: Domainalerts.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: Inclusive string search for the value in the domain or title responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/updatedomain/{documentId}: put: tags: - Domain Business Accounts summary: Update all alerts for a domain operationId: putUpdateAllAlertsForADomain description: 'Folder: Domainalerts. Using the domainwatchlist_id for a domain to find and update alerts, bulk edit the flags on alerts, such as remediated and deleted.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: deleted: type: string description: 'Required. The value must be true or false and key can be any of the following: remediated, deleted, passwordchanged, passwordunique, ato2fa, atouniquepass, atouniqueemail, idwatchlist, idcredit, fraudstolen, fraudfreeze, fraudirs' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/updateemail/{documentId}: put: tags: - Domain Business Accounts summary: Update all alerts for a domain and an email operationId: putUpdateAllAlertsForADomainAndAnEmail description: 'Folder: Domainalerts. Using the email and domainwatchlist_id for a domain to find and update alerts, bulk edit the flags on alerts, such as remediated and deleted.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: email: type: string description: Required. deleted: type: string description: 'Required. The value must be true or false and key can be any of the following: remediated, deleted, passwordchanged, passwordunique, ato2fa, atouniquepass, atouniqueemail, idwatchlist, idcredit, fraudstolen, fraudfreeze, fraudirs' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/{alertId}: get: tags: - Domain Business Accounts summary: Read an alert operationId: getReadAnAlert description: 'Folder: Domainalerts.' parameters: - name: alertId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Domain Business Accounts summary: Update an alert operationId: putUpdateAnAlert description: 'Folder: Domainalerts.' parameters: - name: alertId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: deleted: type: string description: 'Required. The value must be true or false and key can be any of the following: remediated, deleted, passwordchanged, passwordunique, ato2fa, atouniquepass, atouniqueemail, idwatchlist, idcredit, fraudstolen, fraudfreeze, fraudirs' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/{alertId}/count: get: tags: - Domain Business Accounts summary: Read count for a domain operationId: getReadCountForADomain description: 'Folder: Domainalerts.' parameters: - name: alertId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/{alertId}/lastdate: get: tags: - Domain Business Accounts summary: Read alerts last date for a domain operationId: getReadAlertsLastDateForADomain description: 'Folder: Domainalerts.' parameters: - name: alertId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/{alertId}/page/{pageNum}: get: tags: - Domain Business Accounts summary: Read page for a domain operationId: getReadPageForADomain description: 'Folder: Domainalerts.' parameters: - name: alertId in: path required: true schema: type: string - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] post: tags: - Domain Business Accounts summary: Read page for a domain operationId: postReadPageForADomain description: 'Folder: Domainalerts.' parameters: - name: alertId in: path required: true schema: type: string - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: credsonly: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/{alertId}/search: post: tags: - Domain Business Accounts summary: Search hit value within a domain operationId: postSearchHitValueWithinADomain description: 'Folder: Domainalerts.' parameters: - name: alertId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: Inclusive string search for the email in the alert responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalerts/{alertId}/{documentId}: get: tags: - Domain Business Accounts summary: Read an alert for a domain operationId: getReadAnAlertForADomain description: 'Folder: Domainalerts.' parameters: - name: alertId in: path required: true schema: type: string - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Domain Business Accounts summary: Update an alert for a domain operationId: putUpdateAnAlertForADomain description: 'Folder: Domainalerts.' parameters: - name: alertId in: path required: true schema: type: string - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: remediated: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalertscreds/page/{pageNum}: get: tags: - Domain Business Accounts summary: Read page of credentials for an account operationId: getReadPageOfCredentialsForAnAccount description: 'Folder: Domainalerts. GET for a page of credentials for all of the domains for a user. If email and password exist, they will be available through the values email and password. The value of passwordType will either be plaintext, MD5, or SHA1, if it exists.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalertscreds/{documentId}/page/{pageNum}: get: tags: - Domain Business Accounts summary: Read a page of credentials for a domain operationId: getReadAPageOfCredentialsForADomain description: 'Folder: Domainalerts. Read a page of credentials, with the parameters of email and password for a domain.' parameters: - name: documentId in: path required: true schema: type: string - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalertsleaks/page/{pageNum}: get: tags: - Domain Business Accounts summary: Read page of alerts and leaks for an account operationId: getReadPageOfAlertsAndLeaksForAnAccount description: 'Folder: Domainalerts.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainalertsleaks/{documentId}/page/{pageNum}: get: tags: - Domain Business Accounts summary: Read a page of alerts and leaks for a domain operationId: getReadAPageOfAlertsAndLeaksForADomain description: 'Folder: Domainalerts.' parameters: - name: documentId in: path required: true schema: type: string - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainleaks/AYrCzi8pA0BWMJTgGuTGTg3Vxx4%3D: get: tags: - Domain Business Accounts summary: Read a doc operationId: getReadADoc9 description: 'Folder: Domainleak. Get a document by the document ID.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainwatchlist: get: tags: - Domain Business Accounts summary: Read documents operationId: getReadDocuments description: 'Folder: Domainwatchlist. Read all domains.' parameters: - name: X-HackNotice-Integration-Key in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainwatchlist/count: get: tags: - Domain Business Accounts summary: Get the count of all documents operationId: getTheCountOfAllDocuments description: 'Folder: Domainwatchlist. Read all domains.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainwatchlist/page/{pageNum}: get: tags: - Domain Business Accounts summary: Read a page operationId: getReadAPage description: 'Folder: Domainwatchlist. Read a page of domains. Pages are limited to 10 documents per page for domainwatchlist.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] post: tags: - Domain Business Accounts summary: Read a page with parameters operationId: postReadAPageWithParameters description: 'Folder: Domainwatchlist. Read a page of domains. Pages are limited to 10 documents per page for domainwatchlist.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: sort: type: string example: sort: count responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainwatchlist/search: post: tags: - Domain Business Accounts summary: Search domain within watchlist operationId: postSearchDomainWithinWatchlist description: 'Folder: Domainwatchlist.' parameters: - name: X-HackNotice-Integration-Key in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: term: type: string hoveredDate: type: string fromDate: type: string toDate: type: string example: term: example hoveredDate: null fromDate: '2026-01-01' toDate: '2026-05-07' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /domainwatchlist/{watchlistId}: get: tags: - Domain Business Accounts summary: Read a doc operationId: getReadADoc8 description: 'Folder: Domainwatchlist. Get a document by the document ID.' parameters: - name: watchlistId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /downloads: get: tags: - All Business Accounts summary: Read downloads to see if file is ready operationId: getReadDownloadsToSeeIfFileIsReady description: 'Folder: Downloads.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /downloads/domain/all/csv: get: tags: - Domain Business Accounts summary: create csv for all domains operationId: getCreateCsvForAllDomains description: 'Folder: Downloads.