openapi: 3.2.0 info: title: NordStellar Enterprise Data Domain Intelligence API description: '## Overview The NordStellar Enterprise Data API provides comprehensive access to our data breach intelligence platform, enabling organizations to integrate real-time security monitoring and alerting capabilities directly into their existing infrastructure. This API allows you to proactively protect your users by detecting when their sensitive information has been compromised in data breaches across the internet. **Key Features**: - **Real-time Breach Monitoring**: Receive immediate notifications when user data appears in newly discovered data breaches. - **Zero-Knowledge Architecture**: Search for compromised sensitive data (credit cards, national identification numbers) using secure hash-based methods that never transmit the actual sensitive information. - **Comprehensive Data Sources**: Access intelligence from multiple sources including corporate data breaches, malware infection logs, and stolen credential lists. - **Flexible Integration Options**: Support for webhook notifications, bulk operations, and subscription management to fit your organization''s unique requirements. - **Enterprise-Grade Security**: Secure authentication methods, rate limiting, and quota management to ensure responsible and controlled API usage.' version: '3.1' servers: - url: /api/v3/data security: - ApiKeyAuth: [] - BasicAuth: [] tags: - name: Domain Intelligence description: 'Endpoints for investigating domain exposure in data breaches, including detailed breach information and compromise analysis. These operations support protection against domain hijacking, phishing attacks, and other threats targeting domain owners.' paths: /email/domain/{domain}: get: tags: - Domain Intelligence summary: Domain search description: "Used for looking up all email addresses and their data for a specific domain.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.\nIf a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned\nand the rest of its malware data truncated. Truncated data contains malware IDs that can be used\nto retrieve data using **data-source** endpoints*\n\nDefault is the maximum limit of **100** records \n(If the response returns exactly 100 records, it indicates the potential presence of more records. Initiate a subsequent request to retrieve any additional results)\n\n**Rate limit: 20 per second.**" operationId: domain parameters: - $ref: '#/components/parameters/Domain' - $ref: '#/components/parameters/Limit' - $ref: '#/components/parameters/Offset' - name: last-id in: query description: A faster pagination alternative to offset. Set this instead of offset to get response for further pages quicker. required: false schema: type: string - $ref: '#/paths/~1email/post/parameters/0' responses: '200': description: Returns found data headers: X-RateLimit-Limit: $ref: '#/components/headers/X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/X-RateLimit-Reset' X-Quota-Limit: $ref: '#/components/headers/X-Quota-Limit' X-Quota-Remaining: $ref: '#/components/headers/X-Quota-Remaining' X-Quota-Reset: $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset' content: application/json: schema: $ref: '#/components/schemas/EmailsSample' '206': description: Returns partial found data, with **errors** field on truncated records headers: X-RateLimit-Limit: $ref: '#/components/headers/X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/X-RateLimit-Reset' X-Quota-Limit: $ref: '#/components/headers/X-Quota-Limit' X-Quota-Remaining: $ref: '#/components/headers/X-Quota-Remaining' X-Quota-Reset: $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset' content: application/json: schema: $ref: '#/paths/~1email/post/responses/206/content/application~1json/schema' '400': description: Bad request content: application/json: schema: $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema' '401': description: Unauthorized content: application/json: schema: $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema' security: - ApiKeyAuth: [] /email/domain/{domain}/lite: get: tags: - Domain Intelligence summary: Lite Domain search description: "Used for looking up all email addresses and their data for a specific domain.\n\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.\nIf a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned\nand the rest of its malware data truncated. Truncated data contains malware IDs that can be used\nto retrieve data using **data-source** endpoints*\n\nDefault is the maximum limit of **100** records \n(If the response returns exactly 100 records, it indicates the potential presence of more records. Initiate a subsequent request to retrieve any additional results)\n\n**Lite version of /email/domain endpoint, which only includes credentials from malware logs.**\n\n**Rate limit: 100 per second.