openapi: 3.2.0
info:
  title: NordStellar Enterprise Data Malware Logs Intelligence API
  description: '## Overview

    The NordStellar Enterprise Data API provides comprehensive access to our data breach intelligence platform, enabling organizations to integrate real-time security monitoring and alerting capabilities directly into their existing infrastructure.

    This API allows you to proactively protect your users by detecting when their sensitive information has been compromised in data breaches across the internet.


    **Key Features**:

    - **Real-time Breach Monitoring**: Receive immediate notifications when user data appears in newly discovered data breaches.

    - **Zero-Knowledge Architecture**: Search for compromised sensitive data (credit cards, national identification numbers) using secure hash-based methods that never transmit the actual sensitive information.

    - **Comprehensive Data Sources**: Access intelligence from multiple sources including corporate data breaches, malware infection logs, and stolen credential lists.

    - **Flexible Integration Options**: Support for webhook notifications, bulk operations, and subscription management to fit your organization''s unique requirements.

    - **Enterprise-Grade Security**: Secure authentication methods, rate limiting, and quota management to ensure responsible and controlled API usage.'
  version: '3.1'
servers:
- url: /api/v3/data
security:
- ApiKeyAuth: []
- BasicAuth: []
tags:
- name: Malware Logs Intelligence
  description: 'Endpoints for retrieving detailed metadata about breach origins, including malware logs.

    These operations provide comprehensive context about malware logs breach incidents, affected platforms, and exposure scope to support your security investigations.'
paths:
  /email/{email-sha256}/malware-logs:
    get:
      tags:
      - Malware Logs Intelligence
      summary: Email malware logs lookup
      description: 'Used for looking up email addresses and their malware logs.

        These email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.


        **Rate limit: 200 per second.**'
      operationId: singleEmailMalwareLogs
      parameters:
      - $ref: '#/components/parameters/Email'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailMalwareLogsSample'
        '206':
          description: Returns partial found data, with **errors** field on truncated records
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    example: 2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3
                  email:
                    type: string
                    example: example@example.com
                  malware_logs:
                    type: array
                    items:
                      $ref: '#/components/schemas/MalwareDataItem'
                  errors:
                    type: object
                    properties:
                      body:
                        type: string
                    description: Contains errors signifying partial data
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /email/malware-logs:
    post:
      tags:
      - Malware Logs Intelligence
      summary: Bulk email malware logs lookup
      description: 'Used for looking up email addresses and their malware logs in bulk.

        These email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.


        The data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.


        *Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.

        If a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned

        and the rest of its malware data truncated. Truncated data contains malware IDs that can be used

        to retrieve data using **data-source** endpoints*


        **Rate limit: 10 per second.**'
      operationId: emailMalwareLogs
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Emails'
        required: true
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailsMalwareLogsSample'
        '206':
          description: Returns partial found data, with **errors** field on truncated records
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/EmailMalwareLogsSample'
                  limit:
                    type: integer
                    example: 10
                  offset:
                    type: integer
                    example: 0
                  errors:
                    type: object
                    properties:
                      body:
                        type: string
                    description: Contains errors signifying partial data
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
      security:
      - ApiKeyAuth: []
  /phone/{phone-sha256}/malware-logs:
    get:
      tags:
      - Malware Logs Intelligence
      summary: Phone malware logs lookup
      description: 'Used for looking up phone numbers and their malware logs.

        These phone numbers and their data have been collected and aggregated from various databases openly accessible on the internet.


        **Rate limit: 200 per second.**'
      operationId: singlePhoneMalwareLogs
      parameters:
      - $ref: '#/components/parameters/Phone'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PhoneMalwareLogsSample'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /phone/malware-logs:
    post:
      tags:
      - Malware Logs Intelligence
      summary: Bulk phone malware logs lookup
      description: 'Used for looking up phones numbers and their malware logs in bulk.

        These phone numbers and their data have been collected and aggregated from various databases openly accessible on the internet.


        The data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.


        *Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.

        If a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned

        and the rest of its malware data truncated. Truncated data contains malware IDs that can be used

        to retrieve data using **data-source** endpoints*


        **Rate limit: 200 per second.**'
      operationId: phonesMalwareLogs
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Phone'
        required: true
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PhonesMalwareLogsSample'
        '206':
          description: Returns partial found data, with **errors** field on truncated records
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/PhoneMalwareLogsSample'
                  limit:
                    type: integer
                    example: 10
                  offset:
                    type: integer
                    example: 0
                  errors:
                    type: object
                    properties:
                      body:
                        type: string
                    description: Contains errors signifying partial data
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
      security:
      - ApiKeyAuth: []
  /data-source/malware-log/{id}:
    get:
      tags:
      - Malware Logs Intelligence
      summary: Malware Log Lookup
      description: 'Used to look up malware logs that are publicly accessible on the internet, and their metadata.

        These malware logs may have been collected from both clearnet and deep/dark web.

        Each malware log record pertains to a particular instance of infection and contains data gathered from the affected machine at the time of the attack.


        The returned sections can be narrowed using the **inclusive-projection** and **exclusive-projection** query parameters

        (see the parameter descriptions for the available sections, e.g. `credentials`, `cookies`, `secrets`).


        **Rate limit: 200 per second.**'
      operationId: malwareLog
      parameters:
      - $ref: '#/components/parameters/HexId'
      - $ref: '#/paths/~1data-source~1malware-log/post/parameters/0'
      - $ref: '#/paths/~1data-source~1malware-log/post/parameters/1'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MalwareDataItem'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /data-source/malware-log:
    post:
      tags:
      - Malware Logs Intelligence
      summary: Bulk Malware Log Lookup
      description: 'Used to look up malware logs that are publicly accessible on the internet, and their metadata.

        These malware logs may have been collected from both clearnet and deep/dark web.

        Each malware log record pertains to a particular instance of infection and contains data gathered from the affected machine at the time of the attack.


        The data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.


        The returned sections can be narrowed using the **inclusive-projection** and **exclusive-projection** query parameters

        (see the parameter descriptions for the available sections, e.g. `credentials`, `cookies`, `secrets`).


        **Rate limit: 200 per second.**'
      operationId: malwareLogs
      parameters:
      - name: inclusive-projection
        in: query
        description: 'Return **only** the listed fields of each malware log, omitting everything else. Useful for trimming large responses (malware logs can be very large) and reducing payload size.


          Values are a comma-separated list (`?inclusive-projection=credentials,cookies`) or repeated parameters (`?inclusive-projection=credentials&inclusive-projection=cookies`).