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] post: tags: - Domain Business Accounts summary: create csv for all domains operationId: postCreateCsvForAllDomains description: 'Folder: Downloads.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: strongonly: type: boolean example: strongonly: true responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /downloads/domain/all/csv/{documentId}: get: tags: - Domain Business Accounts summary: create csv for domain operationId: getCreateCsvForDomain description: 'Folder: Downloads.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] post: tags: - Domain Business Accounts summary: create csv for domain Copy operationId: postCreateCsvForDomainCopy description: 'Folder: Downloads.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: strongonly: type: boolean example: strongonly: true responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /downloads/domain/thirty/csv: get: tags: - Domain Business Accounts summary: create csv for all domains for the last 30 days operationId: getCreateCsvForAllDomainsForTheLast30Days description: 'Folder: Downloads.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /downloads/domain/thirty/csv/{documentId}: get: tags: - Domain Business Accounts summary: create csv for domain last 30 days operationId: getCreateCsvForDomainLast30Days description: 'Folder: Downloads.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /downloads/{documentId}: get: tags: - All Business Accounts summary: download file operationId: getDownloadFile description: 'Folder: Downloads.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralertcalcs/aggregatedates: post: tags: - Calc endpoints summary: POST /enduseralertcalcs/aggregatedates operationId: postEnduseralertcalcsAggregatedates description: 'Folder: End User Alerts. Aggregation over the matching employee credential-exposure records for the authenticated customer.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string example: startdate: '2025-04-01' enddate: '2025-05-01' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralertcalcs/count: post: tags: - Calc endpoints summary: POST /enduseralertcalcs/count operationId: postEnduseralertcalcsCount description: 'Folder: End User Alerts. Count of employee credential-exposure records for the authenticated customer. Body fields startdate / enddate (string, ISO date, optional pair) — date range. Response : integer count.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string example: startdate: '2025-04-01' enddate: '2025-05-01' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralertcalcs/listdates: post: tags: - Calc endpoints summary: POST /enduseralertcalcs/listdates operationId: postEnduseralertcalcsListdates description: 'Folder: End User Alerts. Unpaginated list, sorted by date desc, for the authenticated customer.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string example: startdate: '2025-04-01' enddate: '2025-05-01' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralertcalcs/page/{pageNum}: post: tags: - Calc endpoints summary: POST /enduseralertcalcs/page/:pageNum operationId: postEnduseralertcalcsPagePagenum description: 'Folder: End User Alerts. Paginated list (50 per page) for the authenticated customer.' parameters: - name: pageNum in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: {} example: {} responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralertcalcs/{docId}: get: tags: - Calc endpoints summary: GET /enduseralertcalcs/:docId operationId: getEnduseralertcalcsDocid description: 'Folder: End User Alerts. Fetch a single employee credential-exposure record by _id .' parameters: - name: docId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralerts: put: tags: - Enduser Business Accounts summary: Fix enduseralerts for a list of alert _ids operationId: putFixEnduseralertsForAListOfAlertIds description: 'Folder: End user alerts.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: alerts: type: array example: alerts: - 5e43dd50721d2b2bde6d5b5d - 5e4350b3721d2b2bde6d596c responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralerts/count: get: tags: - Enduser Business Accounts summary: Read count for alerts operationId: getReadCountForAlerts2 description: 'Folder: End user alerts.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralerts/count/{number}: get: tags: - Enduser Business Accounts summary: Read count for a number of previous days of alerts operationId: getReadCountForANumberOfPreviousDaysOfAlerts description: 'Folder: End user alerts.' parameters: - name: number in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralerts/deleted/page/{pageNum}: get: tags: - Enduser Business Accounts summary: Read a page of deleted alerts operationId: getReadAPageOfDeletedAlerts description: 'Folder: End user alerts. Read a page of the most recent alerts that have the deleted flag set to true.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralerts/enduserwatchlist/update: post: tags: - Enduser Business Accounts summary: Update enduseralerts tags for an email operationId: postUpdateEnduseralertsTagsForAnEmail description: 'Folder: End user alerts.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: email: type: string tags: type: array example: email: example@example.com tags: - Tag A - Tag B responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralerts/lastdate: get: tags: - Enduser Business Accounts summary: Read last alert date operationId: getReadLastAlertDate2 description: 'Folder: End user alerts.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralerts/page/{pageNum}: post: tags: - Alerts summary: Read end-user alerts page operationId: postReadEndUserAlertsPage description: 'Read End-User Alerts Page Route: POST /enduseralerts/page/:pageNum Returns paginated end-user alerts. Common body filters term (exact email match) tier , tag remediated , deleted days sort ( timestamp ) and pubsort Credential/detail toggles: hashpass , leaks , creds , credsonly , csv , allkeys , keyonly pageNum is zero-based.' requestBody: required: true content: application/json: schema: type: object properties: term: type: string tier: type: string tag: type: string remediated: type: boolean days: type: integer example: term: user@example.com tier: medium tag: credential remediated: false days: 7 responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] parameters: - name: pageNum in: path required: true schema: type: integer get: tags: - Enduser Business Accounts summary: Read a page of alerts operationId: getReadAPageOfAlerts description: 'Folder: End user alerts. Read a page of the most recent alerts.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralerts/search: post: tags: - Enduser Business Accounts summary: Search email within alerts operationId: postSearchEmailWithinAlerts description: 'Folder: End user alerts. Returns the first page of alerts for the email. Use the by page to get the next page.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: Inclusive string search for the email in the alert responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralerts/search/page/{pageNum}: post: tags: - Enduser Business Accounts summary: Search email within alerts by page operationId: postSearchEmailWithinAlertsByPage description: 'Folder: End user alerts.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: Inclusive string search for the email in the alert hashpass: type: string pubsort: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralerts/updateall: put: tags: - Enduser Business Accounts summary: Update all documents for an email operationId: putUpdateAllDocumentsForAnEmail description: 'Folder: End user alerts. Using an email to find and update alerts, bulk edit the flags on alerts, such as remediated and deleted.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: email: type: string description: required. deleted: type: string description: 'Required. The value must be true or false and key can be any of the following: remediated, deleted, passwordchanged, passwordunique, ato2fa, atouniquepass, atouniqueemail, idwatchlist, idcredit, fraudstolen, fraudfreeze, fraudirs' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralerts/{alertId}: get: tags: - Enduser Business Accounts summary: Read a document operationId: getReadADocument10 description: 'Folder: End user alerts.' parameters: - name: alertId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Enduser Business Accounts summary: Update a document operationId: putUpdateADocument2 description: 'Folder: End user alerts.' parameters: - name: alertId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: remediated: type: string description: 'Required. The value must be true or false and key can be any of the following: remediated, deleted, passwordchanged, passwordunique, ato2fa, atouniquepass, atouniqueemail, idwatchlist, idcredit, fraudstolen, fraudfreeze, fraudirs' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralertscreds/page/{pageNum}: get: tags: - Enduser Business Accounts summary: Read page of credentials operationId: getReadPageOfCredentials description: 'Folder: End user alerts.