**" operationId: domainLite parameters: - $ref: '#/components/parameters/Domain' - $ref: '#/components/parameters/Limit' - $ref: '#/components/parameters/Offset' - $ref: '#/paths/~1email~1domain~1%7Bdomain%7D/get/parameters/3' responses: '200': description: Returns found data headers: X-RateLimit-Limit: $ref: '#/components/headers/X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/X-RateLimit-Reset' X-Quota-Limit: $ref: '#/components/headers/X-Quota-Limit' X-Quota-Remaining: $ref: '#/components/headers/X-Quota-Remaining' X-Quota-Reset: $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset' content: application/json: schema: $ref: '#/components/schemas/EmailsLiteSample' '206': description: Returns partial found data, with **errors** field on truncated records headers: X-RateLimit-Limit: $ref: '#/components/headers/X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/X-RateLimit-Reset' X-Quota-Limit: $ref: '#/components/headers/X-Quota-Limit' X-Quota-Remaining: $ref: '#/components/headers/X-Quota-Remaining' X-Quota-Reset: $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset' content: application/json: schema: type: object properties: data: type: array items: $ref: '#/components/schemas/EmailLiteSample' limit: type: integer example: 10 offset: type: integer example: 0 errors: type: object properties: body: type: string description: Contains errors signifying partial data '400': description: Bad request content: application/json: schema: $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema' '401': description: Unauthorized content: application/json: schema: $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema' security: - ApiKeyAuth: [] /email/domain/statistics/{domain}: get: tags: - Domain Intelligence summary: Email domain statistics description: 'This API endpoint is designed for retrieving statistics associated with all email addresses under a specific domain. The information regarding these email addresses, including their associated data, is sourced and aggregated from a multitude of databases that are publicly accessible on the internet. Each email can be affected by **three** incident types - data breaches, malware infections, and stolen credential lists. **Rate limit: 10 per second.**' operationId: emailDomainStatistics parameters: - $ref: '#/components/parameters/Domain' responses: '200': description: Returns found data headers: X-RateLimit-Limit: $ref: '#/components/headers/X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/X-RateLimit-Reset' X-Quota-Limit: $ref: '#/components/headers/X-Quota-Limit' X-Quota-Remaining: $ref: '#/components/headers/X-Quota-Remaining' X-Quota-Reset: $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset' content: application/json: schema: $ref: '#/components/schemas/EmailStatistics' '400': description: Bad request content: application/json: schema: $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema' '401': description: Unauthorized content: application/json: schema: $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema' security: - ApiKeyAuth: [] /email/domain/blacklist: get: tags: - Domain Intelligence summary: Email domain blacklist description: "This API endpoint is designed to retrieve a list of public email \ndomains that are blacklisted and cannot be used for domain lookup or subscription operations.\n\n**Rate limit: 20 per second.**" operationId: emailDomainBlacklist parameters: - $ref: '#/components/parameters/Limit' - $ref: '#/components/parameters/Offset' responses: '200': description: Returns found data headers: X-RateLimit-Limit: $ref: '#/components/headers/X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/X-RateLimit-Reset' X-Quota-Limit: $ref: '#/components/headers/X-Quota-Limit' X-Quota-Remaining: $ref: '#/components/headers/X-Quota-Remaining' X-Quota-Reset: $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset' content: application/json: schema: type: object properties: data: type: array items: type: string example: - example.com - gmail.com '400': description: Bad request content: application/json: schema: $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema' '401': description: Unauthorized content: application/json: schema: $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema' security: - ApiKeyAuth: [] /data-source/database/domain/{domain}: get: tags: - Domain Intelligence summary: Database Lookup by Domain description: "Used to look up breached databases, that are publicly accessible on the internet, and their metadata.\nThese databases may have been collected from both clearnet and deep/dark web.\nThe breach date of these databases is by no means exact, since, if no official statement by the breached company is made, it is taken from the data publication source, be it a hacker forum, a ransomware group website or some place else.\nDatabase description can not exceed 1000 characters. \n\n**Rate limit: 200 per second.