          **Available fields:** `id`, `identifier`, `type`, `system_info`, `identification_level`, `credentials`, `credit_cards`, `cookies`, `autofills`, `grabbed_files`, `secrets`, `metadata`, `ftp`, `installed_software`, `process_list`, `rdp`, `rac`, `ssh`, `vpn`, `email_clients`, `downloads`.


          Only the listed fields are returned — there are no implicit includes beyond the always-present `id`.


          **`id` is special:** it is always present and may be named explicitly, but it can never be excluded.


          Mutually exclusive with **exclusive-projection** — supplying both returns `400 Bad Request`. Unknown field names also return `400 Bad Request`. A maximum of 100 fields may be supplied.'
        required: false
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
        example:
        - credentials
        - cookies
      - name: exclusive-projection
        in: query
        description: 'Return each full malware log **except** the listed fields. Useful for dropping heavy parts of the response (e.g. excluding cookies or grabbed files) while keeping everything else.


          Values are a comma-separated list (`?exclusive-projection=cookies,grabbed_files`) or repeated parameters (`?exclusive-projection=cookies&exclusive-projection=grabbed_files`).


          **Available fields:** `identifier`, `type`, `system_info`, `identification_level`, `credentials`, `credit_cards`, `cookies`, `autofills`, `grabbed_files`, `secrets`, `metadata`, `ftp`, `installed_software`, `process_list`, `rdp`, `rac`, `ssh`, `vpn`, `email_clients`, `downloads`.


          **`id` cannot be excluded** — supplying `id` returns `400 Bad Request`.


          Mutually exclusive with **inclusive-projection** — supplying both returns `400 Bad Request`. Unknown field names also return `400 Bad Request`. A maximum of 100 fields may be supplied.'
        required: false
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
        example:
        - cookies
        - grabbed_files
      requestBody:
        content:
          application/json:
            schema:
              required:
              - ids
              type: object
              properties:
                ids:
                  type: array
                  description: 'A list of malware log IDs to lookup.

                    ID should consist of 24 hexadecimal digits.'
                  items:
                    type: string
                  example:
                  - 5f4e1f2e4b1d4d4e4b1d4d4e
                  - 5f4e1f2e4b1d4d4e4b1d4d4f
                limit:
                  description: Default is the maximum limit of 20 records
                  type: integer
                  example: 10
                offset:
                  type: integer
                  example: 0
        required: true
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MalwareLogsSample'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '413':
          description: Too many logs on single request
          content: {}
      security:
      - ApiKeyAuth: []
  /data-source/malware-log/details:
    post:
      tags:
      - Malware Logs Intelligence
      summary: Bulk Malware Log Details Lookup
      description: 'Used to look up malware log details (identifier, malware type, published date, updated date and system information) for a list of malware log IDs.

        Returns a lightweight representation of each malware log, including the identifier, type, published date, updated date, and system information.

        This endpoint does not return the full malware log data (credentials, cookies, etc.).


        The data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.


        **Rate limit: 200 per second.**'
      operationId: malwareLogDetails
      requestBody:
        content:
          application/json:
            schema:
              required:
              - ids
              type: object
              properties:
                ids:
                  type: array
                  description: 'A list of malware log IDs to lookup details for.

                    ID should consist of 24 hexadecimal digits.'
                  items:
                    type: string
                  example:
                  - 5f4e1f2e4b1d4d4e4b1d4d4e
                  - 5f4e1f2e4b1d4d4e4b1d4d4f
                limit:
                  description: Default is the maximum limit of 500 records
                  type: integer
                  example: 10
                offset:
                  type: integer
                  example: 0
        required: true
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      type: object
                      properties:
                        identifier:
                          type: string
                          description: Malware identifier
                          example: US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]
                        id:
                          type: string
                          description: Systemic hex ID of the record
                          example: 678e9e47098d6b3b44f75ec8
                        type:
                          type: string
                          description: Name of the infostealer
                          example: risepro
                        published_date:
                          type: string
                          description: Date that malware log has been published
                          example: '2025-01-20T19:04:39Z'
                        updated_date:
                          type: string
                          description: Date that malware log has been last updated
                          example: '2025-02-15T12:30:00Z'
                        system_info:
                          $ref: '#/components/schemas/MalwareLogSystemInfoSampleItem'
                  limit:
                    type: integer
                    example: 10
                  offset:
                    type: integer
                    example: 0
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '413':
          description: Too many logs on single request
          content: {}
      security:
      - ApiKeyAuth: []
  /data-source/malware-log/stats:
    post:
      tags:
      - Malware Logs Intelligence
      summary: Bulk Malware Log Statistics Lookup
      description: 'Returns the number of records held in each data category of a malware log, without returning the records themselves.


        For a set of malware log identifiers, each result reports how many credentials, cookies, autofills, credit cards, secrets and other artifacts were recovered from the infected machine, together with its system information, metadata and identification level. This offers a lightweight way to assess the size and composition of a malware log before retrieving its full contents.


        **Rate limit: 200 per second.**'
      operationId: malwareLogStatistics
      requestBody:
        content:
          application/json:
            schema:
              required:
              - ids
              type: object
              properties:
                ids:
                  type: array
                  description: 'A list of malware log IDs to look up statistics for. Up to 500 IDs per request.