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] post: tags: - Enduser Business Accounts summary: Post page of credentials with options operationId: postPageOfCredentialsWithOptions description: 'Folder: End user alerts.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: credsonly: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralertsleaks/page/{pageNum}: get: tags: - Enduser Business Accounts summary: Read a page of alerts and leaks operationId: getReadAPageOfAlertsAndLeaks description: 'Folder: End user alerts.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduseralertsleaks/page/{pageNum}/days/{number}: get: tags: - Enduser Business Accounts summary: Read a page of alerts and leaks for a number of previous days of alerts operationId: getReadAPageOfAlertsAndLeaksForANumberOfPreviousDaysOfAlerts description: 'Folder: End user alerts.' parameters: - name: pageNum in: path required: true schema: type: integer - name: number in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduserleaks: post: tags: - Enduser Business Accounts summary: Read a doc operationId: postReadADoc description: 'Folder: End user leak. Get a document by the document ID.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: _id: type: string email: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduserwatchlist/count: get: tags: - Enduser Business Accounts summary: Get the count of documents operationId: getTheCountOfDocuments5 description: 'Folder: End user watchlist. Get the count of watchlist items.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduserwatchlist/create: post: tags: - Enduser Business Accounts summary: Create a doc operationId: postCreateADoc6 description: 'Folder: End user watchlist. Add a watchlist item to your watchlist. If using Dark Hash Collisions, put the hash in the email key and set the hashed key to true.' requestBody: required: true content: application/json: schema: type: object properties: email: type: string tags: type: array example: email: steve@hacknotice.com tags: - tag 1 - tag 2 responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduserwatchlist/page/{pageNum}: get: tags: - Enduser Business Accounts summary: Read a page of documents operationId: getReadAPageOfDocuments7 description: 'Folder: End user watchlist. Read a page of watchlist items.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduserwatchlist/search: post: tags: - Enduser Business Accounts summary: Search for an email operationId: postSearchForAnEmail description: 'Folder: End user watchlist. Search your watchlist for an email address.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enduserwatchlist/{watchlistId}: get: tags: - Enduser Business Accounts summary: Read a doc operationId: getReadADoc10 description: 'Folder: End user watchlist. Get a document by the document ID.' parameters: - name: watchlistId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - Enduser Business Accounts summary: Delete a doc operationId: deleteADoc8 description: 'Folder: End user watchlist. Remove a document by the document ID.' parameters: - name: watchlistId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /enterpriseHabits: get: tags: - Deprecated summary: Read a document operationId: getReadADocument12 description: 'Folder: Teams Accounts / Enterprise Habits. Get a document by the document ID.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] deprecated: true put: tags: - Deprecated summary: Update habits operationId: putUpdateHabits2 description: 'Folder: Teams Accounts / Enterprise Habits.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: remediations: type: array example: remediations: - remediated: true remediationTag: financial-creditreports responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] deprecated: true /hackalertcalcs/aggregatedates: post: tags: - Calc endpoints summary: POST /hackalertcalcs/aggregatedates operationId: postHackalertcalcsAggregatedates description: 'Folder: Third Party Alerts. $group aggregation over the matching docs for the authenticated customer.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string naics: type: string naicsarray: type: array georegions: type: string georegionsarray: type: array example: startdate: '2025-04-01' enddate: '2025-05-01' naics: '' naicsarray: [] georegions: '' georegionsarray: [] responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalertcalcs/count: post: tags: - Calc endpoints summary: POST /hackalertcalcs/count operationId: postHackalertcalcsCount description: 'Folder: Third Party Alerts. Count of hack/breach exposure records for the authenticated customer. Body fields : same as breachcalcs /count . Response : integer count.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string naics: type: string naicsarray: type: array georegions: type: string georegionsarray: type: array example: startdate: '2025-04-01' enddate: '2025-05-01' naics: '' naicsarray: [] georegions: '' georegionsarray: [] responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalertcalcs/listdates: post: tags: - Calc endpoints summary: POST /hackalertcalcs/listdates operationId: postHackalertcalcsListdates description: 'Folder: Third Party Alerts. Unpaginated list, sorted by date desc, for the authenticated customer.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string naics: type: string naicsarray: type: array georegions: type: string georegionsarray: type: array example: startdate: '2025-04-01' enddate: '2025-05-01' naics: '' naicsarray: [] georegions: '' georegionsarray: [] responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalertcalcs/page/{pageNum}: post: tags: - Calc endpoints summary: POST /hackalertcalcs/page/:pageNum operationId: postHackalertcalcsPagePagenum description: 'Folder: Third Party Alerts. Paginated list (50 per page) for the authenticated customer.' parameters: - name: pageNum in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: naics: type: string naicsarray: type: array georegions: type: string georegionsarray: type: array example: naics: '' naicsarray: [] georegions: '' georegionsarray: [] responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalertcalcs/{docId}: get: tags: - Calc endpoints summary: GET /hackalertcalcs/:docId operationId: getHackalertcalcsDocid description: 'Folder: Third Party Alerts. Fetch a single hack/breach exposure record by _id .' parameters: - name: docId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts: put: tags: - Third Party Accounts summary: Fix hackalerts for a list of alert _ids operationId: putFixHackalertsForAListOfAlertIds description: 'Folder: Business Hack Alerts.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: alerts: type: array example: alerts: - 5d000177f946be2abe93f08c responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/alertedcount/{number}: get: tags: - Third Party Accounts summary: Read count for a number of previous (timestamp) days of alerts operationId: getReadCountForANumberOfPreviousTimestampDaysOfAlerts description: 'Folder: Business Hack Alerts.' parameters: - name: number in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/alertedpage/{number}: get: tags: - Third Party Accounts summary: Read a page of alerts (sorted by timestamp) operationId: getReadAPageOfAlertsSortedByTimestamp description: 'Folder: Business Hack Alerts. Read the most recent alerts for a user, sorted by published date.' parameters: - name: number in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/count: get: tags: - Third Party Accounts summary: Read count for alerts operationId: getReadCountForAlerts description: 'Folder: Business Hack Alerts.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/count/{number}: get: tags: - Third Party Accounts summary: Read count for a number of previous (published date) days of alerts operationId: getReadCountForANumberOfPreviousPublishedDateDaysOfAlerts description: 'Folder: Business Hack Alerts.' parameters: - name: number in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/distinct/count: get: tags: - Third Party Accounts summary: Read count for distinct watchlist items operationId: getReadCountForDistinctWatchlistItems description: 'Folder: Business Hack Alerts.' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/distinct/page/{pageNum}: get: tags: - Third Party Accounts summary: Read page for distinct watchlist items operationId: getReadPageForDistinctWatchlistItems description: 'Folder: Business Hack Alerts.' parameters: - name: pageNum in: path required: true schema: type: integer responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/hackwatchlist/remove: post: tags: - Third Party Accounts summary: Delete hackalerts for a hackwatchlist id operationId: postDeleteHackalertsForAHackwatchlistId description: 'Folder: Business Hack Alerts.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: domainwatchlist_id: type: string example: domainwatchlist_id: 5ed80acdcfa9103dad9f0dbc responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/hackwatchlist/update: post: tags: - Third Party Accounts summary: Update hackalerts tags for a hackwatchlist id operationId: postUpdateHackalertsTagsForAHackwatchlistId description: 'Folder: Business Hack Alerts.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: domainwatchlist_id: type: string tags: type: array example: domainwatchlist_id: 5d5d5df3d78f3a774c7d5d8b tags: - Tag A - Tag B responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/harvester/all: get: tags: - Third Party Accounts summary: Read ransomware harvesters all operationId: getReadRansomwareHarvestersAll description: 'Folder: Business Hack Alerts.' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/lastdate: get: tags: - Third Party Accounts summary: Read last alert date operationId: getReadLastAlertDate description: 'Folder: Business Hack Alerts.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/page/{pageNum}: post: tags: - Alerts summary: Read third-party alerts page operationId: postReadThirdPartyAlertsPage description: 'Read Third-Party Alerts Page Route: POST /hackalerts/page/:pageNum Returns paginated third-party alerts. Common body filters sort : alphabetically , timestamp , severity tier , tag , harvester , sourcetype remediated : true|false Time filters: days , start_date , end_date , hours_ago Industry/geo filters: topnaicscode , topnaicscodearray , region , regionarray Other switches used by clients: rss , allkeys , csv , credsonly , creds , deleted pageNum is zero-based.' requestBody: required: true content: application/json: schema: type: object properties: sort: type: string tier: type: string tag: type: string remediated: type: boolean hours_ago: type: integer example: sort: timestamp tier: high tag: password remediated: false hours_ago: 24 responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] parameters: - name: pageNum in: path required: true schema: type: integer get: tags: - Third Party Accounts summary: Read a page of alerts (sorted by published date) operationId: getReadAPageOfAlertsSortedByPublishedDate description: 'Folder: Business Hack Alerts. Read the most recent alerts for a user, sorted by published date.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/search: post: tags: - Third Party Accounts summary: Search domain within alerts operationId: postSearchDomainWithinAlerts description: 'Folder: Business Hack Alerts.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: A valid domain. partial: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackalerts/{alertId}: get: tags: - Third Party Accounts summary: Read a document operationId: getReadADocument9 description: 'Folder: Business Hack Alerts.' parameters: - name: alertId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Third Party Accounts summary: Update a document operationId: putUpdateADocument description: 'Folder: Business Hack Alerts.' parameters: - name: alertId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: remediated: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hacknoticeupdates/page/{pageNum}: get: tags: - Third Party Accounts summary: Read a page of documents operationId: getReadAPageOfDocuments5 description: 'Folder: Hack Updates. Read a page of hack updates where the breach_id is associated with the _id of the breaches record.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hacknoticeupdates/search: post: tags: - Third Party Accounts summary: Search all operationId: postSearchAll4 description: 'Folder: Hack Updates. Searches all documents and returns documents in reverse chronological order.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: Hack Notice _id to search for updates to the hack notice. responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hacknoticeupdates/{documentId}: get: tags: - Third Party Accounts summary: Read a document operationId: getReadADocument8 description: 'Folder: Hack Updates. Get a document by the document ID.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackwatchlist/count: get: tags: - Third Party Accounts summary: Get the count of documents operationId: getTheCountOfDocuments4 description: 'Folder: Business Hack Watchlist. Get the count of documents' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] post: tags: - Third Party Accounts summary: Get the count of documents with options operationId: postGetTheCountOfDocumentsWithOptions description: 'Folder: Business Hack Watchlist. Get the count of documents' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: totalspike: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackwatchlist/create: post: tags: - Third Party Accounts summary: Create a doc operationId: postCreateADoc3 description: 'Folder: Business Hack Watchlist. Add a domain to your watchlist.' parameters: - name: X-HackNotice-Integration-Key in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: domain: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackwatchlist/page/{pageNum}: get: tags: - Third Party Accounts summary: Read a page of documents operationId: getReadAPageOfDocuments6 description: 'Folder: Business Hack Watchlist. Read all domains.' parameters: - name: pageNum in: path required: true schema: type: integer - name: X-HackNotice-Integration-Key in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] post: tags: - Third Party Accounts summary: Read a page of documents operationId: postReadAPageOfDocuments2 description: 'Folder: Business Hack Watchlist. Read all domains.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: sort: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackwatchlist/search: post: tags: - Third Party Accounts summary: Search for a domain operationId: postSearchForADomain description: 'Folder: Business Hack Watchlist. Search your watchlist for a domain.' parameters: - name: X-HackNotice-Integration-Key in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /hackwatchlist/{watchlistId}: get: tags: - Third Party Accounts summary: Read a doc operationId: getReadADoc4 description: 'Folder: Business Hack Watchlist. Get a document by the document ID.' parameters: - name: watchlistId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Third Party Accounts summary: Update a doc tags operationId: putUpdateADocTags description: 'Folder: Business Hack Watchlist. Get a document by the document ID.' parameters: - name: watchlistId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: tags: type: array example: tags: - Tag A - Tag B responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - Third Party Accounts summary: Delete a doc operationId: deleteADoc4 description: 'Folder: Business Hack Watchlist. Remove a document by the document ID.' parameters: - name: watchlistId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /itemnotes/count: get: tags: - All Business Accounts summary: Get the count of documents operationId: getTheCountOfDocuments2 description: 'Folder: Item Notes. Get the Count of Documents Purpose: Return the number of assessment data files for the authenticated customer. Request Body (Optional) Field Type Description assessment_id string If provided, returns count only for this assessment Body Example { "assessment_id": "69aadd3f4620e8b72b9ffffc" } Responses Status Description 200 Numeric count (for example 12 ) 401 Unauthorized user' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /itemnotes/create: post: tags: - All Business Accounts summary: Create a doc operationId: postCreateADoc description: 'Folder: Item Notes. Add a domain to your watchlist.