**" operationId: databaseByDomain parameters: - $ref: '#/components/parameters/Domain' - $ref: '#/paths/~1data-source~1database/post/parameters/0' - $ref: '#/paths/~1data-source~1database/post/parameters/1' responses: '200': description: Returns found data headers: X-RateLimit-Limit: $ref: '#/components/headers/X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/X-RateLimit-Reset' X-Quota-Limit: $ref: '#/components/headers/X-Quota-Limit' X-Quota-Remaining: $ref: '#/components/headers/X-Quota-Remaining' X-Quota-Reset: $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset' content: application/json: schema: $ref: '#/components/schemas/DatabaseSample' '400': description: Bad request content: application/json: schema: $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema' '401': description: Unauthorized content: application/json: schema: $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema' '404': description: No data found content: {} security: - ApiKeyAuth: [] components: headers: X-Quota-Remaining: schema: type: integer description: The number of requests left for the period X-Quota-Limit: schema: type: integer description: Quota limit per minute X-RateLimit-Reset: schema: type: string format: date-time description: Date and time when rate limit counter resets X-RateLimit-Remaining: schema: type: integer description: The number of requests left for the time window X-RateLimit-Limit: schema: type: integer description: Request limit per minute parameters: Offset: name: offset in: query description: Offset the results by an integer schema: type: integer Limit: name: limit in: query description: Limit the count of records in results required: false schema: type: integer Domain: name: domain in: path required: true schema: type: string schemas: EmailsLiteSample: type: object properties: data: type: array items: $ref: '#/components/schemas/EmailLiteSample' limit: type: integer example: 10 offset: type: integer example: 0 DatabaseDataItem: type: object properties: identifier: type: string description: Identifier in the following format {domain}_{top level domain} example: example_com id: type: string description: Systemic hex ID of the record example: 66c4d3912b183418f7743576 published_date: type: string description: Date when the database data was published onto the asset example: '2025-01-20T19:04:39Z' data: type: array items: type: object properties: key: type: string description: Key of the data point, complete list can be found [HERE](https://docs.nordstellar.com/enterprise-apis/product-integrations/data-categories#data-points) example: password value: type: array items: type: string description: Value of the data point example: - password1 - password2 risk_assessment: $ref: '#/components/schemas/EmailSample/properties/risk_assessment' MalwareLogSystemInfoSampleItem: type: object properties: ip: type: string example: 192.168.1.1 username: type: string example: diego.lebon country: type: string example: US zip: type: string example: '10001' location: type: string example: New York, USA hardware_id: type: string example: 89f3221e-2138-48c9-bbe2-8f68-806e6f6e6963 language: type: string example: es-ES timezone: type: string example: UTC1 os: type: string example: Windows 10 Pro [x64] system_name: type: string example: DESKTOP-42R6V1I guid: type: string example: 91788e64-8fdf-11eb-8f68-806e6f6e6963 machine_id: type: string example: 89f3221e-2138-48c9-bbe2-ab615454c7ef date: type: string example: '2021-05-26T08:19:13Z' execution_path: type: string example: C:\Program Files\Example\example.exe antivirus_software: type: array items: type: string example: Norton Antivirus work_dir: type: string example: C:\Users\appdata oem_id: type: string example: 00000000-0000-0000-0000-0000 screen_size: type: string example: 1920x1080 uac: type: string example: AllowAll process_elevation: type: boolean example: true keyboard_layouts: type: array items: type: string example: English (United States) hardwares: type: array items: type: string example: Intel(R) Core(TM) i7-9700 CPU @ 3.00GHz MalwareDataItem: type: object properties: identifier: type: string description: Malware identifier composed by malicious code example: US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566] id: type: string description: Systemic hex ID of the record example: 678e9e47098d6b3b44f75ec8 type: type: string description: Name or brand of the infostealer (may be empty or unknown) example: risepro published_date: type: string description: Date that malware log has been published example: '2025-01-20T19:04:39Z' data: type: object properties: credentials: type: array items: type: object properties: url: type: string example: https://login.example.com/path/to/login cleaned_url: type: string example: login.example.com username: type: string example: username email: type: string example: example@example.com password: type: string example: password1 application: type: string example: Google Chrome cookies: type: array items: type: object properties: name: type: string example: SEARCH_SAMESITE value: type: string example: CgQItZIB path: type: string example: / domain: type: string example: google.com expires: type: string example: '2021-10-21T12:22:38Z' autofills: type: array items: type: object properties: name: type: string example: '0000000000000000011' value: type: string example: example@example.com browser: type: string example: Google Chrome grabbed_files: type: array items: type: string example: /work/important.docx credit_cards: type: array items: type: object properties: name: type: string example: John Doe card_number: type: string example: '4111111111111111' cvv: type: string example: '123' expiration_date: type: string example: 12/25 system_info: $ref: '#/components/schemas/MalwareLogSystemInfoSampleItem' metadata: type: object properties: incident_date: type: string example: '2021-05-26T08:19:13Z' emails: type: array items: type: string example: example@example.com phones: type: array items: type: string example: '15551234567' ips: type: array items: type: string example: 203.0.113.42 hardware_id: type: string example: 89f3221e-2138-48c9-bbe2-8f68-806e6f6e6963 machine_id: type: string example: 89f3221e-2138-48c9-bbe2-ab615454c7ef country: type: string example: US secret: type: array items: type: object properties: type: type: string example: aws-access-token values: type: array items: type: string example: AKIAIOSFODNN7EXAMPLE ftp: type: array items: type: object properties: host: type: string example: ftp.example.com port: type: integer example: 21 username: type: string example: username password: type: string example: password1 applications: type: array items: type: string example: FileZilla cert: type: object properties: data: type: string example: abcd123123123123123123123 activation_time: type: integer example: 1652227200 expiration_time: type: integer example: 1660089599 host: type: string example: ftp.example.com port: type: integer example: 21 trust_sans: type: integer example: 1 installed_software: type: array items: type: object properties: name: type: string example: FileZilla Server version: type: string example: 0.9.60 process_list: type: array items: type: object properties: pid: type: integer example: 11708 name: type: string example: uTorrent.exe session_name: type: string example: Console cmd: type: string example: C:\Users\steam\AppData\Roaming\utorrent\uTorrent.exe /MINIMIZED rdp: type: array items: type: object properties: server: type: string example: Yandex.Browser username: type: string example: username password: type: string example: password1 rac: type: array items: type: object properties: private_key: type: string example: '-----BEGIN PRIVATE KEY----..***..-----END PRIVATE' certificate: type: string example: '-----BEGIN CERTIFICATE----..***..-----END CERTIFICATE' ssh: type: object properties: known_hosts: type: array items: type: object properties: host: type: string example: github.com key_type: type: string example: ssh-ed25519 key_value: type: string example: AAAAC1NzaC2lZDI2NTE5AAAAIOMqqnkVzrm0SdG1UOoqKLsabgH5C9okWi1dh1l1GKJl keys: type: array items: type: object properties: name: type: string example: id_ed25519.pub type: type: string example: public value: type: string example: AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl vpn: type: array items: type: object properties: vpn_name: type: string example: NordVPN credentials: type: array items: type: object properties: username: type: string example: username password: type: string example: password1 user_config: type: array items: type: string example: 'IsThreatProtectionTurnOffByConnection: False' openvpn: type: array items: type: object properties: name: type: string example: filename.ovpn options: type: array items: type: string example: cipher AES-256-CBC openvpn_certificates: type: array items: type: object properties: name: type: string example: tls-crypt-v2 data: type: string example: '-----BEGIN CERTIFICATE----..***..-----END CERTIFICATE' email_clients: type: array items: type: object properties: name: type: string example: Mozilla Thunderbird credentials: type: array items: type: object properties: server: type: string example: imap.example.com username: type: string example: username password: type: string example: password1 downloads: type: array items: type: object properties: url: type: string example: https://example.com/download file_path: type: string example: /work/important.docx browser: type: string example: Google Chrome identification_level: type: string description: Indicates how well the system information was identified during parsing. Empty string when value was not set enum: - '' - identified - partially_identified - unidentified example: identified risk_assessment: $ref: '#/components/schemas/EmailSample/properties/risk_assessment' CredentialDataItem: type: object properties: id: type: string description: Systemic hex ID of the record example: 66c4d3912b183418f7743576 passwords: type: array items: type: string example: - password1 - password2 published_date: type: string description: Date when the credential list data was published onto the asset example: '2025-01-20T19:04:39Z' combos: type: array items: type: object properties: domain: type: string example: example.com password: type: string example: password1 url: type: string example: https://example.com/login risk_assessment: $ref: '#/components/schemas/EmailSample/properties/risk_assessment' EmailsSample: type: object properties: data: type: array items: $ref: '#/components/schemas/EmailSample' limit: type: integer example: 10 offset: type: integer example: 0 EmailStatistics: type: object properties: unique_email_count: type: integer description: Number of unique email addresses that were affected by any incident (This number is always **1** for single email statistics) example: 1 unique_password_count: type: integer description: Number of unique passwords example: 3 password_count: type: integer description: Total number of passwords example: 5 breached_email_count: type: integer description: Total number of email appearances in data breaches example: 4 