                    ID should consist of 24 hexadecimal digits.'
                  items:
                    type: string
                  example:
                  - 5f4e1f2e4b1d4d4e4b1d4d4e
                  - 5f4e1f2e4b1d4d4e4b1d4d4f
        required: true
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      type: object
                      properties:
                        identifier:
                          type: string
                          description: Malware identifier composed by malicious code
                          example: US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]
                        id:
                          type: string
                          description: Systemic hex ID of the record
                          example: 678e9e47098d6b3b44f75ec8
                        type:
                          type: string
                          description: Name or brand of the infostealer (may be empty or unknown)
                          example: risepro
                        published_date:
                          type: string
                          description: Date that malware log has been published
                          example: '2025-01-20T19:04:39Z'
                        statistics:
                          type: object
                          description: Number of records recovered in each data category
                          properties:
                            credentials_count:
                              type: integer
                              example: 42
                            cookies_count:
                              type: integer
                              example: 1337
                            autofills_count:
                              type: integer
                              example: 12
                            grabbed_files_count:
                              type: integer
                              example: 87
                            credit_cards_count:
                              type: integer
                              example: 0
                            secrets_count:
                              type: integer
                              example: 3
                            ftp_count:
                              type: integer
                              example: 0
                            installed_software_count:
                              type: integer
                              example: 65
                            process_list_count:
                              type: integer
                              example: 120
                            rdp_count:
                              type: integer
                              example: 0
                            rac_count:
                              type: integer
                              example: 0
                            vpn_count:
                              type: integer
                              example: 1
                            email_clients_count:
                              type: integer
                              example: 2
                            downloads_count:
                              type: integer
                              example: 5
                            ssh_keys_count:
                              type: integer
                              example: 4
                            ssh_known_hosts_count:
                              type: integer
                              example: 9
                        system_info:
                          $ref: '#/components/schemas/MalwareLogSystemInfoSampleItem'
                        metadata:
                          type: object
                          properties:
                            incident_date:
                              type: string
                              example: '2021-05-26T08:19:13Z'
                            emails:
                              type: array
                              items:
                                type: string
                                example: example@example.com
                            phones:
                              type: array
                              items:
                                type: string
                                example: '15551234567'
                            ips:
                              type: array
                              items:
                                type: string
                                example: 203.0.113.42
                            hardware_id:
                              type: string
                              example: 89f3221e-2138-48c9-bbe2-8f68-806e6f6e6963
                            machine_id:
                              type: string
                              example: 89f3221e-2138-48c9-bbe2-ab615454c7ef
                            country:
                              type: string
                              example: US
                        identification_level:
                          type: string
                          description: Indicates how well the system information was identified during parsing. Empty string when value was not set
                          enum:
                          - ''
                          - identified
                          - partially_identified
                          - unidentified
                          example: identified
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
      security:
      - ApiKeyAuth: []
  /data-source/malware-log/credentials/url/{credentials_url}/id:
    get:
      tags:
      - Malware Logs Intelligence
      summary: Malware Log IDs Lookup
      description: "Used to look up malware logs ids that contains specified url domain/subdomain values in their credentials.\n\nNote that  domain/subdomain values need to be exact match. That means for example:\nIf 'domain.com' is given in the request. The response credentials will not contain 'subdomain.domain.com'. \nFor those cases, 'subdomain.domain.com' should be given in the request.\n\nThe request data requires pagination object. Pagination behaviour can be modified using **limit** and **offset** parameters.\nDefault is the maximum limit of 2000. \n\n**Rate limit: 200 per second.**"
      operationId: malwareLogIdsByCred
      parameters:
      - $ref: '#/components/parameters/Url'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Offset'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  credentials_url:
                    type: string
                    example: example.com
                  malware_log_ids:
                    type: array
                    items:
                      type: string
                    example:
                    - 5f4e1f2e4b1d4d4e4b1d4d4e
                    - 5f4e1f2e4b1d4d4e4b1d4d4f
                  limit:
                    type: integer
                    example: 10
                  offset:
                    type: integer
                    example: 0
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /data-source/malware-log/{id}/credentials/url/{credentials_url}:
    get:
      tags:
      - Malware Logs Intelligence
      summary: Malware Log Credentials Lookup
      description: "Used to look up a malware log by ID and credential url. \nThe credentials of the malware will be filtered out to match the request url by domain/subdomain.\n\nNote that  domain/subdomain values need to be exact match. That means for example:\nIf 'domain.com' is given in the request. The response credentials will not contain 'subdomain.domain.com'. \nFor those cases, 'subdomain.domain.com' should be given in the request.\n\n**Rate limit: 200 per second.**"
      operationId: malwareLogByCred
      parameters:
      - $ref: '#/components/parameters/HexId'
      - $ref: '#/components/parameters/Url'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  identifier:
                    type: string
                    description: Malware identifier composed by malicious code
                    example: US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]
                  id:
                    type: string
                    description: Systemic hex ID of the record
                    example: 678e9e47098d6b3b44f75ec8
                  incident_date:
                    type: string
                    description: Date of the infection
                    example: '2025-01-20T19:04:39Z'
                  published_date:
                    type: string
                    description: Date that malware log has been published
                    example: '2025-01-20T19:04:39Z'
                  credentials:
                    type: array
                    items:
                      type: object
                      properties:
                        url:
                          type: string
                          example: https://login.example.com/path/to/login
                        cleaned_url:
                          type: string
                          example: login.example.com
                        username:
                          type: string
                          example: username
                        email:
                          type: string
                          example: example@example.com
                        password:
                          type: string
                          example: password1
                        application:
                          type: string
                          example: Google Chrome
                  system_info:
                    $ref: '#/components/schemas/MalwareLogSystemInfoSampleItem'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
      security:
      - ApiKeyAuth: []
  /data-source/malware-log/secrets/type/{type}/id:
    get:
      tags:
      - Malware Logs Intelligence
      summary: Malware Log IDs With Secrets Lookup
      description: "Used to look up malware logs ids that contains specified secret type values in their secrets list.\n    \n**Rate limit: 200 per second.**"
      operationId: malwareLogIdsBySecret
      parameters:
      - $ref: '#/components/parameters/SecretType'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Offset'
      - $ref: '#/components/parameters/PublishedTsFrom'
      - $ref: '#/components/parameters/PublishedTsTo'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/paths/~1data-source~1malware-log~1secrets~1type~1id/get/responses/200/content/application~1json/schema'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /data-source/malware-log/{id}/secrets/type/{type}:
    get:
      tags:
      - Malware Logs Intelligence
      summary: Malware Log Secrets Lookup
      description: "Used to look up a malware log by ID and secret type. \nThe secrets of the malware will be filtered out to match the secret type.\n    \nThe request data requires pagination object. Pagination behaviour can be modified using **limit** and **offset** parameters.\nDefault is the maximum limit of 2000. \n\n**Rate limit: 200 per second.**"
      operationId: malwareLogBySecret
      parameters:
      - $ref: '#/components/parameters/HexId'
      - $ref: '#/components/parameters/SecretType'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MalwareLogSecretSample'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
      security:
      - ApiKeyAuth: []
  /data-source/malware-log/secrets/type/id:
    get:
      tags:
      - Malware Logs Intelligence
      summary: Malware Log IDs With Unspecified Secrets Lookup
      description: 'Used to look up malware logs ids that contains any secrets types.