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: note: type: string item_id: type: string item_type: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /itemnotes/customer/count: get: tags: - All Business Accounts summary: Get the count of documents operationId: getTheCountOfDocuments description: 'Folder: Item Notes / customer level endpoints. Get the count of documents' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /itemnotes/customer/itemdoc: post: tags: - All Business Accounts summary: Search for a note for an item operationId: postSearchForANoteForAnItem description: 'Folder: Item Notes / customer level endpoints. Search your watchlist for a domain.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: item_id: type: string item_type: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /itemnotes/customer/page/{pageNum}: get: tags: - All Business Accounts summary: Read a page of documents operationId: getReadAPageOfDocuments description: 'Folder: Item Notes / customer level endpoints. Read all domains.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /itemnotes/customer/{customerId}: get: tags: - All Business Accounts summary: Read a doc operationId: getReadADoc description: 'Folder: Item Notes / customer level endpoints. Get a document by the document ID.' parameters: - name: customerId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - All Business Accounts summary: Delete a doc operationId: deleteADoc description: 'Folder: Item Notes / customer level endpoints. Remove a document by the document ID.' parameters: - name: customerId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /itemnotes/itemdoc: post: tags: - All Business Accounts summary: Search for a note for an item operationId: postSearchForANoteForAnItem2 description: 'Folder: Item Notes. Search your watchlist for a domain.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: item_id: type: string item_type: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /itemnotes/page/{pageNum}: get: tags: - All Business Accounts summary: Read a page of documents operationId: getReadAPageOfDocuments2 description: 'Folder: Item Notes. Read a Page of Documents Purpose: Return a paginated list of assessment data files for the authenticated customer. Path Parameters Parameter Description pageNum Zero-based page index. Page size is fixed at 50 . Request Body (Optional) Field Type Description assessment_id string If provided, returns files only for this assessment Body Example { "assessment_id": "69aadd3f4620e8b72b9ffffc" } Responses Status Description 200 Array of file metadata documents (newest first) 401 Unauthorized user' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /itemnotes/{noteId}: get: tags: - All Business Accounts summary: Read a doc operationId: getReadADoc2 description: 'Folder: Item Notes. Get a document by the document ID.' parameters: - name: noteId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - All Business Accounts summary: Update a doc operationId: putUpdateADoc description: 'Folder: Item Notes. Get a document by the document ID.' parameters: - name: noteId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: note: type: string example: note: updated note responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - All Business Accounts summary: Delete a doc operationId: deleteADoc2 description: 'Folder: Item Notes. Remove a document by the document ID.' parameters: - name: noteId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /leakReportsv2/count: get: tags: - All Business Accounts summary: Read a count of documents operationId: getReadACountOfDocuments description: 'Folder: All Leaks.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /leakReportsv2/search: post: tags: - All Business Accounts summary: Search all operationId: postSearchAll description: 'Folder: All Leaks. Searches all documents and returns documents in reverse chronological order.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: Inclusive string search for the value in the domain or title responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /leakReportsv2/{documentId}: get: tags: - All Business Accounts summary: Read a document operationId: getReadADocument description: 'Folder: All Leaks. Get a document by the document ID.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /leakfile/filename: post: tags: - All Business Accounts summary: Get by filename operationId: postGetByFilename description: 'Folder: LeakFiles. Get a leakfile by filename. Research service customer only endpoint.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: String search for the exact value in the domain. responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /leakfile/search: post: tags: - All Business Accounts summary: Search all operationId: postSearchAll2 description: 'Folder: LeakFiles. Searches all documents and returns documents in reverse chronological order.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: String search for the exact value in the domain. responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /leakfile/{documentId}: get: tags: - All Business Accounts summary: Read a document operationId: getReadADocument2 description: 'Folder: LeakFiles. Get a document by the document ID.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /leakfilestats/count: get: tags: - All Business Accounts summary: Read count operationId: getReadCount description: 'Folder: LeakFileStats.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /leakfilestats/find: post: tags: - All Business Accounts summary: Find one operationId: postFindOne description: 'Folder: LeakFileStats. Get a document by the document ID.' requestBody: required: true content: application/json: schema: type: object properties: date: type: string example: date: '2019-04-10' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /leakfilestats/latest: get: tags: - All Business Accounts summary: Read latest operationId: getReadLatest description: 'Folder: LeakFileStats. Get a document by the document ID.' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /leakfilestats/page/{pageNum}: get: tags: - All Business Accounts summary: Read page operationId: getReadPage description: 'Folder: LeakFileStats.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /report/assessment: post: tags: - Third Party Accounts summary: Create assessment PDF report operationId: postCreateAssessmentPdfReport description: 'Folder: Assessments / reports. Create Assessment PDF Report Purpose: Start generation of a customer-scoped assessment PDF report. Auth Authorization: JWT REDACTED_EXAMPLE_TOKEN Request Body Field Type Required Description report_name string Yes Human-friendly report name used in output metadata schema object Yes Report schema payload used to render report content Body Example { "report_name": "Assessment", "schema": { "type": "Report", "options": { "report_title": "HackNotice" }, "components": [] } } Behavior Validates customer authentication and customer type access Creates a download job record with file_type: pdf and available: false Report is generated asynchronously; poll downloads endpoint to fetch status/file Responses Status Description 200 Download job object (queued/in progress) 400 Missing required fields ( schema , report_name ) 401 Unauthorized user 500 Failed to start report generation' requestBody: required: true content: application/json: schema: type: object properties: report_name: type: string schema: type: object example: report_name: Assessment schema: $schema: https://hybiscuscdn.blob.core.windows.net/public/Report.schema.json type: Report options: report_title: HackNotice report_byline: Reports version_number: '' logo_url: https://app.hacknotice.com/assets/media/logos/default-dark.svg config: enable_multi_page: true color_theme: corporate typography_theme: jost enable_pagination: true components: - type: Section options: columns: 1 section_title: Assessment Report components: - type: Table options: title: Assessment Details headings: - Field - Value headings_vertical_padding: 0 rows: - - Name - Q1 2026 Security Assessment - - Company - Acme Corp - - Status - In progress - - Risk Tier - High - - Tags - critical, vendor - - Created - Jan 15 2026 - - Due Date - Apr 15 2026 - - Completed - — - - Description - Quarterly security assessment for Acme Corp - type: Table options: title: Questions & Answers headings: - Question - Answer - Answered Date headings_vertical_padding: 0 rows: - - 1. Do you have a security policy? - 'Yes' - Feb 1 2026 - - 2. Describe your incident response plan. - We follow NIST guidelines. - Feb 3 2026 - - 3. Do you encrypt data at rest? - Yes, AES-256 - Feb 3 2026 - type: Table options: title: Assessment Events headings: - Date - Action - Assessor Notes - Company Notes - Complete headings_vertical_padding: 0 rows: - - Jan 15 2026 - Review started - Initial review