malware_affected_email_count: type: integer description: Total number of email appearances in malware infections example: 1 stolen_email_count: type: integer description: Total number of email appearances in stolen credential lists example: 2 database_count: type: integer description: Number of unique data breaches that this email appears in example: 3 malware_infection_count: type: integer description: Number of unique malware infections that this email appears in example: 1 credential_list_count: type: integer description: Number of unique stolen credential lists that this email appears in example: 2 EmailLiteSample: type: object properties: id: type: string example: 2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3 email: type: string example: example@example.com databases: type: array items: $ref: '#/components/schemas/DatabaseDataItem' malware_logs: type: array items: $ref: '#/components/schemas/MalwareDataItemLite' credential_lists: type: array items: $ref: '#/components/schemas/CredentialDataItem' EmailSample: type: object properties: id: type: string example: 2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3 email: type: string example: example@example.com databases: type: array items: $ref: '#/components/schemas/DatabaseDataItem' malware_logs: type: array items: $ref: '#/components/schemas/MalwareDataItem' credential_lists: type: array items: $ref: '#/components/schemas/CredentialDataItem' risk_assessment: type: object properties: level: type: string description: 'Risk level, one of the following: info, low, medium, high, critical' example: high recommendations_enabled: type: string description: If true, user has enabled recommendations for this request. If false, recommendations are not provided. This field is taken from user provided query parameter of the same name. example: 'true' recommendations: type: array items: type: object properties: leaked_data_category: type: string description: Pretty name of general data category that triggered this recommendation example: Password recommendation: type: string description: Recommendation text example: Avoid using your publicly known information in passwords. Threat actors routinely use other known information, such as email addresses, phone numbers, pet names, dates of birth, first/last names and other data in stuffing attacks to uncover passwords that were otherwise never leaked online. MalwareDataItemLite: type: object properties: identifier: type: string description: Malware identifier composed by malicious code example: US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566] id: type: string description: Systemic hex ID of the record example: 678e9e47098d6b3b44f75ec8 type: type: string description: Name or brand of the infostealer (may be empty or unknown) example: risepro published_date: type: string description: Date that malware log has been published example: '2025-01-20T19:04:39Z' data: type: object properties: credentials: type: array items: type: object properties: url: type: string example: https://login.example.com/path/to/login cleaned_url: type: string example: login.example.com username: type: string example: username email: type: string example: example@example.com password: type: string example: password1 application: type: string example: Google Chrome DatabaseSample: type: object properties: identifier: type: string description: Identifier in the following format {domain}_{top level domain} example: example_com id: type: string description: Systemic hex ID of the record example: 6698de5af71724f56f4076df breach_date: type: string example: '2024-01-16T00:00:00Z' data_keys: type: array items: type: string description: List of data keys that are exposed in the database, all possible values can be found [HERE](https://docs.nordstellar.com/enterprise-apis/product-integrations/data-categories#data-points) example: - alternate_email - bio - email - homepage - name - profile_picture - username description: type: string example: On July 18, 2024, a database related to the example.com website was found circulating the web. The potential data leak reportedly occurred on January 16, 2024. Over 15 million email addresses were exposed, together with social media, credential and personal data. Leaked records include username, name, home page, bio, Parent email address and Profile picture's URL. The validity of the data exposed couldn't be verified. Yet we're still informing you about a potential data leak – but keep in mind there's a chance of it being a false positive. logo_url: type: string example: null name: type: string example: example.com published_date: type: string example: '2024-07-18T09:20:26Z' unique_email_count: type: integer example: 15111576 unique_phone_count: type: integer example: 123516 type: type: string description: Type of the database - identified (has a domain or name), unidentified or collection example: identified domain: type: string example: example.com securitySchemes: BasicAuth: type: http scheme: basic description: Authorization string. Needs to be in the standard BasicAuth format - "Basic BASE64_CREDENTIALS", where BASE64_CREDENTIALS is the user username:password encoded in base64 format. ApiKeyAuth: type: apiKey in: header name: X-API-KEY