        **Rate limit: 200 per second.**'
      operationId: malwareLogIdsWithSecrets
      parameters:
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Offset'
      - $ref: '#/components/parameters/PublishedTsFrom'
      - $ref: '#/components/parameters/PublishedTsTo'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                    example: aws-access-token
                  malware_log_ids:
                    type: array
                    items:
                      type: string
                    example:
                    - 5f4e1f2e4b1d4d4e4b1d4d4e
                    - 5f4e1f2e4b1d4d4e4b1d4d4f
                  limit:
                    type: integer
                    example: 10
                  offset:
                    type: integer
                    example: 0
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /data-source/malware-log/{id}/secrets/type:
    get:
      tags:
      - Malware Logs Intelligence
      summary: Malware Log Unspecified Secrets Lookup
      description: "Used to look up a malware log by ID. \nThe secret list of the log will not be filtered.\n    \nThe request data requires pagination object. Pagination behaviour can be modified using **limit** and **offset** parameters.\nDefault is the maximum limit of 2000. \n\n**Rate limit: 200 per second.**"
      operationId: malwareLogWithSecrets
      parameters:
      - $ref: '#/components/parameters/HexId'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MalwareLogSecretSample'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
      security:
      - ApiKeyAuth: []
  /data-source/malware-log/secrets/feed:
    post:
      tags:
      - Malware Logs Intelligence
      summary: Malware Log Secrets Feed
      description: "\nUsed to get a feed of malware logs secrets based on specified secret type(s) & date ranges.\nDates can be specified either with exact values (range) or relative value (lookback days).\nIf no secret values are specified, all secret types will be returned.\n\nThe data is returned using pagination by default, \npagination behaviour can be modified using **limit** and **offset** parameters.\n\n**Rate limit: 200 per second.**"
      operationId: malwareLogsSecretsFeed
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                published_ts_from:
                  description: Unix timestamp of the earliest published date to include in the results
                  type: integer
                  example: 1747186400
                published_ts_to:
                  description: Unix timestamp of the latest published date to include in the results
                  type: integer
                  example: 1747186400
                lookback_days:
                  description: Lookback days to include in the results (max 180)
                  type: integer
                  example: 15
                types:
                  type: array
                  description: "Any of the following: \n  - 1password-secret-key\n  - 1password-service-account-token\n  - adafruit-api-key\n  - adobe-client-id\n  - adobe-client-secret\n  - age-secret-key\n  - airtable-api-key\n  - airtable-personnal-access-token\n  - algolia-api-key\n  - alibaba-access-key-id\n  - alibaba-secret-key\n  - anthropic-admin-api-key\n  - anthropic-api-key\n  - artifactory-api-key\n  - artifactory-reference-token\n  - asana-client-id\n  - asana-client-secret\n  - assemblyai-api-key\n  - atlassian-api-token\n  - authress-service-client-access-key\n  - aws-access-token\n  - aws-amazon-bedrock-api-key-long-lived\n  - aws-amazon-bedrock-api-key-short-lived\n  - aws-secret-key\n  - azure-ad-client-secret\n  - beamer-api-token\n  - bitbucket-client-id\n  - bitbucket-client-secret\n  - bittrex-access-key\n  - bittrex-secret-key\n  - cerebras-api-key\n  - cisco-meraki-api-key\n  - clickhouse-cloud-api-secret-key\n  - clojars-api-token\n  - cloudflare-api-key\n  - cloudflare-global-api-key\n  - cloudflare-origin-ca-key\n  - codecov-access-token\n  - cohere-api-token\n  - coinbase-access-token\n  - confluent-access-token\n  - confluent-secret-key\n  - contentful-delivery-api-token\n  - curl-auth-header\n  - curl-auth-user\n  - cursor-api-key\n  - databricks-api-token\n  - datadog-access-token\n  - deepgram-api-key\n  - deepseek-api-key\n  - defined-networking-api-token\n  - digitalocean-access-token\n  - digitalocean-pat\n  - digitalocean-refresh-token\n  - discord-api-token\n  - discord-client-id\n  - discord-client-secret\n  - doppler-api-token\n  - droneci-access-token\n  - dropbox-api-token\n  - dropbox-long-lived-api-token\n  - dropbox-short-lived-api-token\n  - duffel-api-token\n  - dynatrace-api-token\n  - easypost-api-token\n  - easypost-test-api-token\n  - elevenlabs-api-key\n  - endorlabs-api-key\n  - endorlabs-api-secret\n  - etsy-access-token\n  - facebook-access-token\n  - facebook-page-access-token\n  - facebook-secret\n  - fastly-api-token\n  - figma-personal-access-header-token\n  - figma-personal-access-token\n  - finicity-api-token\n  - finicity-client-secret\n  - finnhub-access-token\n  - flickr-access-token\n  - flutterwave-encryption-key\n  - flutterwave-public-key\n  - flutterwave-secret-key\n  - flyio-access-token\n  - frameio-api-token\n  - freemius-secret-key\n  - freshbooks-access-token\n  - gcp-api-key\n  - gcp-service-account-json\n  - gitea-access-token\n  - github-app-token\n  - github-fine-grained-pat\n  - github-oauth\n  - github-pat\n  - github-refresh-token\n  - gitlab-cicd-job-token\n  - gitlab-deploy-token\n  - gitlab-feature-flag-client-token\n  - gitlab-feed-token\n  - gitlab-kubernetes-agent-token\n  - gitlab-oauth-app-secret\n  - gitlab-pat\n  - gitlab-pat-routable\n  - gitlab-ptt\n  - gitlab-rrt\n  - gitlab-runner-authentication-token\n  - gitlab-runner-authentication-token-routable\n  - gitlab-scim-token\n  - gitlab-session-cookie\n  - gitter-access-token\n  - gocardless-api-token\n  - grafana-api-key\n  - grafana-cloud-api-token\n  - grafana-service-account-token\n  - greptile-api-key\n  - groq-api-key\n  - harness-api-key\n  - hashicorp-tf-api-token\n  - hashicorp-tf-password\n  - heroku-api-key\n  - hubspot-api-key\n  - huggingface-access-token\n  - huggingface-organization-api-token\n  - infracost-api-token\n  - intercom-api-key\n  - intra42-client-secret\n  - jfrog-api-key\n  - jfrog-identity-token\n  - kraken-access-token\n  - kubernetes-secret-yaml\n  - kucoin-access-token\n  - kucoin-secret-key\n  - launchdarkly-access-token\n  - linear-api-key\n  - linear-client-secret\n  - linkedin-client-id\n  - linkedin-client-secret\n  - lob-api-key\n  - lob-pub-api-key\n  - looker-client-id\n  - looker-client-secret\n  - mailchimp-api-key\n  - mailgun-private-api-token\n  - mailgun-pub-key\n  - mailgun-signing-key\n  - mapbox-api-token\n  - mattermost-access-token\n  - maxmind-license-key\n  - messagebird-api-token\n  - messagebird-client-id\n  - microsoft-teams-webhook\n  - mistral-api-key\n  - mongodb-atlas-service-account-id\n  - mongodb-atlas-service-account-secret\n  - mongodb-connection-string\n  - netlify-access-token\n  - new-relic-browser-api-token\n  - new-relic-insert-key\n  - new-relic-user-api-id\n  - new-relic-user-api-key\n  - nexos-ai-user-api-key\n  - npm-access-token\n  - nuget-config-password\n  - nvidia-api-key\n  - nytimes-access-token\n  - octopus-deploy-api-key\n  - okta-access-token\n  - ollama-api-key\n  - openai-api-key\n  - openrouter-api-key\n  - openshift-user-token\n  - ovh-application-key\n  - ovh-application-secret\n  - ovh-consumer-key\n  - perplexity-api-key\n  - pkcs12-file\n  - plaid-api-token\n  - plaid-client-id\n  - plaid-secret-key\n  - planetscale-api-token\n  - planetscale-id\n  - planetscale-oauth-token\n  - planetscale-password\n  - polymarket-address\n  - polymarket-api-key\n  - polymarket-api-secret\n  - polymarket-passphrase\n  - polymarket-private-key\n  - posthog-personal-api-key\n  - posthog-project-api-key\n  - postman-api-token\n  - prefect-api-token\n  - private-key\n  - privateai-api-token\n  - pulumi-api-token\n  - pypi-upload-token\n  - rapidapi-access-token\n  - readme-api-token\n  - replicate-api-token\n  - rubygems-api-token\n  - scalingo-api-token\n  - sendbird-access-id\n  - sendbird-access-token\n  - sendgrid-api-token\n  - sendinblue-api-token\n  - sentry-access-token\n  - sentry-org-token\n  - sentry-user-token\n  - settlemint-application-access-token\n  - settlemint-personal-access-token\n  - settlemint-service-access-token\n  - shippo-api-token\n  - shopify-access-token\n  - shopify-custom-access-token\n  - shopify-private-app-access-token\n  - shopify-shared-secret\n  - sidekiq-secret\n  - sidekiq-sensitive-url\n  - slack-app-token\n  - slack-bot-token\n  - slack-config-access-token\n  - slack-config-refresh-token\n  - slack-legacy-bot-token\n  - slack-legacy-token\n  - slack-legacy-workspace-token\n  - slack-session-cookie\n  - slack-session-token\n  - slack-user-token\n  - slack-webhook-url\n  - snyk-api-token\n  - sonar-api-token\n  - sourcegraph-access-token\n  - square-access-token\n  - squarespace-access-token\n  - stability-ai-api-key\n  - stripe-access-token\n  - sumologic-access-id\n  - sumologic-access-token\n  - telegram-bot-api-token\n  - togetherai-api-key\n  - travisci-access-token\n  - twilio-api-key\n  - twitch-api-token\n  - twitter-access-secret\n  - twitter-access-token\n  - twitter-api-key\n  - twitter-api-secret\n  - twitter-bearer-token\n  - typeform-api-token\n  - vault-batch-token\n  - vault-service-token\n  - vercel-ai-gateway-key\n  - vercel-api-token\n  - vercel-app-access-token\n  - vercel-app-refresh-token\n  - vercel-integration-token\n  - vercel-personal-access-token\n  - weights-and-biases-api-key\n  - weights-and-biases-api-key-v1\n  - xai-api-key\n  - yandex-access-token\n  - yandex-api-key\n  - yandex-aws-access-token\n  - zendesk-secret-key"
                  items:
                    type: string
                  example:
                  - aws-access-token
                  - stripe-access-token
                limit:
                  description: Default is the maximum limit of 100 records
                  type: integer
                  example: 10
                offset:
                  type: integer
                  example: 0
                last_id:
                  description: A faster pagination alternative to offset. Set this instead of offset to get response for further pages quicker.
                  type: string
                  example: 655f334bca9e4393edf56f0b
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MalwareLogsSecretsFeedSample'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /data-source/malware-log/credentials/feed:
    post:
      tags:
      - Malware Logs Intelligence
      summary: Malware Log Credentials Feed
      description: '