of Acme Corp - — - 'No' - - Feb 1 2026 - Document requested - Requested SOC 2 report - Will provide by Feb 10 - 'No' - - Feb 12 2026 - Document received - SOC 2 report received - — - 'Yes' - type: Table options: title: Invites headings: - Email - Status - Sent - Expires headings_vertical_padding: 0 rows: - - security@acmecorp.com - accepted - Jan 16 2026 - Feb 15 2026 - type: Row options: columns: 1 components: - type: Text options: text: Report generated at March 9, 2026, 3:00 PM size: sm responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /report/assessment/excel: post: tags: - Third Party Accounts summary: Create assessment Excel report operationId: postCreateAssessmentExcelReport description: 'Folder: Assessments / reports. Create Assessment Excel Report Purpose: Generate a customer-scoped assessment Excel report and return a download record. Auth Authorization: JWT REDACTED_EXAMPLE_TOKEN Request Body Field Type Required Description report_name string Yes Human-friendly report name schema object Yes Report schema payload Body Example { "report_name": "Assessment", "schema": { "type": "Report", "options": { "report_title": "HackNotice" }, "components": [] } } Behavior Validates customer authentication and customer type access Generates Excel output and stores file path in a download record Returns download object with file_type: excel and available: true Responses Status Description 200 Download object for generated Excel file 400 Missing required fields ( schema , report_name ) 401 Unauthorized user 500 Failed to generate report' requestBody: required: true content: application/json: schema: type: object properties: report_name: type: string schema: type: object example: report_name: Assessment schema: $schema: https://hybiscuscdn.blob.core.windows.net/public/Report.schema.json type: Report options: report_title: HackNotice report_byline: Reports version_number: '' logo_url: https://app.hacknotice.com/assets/media/logos/default-dark.svg config: enable_multi_page: true color_theme: corporate typography_theme: jost enable_pagination: true components: - type: Section options: columns: 1 section_title: Assessment Report components: - type: Table options: title: Assessment Details headings: - Field - Value headings_vertical_padding: 0 rows: - - Name - Q1 2026 Security Assessment - - Company - Acme Corp - - Status - In progress - - Risk Tier - High - - Tags - critical, vendor - - Created - Jan 15 2026 - - Due Date - Apr 15 2026 - - Completed - — - - Description - Quarterly security assessment for Acme Corp - type: Table options: title: Questions & Answers headings: - Question - Answer - Answered Date headings_vertical_padding: 0 rows: - - 1. Do you have a security policy? - 'Yes' - Feb 1 2026 - - 2. Describe your incident response plan. - We follow NIST guidelines. - Feb 3 2026 - - 3. Do you encrypt data at rest? - Yes, AES-256 - Feb 3 2026 - type: Table options: title: Assessment Events headings: - Date - Action - Assessor Notes - Company Notes - Complete headings_vertical_padding: 0 rows: - - Jan 15 2026 - Review started - Initial review of Acme Corp - — - 'No' - - Feb 1 2026 - Document requested - Requested SOC 2 report - Will provide by Feb 10 - 'No' - - Feb 12 2026 - Document received - SOC 2 report received - — - 'Yes' - type: Table options: title: Invites headings: - Email - Status - Sent - Expires headings_vertical_padding: 0 rows: - - security@acmecorp.com - accepted - Jan 16 2026 - Feb 15 2026 - type: Row options: columns: 1 components: - type: Text options: text: Report generated at March 9, 2026, 3:00 PM size: sm responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /report/assessment/invited: post: tags: - Third Party Accounts summary: Create invited assessment PDF report operationId: postCreateInvitedAssessmentPdfReport description: 'Folder: Assessments / reports (invited). Create Invited Assessment PDF Report Purpose: Generate a PDF report for an assessment as an invited user. Auth Authorization: JWT REDACTED_EXAMPLE_TOKEN Request Body Field Type Required Description assessment_id string Yes Assessment being reported (must be shared with user) report_name string Yes Human-friendly report name schema object Yes Report schema payload Body Example { "assessment_id": "69a73dc2c0deb2b4840f44fc", "report_name": "Assessment", "schema": { "type": "Report", "options": { "report_title": "HackNotice" }, "components": [] } } Behavior Verifies invited-user share access for assessment_id Builds report, polls task status, and returns PDF binary stream when ready Response is direct file download (not a download job record) Responses Status Description 200 PDF binary stream ( Content-Type: application/pdf ) 400 Missing required fields ( schema , report_name , assessment_id ) 401 Unauthorized user or no valid share access 500 Report generation/retrieval failed 504 Report generation timed out' requestBody: required: true content: application/json: schema: type: object properties: assessment_id: type: string report_name: type: string schema: type: object example: assessment_id: 69a73dc2c0deb2b4840f44fc report_name: Assessment schema: $schema: https://hybiscuscdn.blob.core.windows.net/public/Report.schema.json type: Report options: report_title: HackNotice report_byline: Reports version_number: '' logo_url: https://app.hacknotice.com/assets/media/logos/default-dark.svg config: enable_multi_page: true color_theme: corporate typography_theme: jost enable_pagination: true components: - type: Section options: columns: 1 section_title: Assessment Report — Complete components: - type: Table options: title: Completion Summary headings: - Field - Value headings_vertical_padding: 0 rows: - - Assessment - Test Assessment - - Status - Complete - - Completed Date - Mar 9 2026 - - Due Date - Apr 8 2026 - type: Table options: title: Questions & Answers headings: - Question - Answer - Answered Date headings_vertical_padding: 0 rows: - - 1. Do you have a security policy? - 'Yes' - Mar 5 2026 - - 2. Describe your incident response plan. - We follow NIST guidelines. - Mar 6 2026 - type: Row options: columns: 1 components: - type: Text options: text: Report generated at March 9, 2026, 2:30 PM size: sm responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /report/assessment/invited/excel: post: tags: - Third Party Accounts summary: Create invited assessment Excel report operationId: postCreateInvitedAssessmentExcelReport description: 'Folder: Assessments / reports (invited). Create Invited Assessment Excel Report Purpose: Generate an Excel report for an assessment as an invited user. Auth Authorization: JWT REDACTED_EXAMPLE_TOKEN Request Body Field Type Required Description assessment_id string Yes Assessment being reported (must be shared with user) report_name string Yes Human-friendly report name schema object Yes Report schema payload Body Example { "assessment_id": "69a73dc2c0deb2b4840f44fc", "report_name": "Assessment", "schema": { "type": "Report", "options": { "report_title": "HackNotice" }, "components": [] } } Behavior Verifies invited-user share access for assessment_id Generates workbook and returns direct binary stream Responses Status Description 200 Excel binary stream ( Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet ) 400 Missing required fields ( schema , report_name , assessment_id ) 401 Unauthorized user or no valid share access 500 Excel generation failed' requestBody: required: true content: application/json: schema: type: object properties: assessment_id: type: string report_name: type: string schema: type: object example: assessment_id: 69a73dc2c0deb2b4840f44fc report_name: Assessment schema: $schema: https://hybiscuscdn.blob.core.windows.net/public/Report.schema.json type: Report options: report_title: HackNotice report_byline: Reports version_number: '' logo_url: https://app.hacknotice.com/assets/media/logos/default-dark.svg config: enable_multi_page: true color_theme: corporate typography_theme: jost enable_pagination: true components: - type: Section options: columns: 1 section_title: Assessment Report — Complete components: - type: Table options: title: Completion Summary headings: - Field - Value headings_vertical_padding: 0 rows: - - Assessment - Test Assessment - - Status - Complete - - Completed Date - Mar 9 2026 - - Due Date - Apr 8 2026 - type: Table options: title: Questions & Answers headings: - Question - Answer - Answered Date headings_vertical_padding: 0 rows: - - 1. Do you have a security policy? - 'Yes' - Mar 5 2026 - - 2. Describe your incident response plan. - We follow NIST guidelines. - Mar 6 2026 - type: Row options: columns: 1 components: - type: Text options: text: Report generated at March 9, 2026, 2:30 PM size: sm responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /research/count/filename/term: post: tags: - Research Service Accounts summary: Count search filename term operationId: postCountSearchFilenameTerm parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: Any search word or phrase searchtype: type: string description: 'Search type: match_phrase, wildcard_pre, wildcard_post, wildcard_both. If no or incorrect type is given, defaults to match_phrase.' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /research/count/pool: post: tags: - Research Service Accounts summary: Count word pool operationId: postCountWordPool parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: searchtype: type: string pool: type: array match: type: string example: searchtype: word_pool pool: - '1600' - pennsylvania - washington match: '3' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /research/count/term: post: tags: - Research Service Accounts summary: Count search term operationId: postCountSearchTerm parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: Any search word or phrase searchtype: type: string description: 'Search type: match_phrase, wildcard_pre, wildcard_post, wildcard_both. If no or incorrect type is given, defaults to match_phrase.' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /research/search/filename/term/page/{pageNum}: post: tags: - Research Service Accounts summary: Search filename term and page operationId: postSearchFilenameTermAndPage parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: Any search word or phrase searchtype: type: string description: 'Search type: match_phrase, wildcard_post. If incorrect type is given, defaults to match_phrase.' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /research/search/pool/page/{pageNum}: post: tags: - Research Service Accounts summary: Search word pool and page operationId: postSearchWordPoolAndPage parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: searchtype: type: string pool: type: array match: type: string startdate: type: string enddate: type: string fullrecords: type: boolean example: searchtype: word_pool pool: - first - second match: '2' startdate: '2015-04-03' enddate: '2022-07-30' fullrecords: true responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /research/search/term/page/{pageNum}: post: tags: - Research Service Accounts summary: Search term and page operationId: postSearchTermAndPage parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string description: Any search word or phrase searchtype: type: string description: 'Search type: match_phrase, wildcard_pre, wildcard_post, wildcard_both. If incorrect type is given, defaults to match_phrase.' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /research8/search/filename/term/page/{pageNum}: post: tags: - Alerts summary: Search research phrase+filename alerts page operationId: postSearchResearchPhraseFilenameAlertsPage description: 'Search Research Phrase + Filename Alerts Page Route: POST /research8/search/filename/term/page/:pageNum Uses the same options as phrase search, with filename matching enabled. Required fields term searchtype Filename-specific fields filename filesearchtype (for example wildcard_post ) Additional optional fields order , startdate , enddate , hours_ago , searchafter , allkeys , fullrecords , creds , credsonly , csv , word , blob , redacted , domainfilter , monthly .' requestBody: required: true content: application/json: schema: type: object properties: term: type: string searchtype: type: string filename: type: string filesearchtype: type: string order: type: string hours_ago: type: integer allkeys: type: boolean fullrecords: type: boolean example: term: acme.com searchtype: match_phrase filename: dump filesearchtype: wildcard_post order: desc hours_ago: 24 allkeys: false fullrecords: false responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] parameters: - name: pageNum in: path required: true schema: type: integer /research8/search/pool/page/{pageNum}: post: tags: - Alerts summary: Search research word pool alerts page operationId: postSearchResearchWordPoolAlertsPage description: 'Search Research Word Pool Alerts Page Route: POST /research8/search/pool/page/:pageNum Required fields pool (array of terms) match (minimum match threshold; must be > 0) Optional fields searchtype order Date filters: startdate , enddate , hours_ago Paging cursor: searchafter Output toggles: allkeys , fullrecords , csv , word , blob , redacted Credential toggles: creds , credsonly Other: domainfilter , monthly pageNum is zero-based.' requestBody: required: true content: application/json: schema: type: object properties: pool: type: array match: type: integer searchtype: type: string order: type: string hours_ago: type: integer searchafter: type: integer allkeys: type: boolean fullrecords: type: boolean creds: type: boolean credsonly: type: boolean csv: type: boolean word: type: boolean blob: type: boolean redacted: type: boolean domainfilter: type: boolean example: pool: - acme.com - example.com match: 1 searchtype: match_phrase order: desc hours_ago: 24 searchafter: -1 allkeys: false fullrecords: false creds: false credsonly: false csv: false word: false blob: false redacted: false domainfilter: false responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] parameters: - name: pageNum in: path required: true schema: type: integer /research8/search/term/page/{pageNum}: post: tags: - Alerts summary: Search research phrase alerts page operationId: postSearchResearchPhraseAlertsPage description: 'Search Research Phrase Alerts Page Route: POST /research8/search/term/page/:pageNum Required fields term (string) searchtype (string) Optional filters/options order : asc|desc Date filters: startdate , enddate , hours_ago Paging cursor: searchafter Output toggles: allkeys , fullrecords , csv , word , blob , redacted Credential toggles: creds , credsonly Other: domainfilter , monthly pageNum is zero-based (server enforces an upper page cap in this endpoint family).' requestBody: required: true content: application/json: schema: type: object properties: term: type: string searchtype: type: string order: type: string hours_ago: type: integer allkeys: type: boolean fullrecords: type: boolean creds: type: boolean credsonly: type: boolean csv: type: boolean word: type: boolean blob: type: boolean redacted: type: boolean domainfilter: type: boolean example: term: acme.com searchtype: match_phrase order: desc hours_ago: 24 allkeys: false fullrecords: false creds: false credsonly: false csv: false word: false blob: false redacted: false domainfilter: false responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] parameters: - name: pageNum in: path required: true schema: type: integer /researchsavedsearch/count: get: tags: - Research Service Accounts summary: Get the count of documents operationId: getTheCountOfDocuments3 description: 'Folder: Research Saved Search. Read a count of all documents.' parameters: - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /researchsavedsearch/create: post: tags: - Research Service Accounts summary: Create a doc operationId: postCreateADoc2 description: 'Folder: Research Saved Search. Add a document to your documents.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: search: type: string endpoint: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /researchsavedsearch/page/{pageNum}: get: tags: - Research Service Accounts summary: Read a page of documents operationId: getReadAPageOfDocuments3 description: 'Folder: Research Saved Search. Read all documents.' parameters: - name: pageNum in: path required: true schema: type: integer - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /researchsavedsearch/runsearch/{documentId}: get: tags: - Research Service Accounts summary: Run search a doc operationId: getRunSearchADoc description: 'Folder: Research Saved Search. Run a document by the document ID.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /researchsavedsearch/search: post: tags: - Research Service Accounts summary: Search for a search name operationId: postSearchForASearchName description: 'Folder: Research Saved Search. Search your documents for a search name.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: term: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /researchsavedsearch/{documentId}: get: tags: - Research Service Accounts summary: Read a doc operationId: getReadADoc3 description: 'Folder: Research Saved Search. Get a document by the document ID.