        Used to get a feed of malware logs credentials based on specified date ranges.

        Dates can be specified either with exact values (range) or relative value (lookback days).


        Because some malware logs can contain an abnormally large number of credentials,

        the number of credentials returned is capped. When the cap is reached the response

        contains fewer malware logs than the pagination limit and is returned with HTTP

        status **206 Partial Content**. Continue paging (using the id of the last returned

        record as **last_id**) to retrieve the remainder.


        The data is returned using pagination by default,

        pagination behaviour can be modified using **limit** and **offset** parameters.


        **Rate limit: 200 per second.**'
      operationId: malwareLogsCredentialsFeed
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                published_ts_from:
                  description: Unix timestamp of the earliest published date to include in the results
                  type: integer
                  example: 1747186400
                published_ts_to:
                  description: Unix timestamp of the latest published date to include in the results
                  type: integer
                  example: 1747186400
                lookback_days:
                  description: Lookback days to include in the results (max 180)
                  type: integer
                  example: 15
                limit:
                  description: Default is the maximum limit of 100 records
                  type: integer
                  example: 10
                offset:
                  type: integer
                  example: 0
                last_id:
                  description: A faster pagination alternative to offset. Set this instead of offset to get response for further pages quicker.
                  type: string
                  example: 655f334bca9e4393edf56f0b
                domain:
                  description: Filter the credentials for a specific domain target.
                  type: string
                  example: example.com
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      type: object
                      properties:
                        identifier:
                          type: string
                          description: Malware identifier composed by malicious code
                          example: US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]
                        id:
                          type: string
                          description: Systemic hex ID of the record
                          example: 678e9e47098d6b3b44f75ec8
                        type:
                          type: string
                          description: Name or brand of the infostealer (may be empty or unknown)
                          example: risepro
                        incident_date:
                          type: string
                          description: Date of the infection
                          example: '2025-01-20T19:04:39Z'
                        published_date:
                          type: string
                          description: Date that malware log has been published
                          example: '2025-01-22T19:04:39Z'
                        credentials:
                          type: array
                          items:
                            type: object
                            properties:
                              url:
                                type: string
                                example: https://login.example.com/path/to/login
                              cleaned_url:
                                type: string
                                example: login.example.com
                              username:
                                type: string
                                example: username
                              email:
                                type: string
                                example: example@example.com
                              password:
                                type: string
                                example: password1
                              application:
                                type: string
                                example: Google Chrome
                        system_info:
                          $ref: '#/components/schemas/MalwareLogSystemInfoSampleItem'
                  limit:
                    type: integer
                    example: 10
                  offset:
                    type: integer
                    example: 0
        '206':
          description: Partial content. The credential cap was reached, so fewer malware logs than the pagination limit are returned. Continue paging with last_id to retrieve the remainder.
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/paths/~1data-source~1malware-log~1credentials~1feed/post/responses/200/content/application~1json/schema'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
components:
  headers:
    X-Quota-Remaining:
      schema:
        type: integer
      description: The number of requests left for the period
    X-Quota-Limit:
      schema:
        type: integer
      description: Quota limit per minute
    X-RateLimit-Reset:
      schema:
        type: string
        format: date-time
      description: Date and time when rate limit counter resets
    X-RateLimit-Remaining:
      schema:
        type: integer
      description: The number of requests left for the time window
    X-RateLimit-Limit:
      schema:
        type: integer
      description: Request limit per minute
  parameters:
    Offset:
      name: offset
      in: query
      description: Offset the results by an integer
      schema:
        type: integer
    PublishedTsFrom:
      name: published_ts_from
      in: query
      description: Unix timestamp of the earliest published date to include in the results
      schema:
        type: integer
    Limit:
      name: limit
      in: query
      description: Limit the count of records in results
      required: false
      schema:
        type: integer
    Email:
      name: email-sha256
      in: path
      required: true
      description: Hashed lower-cased email address using SHA256 algorithm
      schema:
        type: string
    SecretType:
      name: type
      in: path
      required: true
      description: "Any of the following: \n  - 1password-secret-key\n  - 1password-service-account-token\n  - adafruit-api-key\n  - adobe-client-id\n  - adobe-client-secret\n  - age-secret-key\n  - airtable-api-key\n  - airtable-personnal-access-token\n  - algolia-api-key\n  - alibaba-access-key-id\n  - alibaba-secret-key\n  - anthropic-admin-api-key\n  - anthropic-api-key\n  - artifactory-api-key\n  - artifactory-reference-token\n  - asana-client-id\n  - asana-client-secret\n  - assemblyai-api-key\n  - atlassian-api-token\n  - authress-service-client-access-key\n  - aws-access-token\n  - aws-amazon-bedrock-api-key-long-lived\n  - aws-amazon-bedrock-api-key-short-lived\n  - aws-secret-key\n  - azure-ad-client-secret\n  - beamer-api-token\n  - bitbucket-client-id\n  - bitbucket-client-secret\n  - bittrex-access-key\n  - bittrex-secret-key\n  - cerebras-api-key\n  - cisco-meraki-api-key\n  - clickhouse-cloud-api-secret-key\n  - clojars-api-token\n  - cloudflare-api-key\n  - cloudflare-global-api-key\n  - cloudflare-origin-ca-key\n  - codecov-access-token\n  - cohere-api-token\n  - coinbase-access-token\n  - confluent-access-token\n  - confluent-secret-key\n  - contentful-delivery-api-token\n  - curl-auth-header\n  - curl-auth-user\n  - cursor-api-key\n  - databricks-api-token\n  - datadog-access-token\n  - deepgram-api-key\n  - deepseek-api-key\n  - defined-networking-api-token\n  - digitalocean-access-token\n  - digitalocean-pat\n  - digitalocean-refresh-token\n  - discord-api-token\n  - discord-client-id\n  - discord-client-secret\n  - doppler-api-token\n  - droneci-access-token\n  - dropbox-api-token\n  - dropbox-long-lived-api-token\n  - dropbox-short-lived-api-token\n  - duffel-api-token\n  - dynatrace-api-token\n  - easypost-api-token\n  - easypost-test-api-token\n  - elevenlabs-api-key\n  - endorlabs-api-key\n  - endorlabs-api-secret\n  - etsy-access-token\n  - facebook-access-token\n  - facebook-page-access-token\n  - facebook-secret\n  - fastly-api-token\n  - figma-personal-access-header-token\n  - figma-personal-access-token\n  - finicity-api-token\n  - finicity-client-secret\n  - finnhub-access-token\n  - flickr-access-token\n  - flutterwave-encryption-key\n  - flutterwave-public-key\n  - flutterwave-secret-key\n  - flyio-access-token\n  - frameio-api-token\n  - freemius-secret-key\n  - freshbooks-access-token\n  - gcp-api-key\n  - gcp-service-account-json\n  - gitea-access-token\n  - github-app-token\n  - github-fine-grained-pat\n  - github-oauth\n  - github-pat\n  - github-refresh-token\n  - gitlab-cicd-job-token\n  - gitlab-deploy-token\n  - gitlab-feature-flag-client-token\n  - gitlab-feed-token\n  - gitlab-kubernetes-agent-token\n  - gitlab-oauth-app-secret\n  - gitlab-pat\n  - gitlab-pat-routable\n  - gitlab-ptt\n  - gitlab-rrt\n  - gitlab-runner-authentication-token\n  - gitlab-runner-authentication-token-routable\n  - gitlab-scim-token\n  - gitlab-session-cookie\n  - gitter-access-token\n  - gocardless-api-token\n  - grafana-api-key\n  - grafana-cloud-api-token\n  - grafana-service-account-token\n  - greptile-api-key\n  - groq-api-key\n  - harness-api-key\n  - hashicorp-tf-api-token\n  - hashicorp-tf-password\n  - heroku-api-key\n  - hubspot-api-key\n  - huggingface-access-token\n  - huggingface-organization-api-token\n  - infracost-api-token\n  - intercom-api-key\n  - intra42-client-secret\n  - jfrog-api-key\n  - jfrog-identity-token\n  - kraken-access-token\n  - kubernetes-secret-yaml\n  - kucoin-access-token\n  - kucoin-secret-key\n  - launchdarkly-access-token\n  - linear-api-key\n  - linear-client-secret\n  - linkedin-client-id\n  - linkedin-client-secret\n  - lob-api-key\n  - lob-pub-api-key\n  - looker-client-id\n  - looker-client-secret\n  - mailchimp-api-key\n  - mailgun-private-api-token\n  - mailgun-pub-key\n  - mailgun-signing-key\n  - mapbox-api-token\n  - mattermost-access-token\n  - maxmind-license-key\n  - messagebird-api-token\n  - messagebird-client-id\n  - microsoft-teams-webhook\n  - mistral-api-key\n  - mongodb-atlas-service-account-id\n  - mongodb-atlas-service-account-secret\n  - mongodb-connection-string\n  - netlify-access-token\n  - new-relic-browser-api-token\n  - new-relic-insert-key\n  - new-relic-user-api-id\n  - new-relic-user-api-key\n  - nexos-ai-user-api-key\n  - npm-access-token\n  - nuget-config-password\n  - nvidia-api-key\n  - nytimes-access-token\n  - octopus-deploy-api-key\n  - okta-access-token\n  - ollama-api-key\n  - openai-api-key\n  - openrouter-api-key\n  - openshift-user-token\n  - ovh-application-key\n  - ovh-application-secret\n  - ovh-consumer-key\n  - perplexity-api-key\n  - pkcs12-file\n  - plaid-api-token\n  - plaid-client-id\n  - plaid-secret-key\n  - planetscale-api-token\n  - planetscale-id\n  - planetscale-oauth-token\n  - planetscale-password\n  - polymarket-address\n  - polymarket-api-key\n  - polymarket-api-secret\n  - polymarket-passphrase\n  - polymarket-private-key\n  - posthog-personal-api-key\n  - posthog-project-api-key\n  - postman-api-token\n  - prefect-api-token\n  - private-key\n  - privateai-api-token\n  - pulumi-api-token\n  - pypi-upload-token\n  - rapidapi-access-token\n  - readme-api-token\n  - replicate-api-token\n  - rubygems-api-token\n  - scalingo-api-token\n  - sendbird-access-id\n  - sendbird-access-token\n  - sendgrid-api-token\n  - sendinblue-api-token\n  - sentry-access-token\n  - sentry-org-token\n  - sentry-user-token\n  - settlemint-application-access-token\n  - settlemint-personal-access-token\n  - settlemint-service-access-token\n  - shippo-api-token\n  - shopify-access-token\n  - shopify-custom-access-token\n  - shopify-private-app-access-token\n  - shopify-shared-secret\n  - sidekiq-secret\n  - sidekiq-sensitive-url\n  - slack-app-token\n  - slack-bot-token\n  - slack-config-access-token\n  - slack-config-refresh-token\n  - slack-legacy-bot-token\n  - slack-legacy-token\n  - slack-legacy-workspace-token\n  - slack-session-cookie\n  - slack-session-token\n  - slack-user-token\n  - slack-webhook-url\n  - snyk-api-token\n  - sonar-api-token\n  - sourcegraph-access-token\n  - square-access-token\n  - squarespace-access-token\n  - stability-ai-api-key\n  - stripe-access-token\n  - sumologic-access-id\n  - sumologic-access-token\n  - telegram-bot-api-token\n  - togetherai-api-key\n  - travisci-access-token\n  - twilio-api-key\n  - twitch-api-token\n  - twitter-access-secret\n  - twitter-access-token\n  - twitter-api-key\n  - twitter-api-secret\n  - twitter-bearer-token\n  - typeform-api-token\n  - vault-batch-token\n  - vault-service-token\n  - vercel-ai-gateway-key\n  - vercel-api-token\n  - vercel-app-access-token\n  - vercel-app-refresh-token\n  - vercel-integration-token\n  - vercel-personal-access-token\n  - weights-and-biases-api-key\n  - weights-and-biases-api-key-v1\n  - xai-api-key\n  - yandex-access-token\n  - yandex-api-key\n  - yandex-aws-access-token\n  - zendesk-secret-key"
      schema:
        type: string
    HexId:
      name: id
      in: path
      required: true
      description: Record ID to lookup. ID should consist of 24 hexadecimal digits.
      schema:
        type: string
    PublishedTsTo:
      name: published_ts_to
      in: query
      description: Unix timestamp of the latest published date to include in the results
      schema:
        type: integer
    Url:
      name: credentials_url
      in: path
      required: true
      description: Credentials URL that must be sanitized, excluding protocols and any extraneous details.
      schema:
        type: string
    Phone:
      name: phone-sha256
      in: path
      required: true
      description: Hashed phone number using SHA256 algorithm
      schema:
        type: string
  schemas:
    MalwareLogSystemInfoSampleItem:
      type: object
      properties:
        ip:
          type: string
          example: 192.168.1.1
        username:
          type: string
          example: diego.lebon
        country:
          type: string
          example: US
        zip:
          type: string
          example: '10001'
        location:
          type: string
          example: New York, USA
        hardware_id:
          type: string
          example: 89f3221e-2138-48c9-bbe2-8f68-806e6f6e6963
        language:
          type: string
          example: es-ES
        timezone:
          type: string
          example: UTC1
        os:
          type: string
          example: Windows 10 Pro [x64]
        system_name:
          type: string
          example: DESKTOP-42R6V1I
        guid:
          type: string
          example: 91788e64-8fdf-11eb-8f68-806e6f6e6963
        machine_id:
          type: string
          example: 89f3221e-2138-48c9-bbe2-ab615454c7ef
        date:
          type: string
          example: '2021-05-26T08:19:13Z'
        execution_path:
          type: string
          example: C:\Program Files\Example\example.exe
        antivirus_software:
          type: array
          items:
            type: string
            example: Norton Antivirus
        work_dir:
          type: string
          example: C:\Users\appdata
        oem_id:
          type: string
          example: 00000000-0000-0000-0000-0000
        screen_size:
          type: string
          example: 1920x1080
        uac:
          type: string
          example: AllowAll
        process_elevation:
          type: boolean
          example: true
        keyboard_layouts:
          type: array
          items:
            type: string
            example: English (United States)
        hardwares:
          type: array
          items:
            type: string
            example: Intel(R) Core(TM) i7-9700 CPU @ 3.00GHz
    MalwareDataItem:
      type: object
      properties:
        identifier:
          type: string
          description: Malware identifier composed by malicious code
          example: US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]
        id:
          type: string
          description: Systemic hex ID of the record
          example: 678e9e47098d6b3b44f75ec8
        type:
          type: string
          description: Name or brand of the infostealer (may be empty or unknown)
          example: risepro
        published_date:
          type: string
          description: Date that malware log has been published
          example: '2025-01-20T19:04:39Z'
        data:
          type: object
          properties:
            credentials:
              type: array
              items:
                type: object
                properties:
                  url:
                    type: string
                    example: https://login.example.com/path/to/login
                  cleaned_url:
                    type: string
                    example: login.example.com
                  username:
                    type: string
                    example: username
                  email:
                    type: string
                    example: example@example.com
                  password:
                    type: string
                    example: password1
                  application:
                    type: string
                    example: Google Chrome
            cookies:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                    example: SEARCH_SAMESITE
                  value:
                    type: string
                    example: CgQItZIB
                  path:
                    type: string
                    example: /
                  domain:
                    type: string
                    example: google.com
                  expires:
                    type: string
                    example: '2021-10-21T12:22:38Z'
            autofills:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                    example: '0000000000000000011'
                  value:
                    type: string
                    example: example@example.com
                  browser:
                    type: string
                    example: Google Chrome
            grabbed_files:
              type: array
              items:
                type: string
                example: /work/important.docx
            credit_cards:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                    example: John Doe
                  card_number:
                    type: string
                    example: '4111111111111111'
                  cvv:
                    type: string
                    example: '123'
                  expiration_date:
                    type: string
                    example: 12/25
            system_info:
              $ref: '#/components/schemas/MalwareLogSystemInfoSampleItem'
            metadata:
              type: object
              properties:
                incident_date:
                  type: string
                  example: '2021-05-26T08:19:13Z'
                emails:
                  type: array
                  items:
                    type: string
                    example: example@example.com