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] put: tags: - Research Service Accounts summary: Update a doc operationId: putUpdateADoc2 description: 'Folder: Research Saved Search. Update a document by the document ID.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: name: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] delete: tags: - Research Service Accounts summary: Delete a doc operationId: deleteADoc3 description: 'Folder: Research Saved Search. Remove a document by the document ID.' parameters: - name: documentId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /saved-searches/{productKey}: get: tags: - Alerts summary: List saved searches by product-key operationId: getListSavedSearchesByProductKey description: 'List Saved Searches by Product Key Purpose: Return saved searches for the authenticated customer and selected product line. Path Parameters Parameter Required Description product-key Yes Product domain for saved searches Allowed product-key Values Value firstparty enduser thirdparty research Query Parameters Parameter Required Applies To Allowed Values endpoint Yes product-key=research phrase , wordpool Responses Status Description 200 Saved search records 401 Unauthorized user 500 Internal server error' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] parameters: - name: productKey in: path required: true schema: type: string /threatactorcalcs/aggregatedates: post: tags: - Calc endpoints summary: POST /threatactorcalcs/aggregatedates operationId: postThreatactorcalcsAggregatedates description: 'Folder: Threat Actors. Mongo $group aggregation over the matching docs. Body fields : same as /count , plus: harvesterarray (array, optional) — harvester $in filter. csv / exportcsv (boolean, optional) — if truthy, response is a CSV download. Response : aggregated totals (per-NAICS, per-geo-region, etc.) similar to breachcalcs /aggregatedates .' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string naics: type: string naicsarray: type: array georegions: type: string georegionsarray: type: array harvester: type: string harvesterarray: type: array csv: type: boolean example: startdate: '2025-04-01' enddate: '2025-05-01' naics: '' naicsarray: [] georegions: '' georegionsarray: [] harvester: '' harvesterarray: [] csv: false responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /threatactorcalcs/aggregatedistinct: post: tags: - Calc endpoints summary: POST /threatactorcalcs/aggregatedistinct operationId: postThreatactorcalcsAggregatedistinct description: 'Folder: Threat Actors. For each distinct harvester in the window, returns the date-range aggregate. Internally calls list_distinct then iterates per harvester. Body fields : date range filters. Response : array of per-harvester aggregate objects.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string example: startdate: '2025-04-01' enddate: '2025-05-01' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /threatactorcalcs/count: post: tags: - Calc endpoints summary: POST /threatactorcalcs/count operationId: postThreatactorcalcsCount description: 'Folder: Threat Actors. Count of threat-actor activity records matching the filter. Body fields : same date/naics/georegion filters as breachcalcs, plus: harvester (string, optional) — filter to a single harvester name. Response : integer count.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string naics: type: string naicsarray: type: array georegions: type: string georegionsarray: type: array harvester: type: string example: startdate: '2025-04-01' enddate: '2025-05-01' naics: '' naicsarray: [] georegions: '' georegionsarray: [] harvester: '' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /threatactorcalcs/distinct: post: tags: - Calc endpoints summary: POST /threatactorcalcs/distinct operationId: postThreatactorcalcsDistinct description: 'Folder: Threat Actors. Returns the distinct list of harvesters seen over the filter window. Body fields : date range filters. Response : array of harvester identifiers (strings).' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string example: startdate: '2025-04-01' enddate: '2025-05-01' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /threatactorcalcs/listdates: post: tags: - Calc endpoints summary: POST /threatactorcalcs/listdates operationId: postThreatactorcalcsListdates description: 'Folder: Threat Actors. Unpaginated list of threat-actor activity records matching the filter, sorted by date desc. Body fields : same as /count . Response : array of threat-actor activity records.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: startdate: type: string enddate: type: string naics: type: string naicsarray: type: array georegions: type: string georegionsarray: type: array harvester: type: string example: startdate: '2025-04-01' enddate: '2025-05-01' naics: '' naicsarray: [] georegions: '' georegionsarray: [] harvester: '' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /threatactorcalcs/page/{pageNum}: post: tags: - Calc endpoints summary: POST /threatactorcalcs/page/:pageNum operationId: postThreatactorcalcsPagePagenum description: 'Folder: Threat Actors. Paginated list (50 per page, sorted by date desc). Path params pageNum (integer) Body fields : same as /count minus date range. harvester optional. Response : array of threat-actor activity records.' parameters: - name: pageNum in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/json: schema: type: object properties: naics: type: string naicsarray: type: array georegions: type: string georegionsarray: type: array harvester: type: string example: naics: '' naicsarray: [] georegions: '' georegionsarray: [] harvester: '' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /threatactorcalcs/{docId}: get: tags: - Calc endpoints summary: GET /threatactorcalcs/:docId operationId: getThreatactorcalcsDocid description: 'Folder: Threat Actors. Fetch a single threat-actor activity record by _id .' parameters: - name: docId in: path required: true schema: type: string - name: apikey in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /userstats/active/count: get: tags: - Deprecated summary: Read active docs count operationId: getReadActiveDocsCount description: 'Folder: Teams Accounts / Active Userstats. Get a count of active userstats. Can also be a post and include the enterprisedepartment_id' responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] deprecated: true /userstats/active/{number}: get: tags: - Deprecated summary: Read active docs page operationId: getReadActiveDocsPage description: 'Folder: Teams Accounts / Active Userstats. Get a page of active userstats. Can also be a post and include the enterprisedepartment_id' parameters: - name: number in: path required: true schema: type: integer responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] deprecated: true /utils/sha512: post: tags: - All Business Accounts summary: Create a SHA512 hash operationId: postCreateASha512Hash description: 'Folder: Utils. Add a domain to your watchlist.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: email: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] /utils/sha512half: post: tags: - All Business Accounts summary: Create a SHA512 half hash operationId: postCreateASha512HalfHash description: 'Folder: Utils. Add a domain to your watchlist.' parameters: - name: apikey in: header required: false schema: type: string requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: email: type: string responses: '200': description: Successful response content: application/json: schema: type: object '401': description: Unauthorized — missing or invalid JWT / API key content: application/json: schema: $ref: '#/components/schemas/Error' security: - jwtAuth: [] - apiKeyAuth: [] components: securitySchemes: jwtAuth: type: apiKey in: header name: Authorization description: 'Session token from POST /auth/sign_in, sent as the literal prefix "JWT " followed by the token — e.g. Authorization: JWT . Note this is HackNotice''s own scheme, not RFC 6750 Bearer.' apiKeyAuth: type: apiKey in: header name: apikey description: Per-account API key issued by HackNotice, sent in the lower-case "apikey" header alongside the JWT on most operations. integrationKeyAuth: type: apiKey in: header name: X-HackNotice-Integration-Key description: Per-user HackNotice integration secret (hn_ik_ prefix). Single-header alternative to apikey + email + password; also the credential used by the HackNotice MCP server. schemas: Error: type: object description: HackNotice error envelope observed on the live API hosts. properties: message: type: string description: Human-readable error message, e.g. "Unauthorized user!" or "Not found".