                phones:
                  type: array
                  items:
                    type: string
                    example: '15551234567'
                ips:
                  type: array
                  items:
                    type: string
                    example: 203.0.113.42
                hardware_id:
                  type: string
                  example: 89f3221e-2138-48c9-bbe2-8f68-806e6f6e6963
                machine_id:
                  type: string
                  example: 89f3221e-2138-48c9-bbe2-ab615454c7ef
                country:
                  type: string
                  example: US
            secret:
              type: array
              items:
                type: object
                properties:
                  type:
                    type: string
                    example: aws-access-token
                  values:
                    type: array
                    items:
                      type: string
                      example: AKIAIOSFODNN7EXAMPLE
            ftp:
              type: array
              items:
                type: object
                properties:
                  host:
                    type: string
                    example: ftp.example.com
                  port:
                    type: integer
                    example: 21
                  username:
                    type: string
                    example: username
                  password:
                    type: string
                    example: password1
                  applications:
                    type: array
                    items:
                      type: string
                      example: FileZilla
                  cert:
                    type: object
                    properties:
                      data:
                        type: string
                        example: abcd123123123123123123123
                      activation_time:
                        type: integer
                        example: 1652227200
                      expiration_time:
                        type: integer
                        example: 1660089599
                      host:
                        type: string
                        example: ftp.example.com
                      port:
                        type: integer
                        example: 21
                      trust_sans:
                        type: integer
                        example: 1
            installed_software:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                    example: FileZilla Server
                  version:
                    type: string
                    example: 0.9.60
            process_list:
              type: array
              items:
                type: object
                properties:
                  pid:
                    type: integer
                    example: 11708
                  name:
                    type: string
                    example: uTorrent.exe
                  session_name:
                    type: string
                    example: Console
                  cmd:
                    type: string
                    example: C:\Users\steam\AppData\Roaming\utorrent\uTorrent.exe  /MINIMIZED
            rdp:
              type: array
              items:
                type: object
                properties:
                  server:
                    type: string
                    example: Yandex.Browser
                  username:
                    type: string
                    example: username
                  password:
                    type: string
                    example: password1
            rac:
              type: array
              items:
                type: object
                properties:
                  private_key:
                    type: string
                    example: '-----BEGIN PRIVATE KEY----..***..-----END PRIVATE'
                  certificate:
                    type: string
                    example: '-----BEGIN CERTIFICATE----..***..-----END CERTIFICATE'
            ssh:
              type: object
              properties:
                known_hosts:
                  type: array
                  items:
                    type: object
                    properties:
                      host:
                        type: string
                        example: github.com
                      key_type:
                        type: string
                        example: ssh-ed25519
                      key_value:
                        type: string
                        example: AAAAC1NzaC2lZDI2NTE5AAAAIOMqqnkVzrm0SdG1UOoqKLsabgH5C9okWi1dh1l1GKJl
                keys:
                  type: array
                  items:
                    type: object
                    properties:
                      name:
                        type: string
                        example: id_ed25519.pub
                      type:
                        type: string
                        example: public
                      value:
                        type: string
                        example: AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
            vpn:
              type: array
              items:
                type: object
                properties:
                  vpn_name:
                    type: string
                    example: NordVPN
                  credentials:
                    type: array
                    items:
                      type: object
                      properties:
                        username:
                          type: string
                          example: username
                        password:
                          type: string
                          example: password1
                  user_config:
                    type: array
                    items:
                      type: string
                      example: 'IsThreatProtectionTurnOffByConnection: False'
                  openvpn:
                    type: array
                    items:
                      type: object
                      properties:
                        name:
                          type: string
                          example: filename.ovpn
                        options:
                          type: array
                          items:
                            type: string
                            example: cipher AES-256-CBC
                        openvpn_certificates:
                          type: array
                          items:
                            type: object
                            properties:
                              name:
                                type: string
                                example: tls-crypt-v2
                              data:
                                type: string
                                example: '-----BEGIN CERTIFICATE----..***..-----END CERTIFICATE'
            email_clients:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                    example: Mozilla Thunderbird
                  credentials:
                    type: array
                    items:
                      type: object
                      properties:
                        server:
                          type: string
                          example: imap.example.com
                        username:
                          type: string
                          example: username
                        password:
                          type: string
                          example: password1
            downloads:
              type: array
              items:
                type: object
                properties:
                  url:
                    type: string
                    example: https://example.com/download
                  file_path:
                    type: string
                    example: /work/important.docx
                  browser:
                    type: string
                    example: Google Chrome
            identification_level:
              type: string
              description: Indicates how well the system information was identified during parsing. Empty string when value was not set
              enum:
              - ''
              - identified
              - partially_identified
              - unidentified
              example: identified
        risk_assessment:
          $ref: '#/components/schemas/EmailSample/properties/risk_assessment'
    PhonesMalwareLogsSample:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/PhoneMalwareLogsSample'
        limit:
          type: integer
          example: 10
        offset:
          type: integer
          example: 0
    PhoneMalwareLogsSample:
      type: object
      properties:
        id:
          type: string
          example: 631dadc9288c13b61bb83c480292c11154b35b5bb777a4946980de62f70477eb
        phone:
          type: string
          example: '13855550193'
          description: International format phone number
        malware_logs:
          type: array
          items:
            $ref: '#/components/schemas/MalwareDataItem'
    EmailsMalwareLogsSample:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/EmailMalwareLogsSample'
        limit:
          type: integer
          example: 10
        offset:
          type: integer
          example: 0
    Phone:
      required:
      - data
      type: object
      properties:
        phones_sha256:
          type: array
          description: A list of SHA256 hashed phone numbers to lookup
          items:
            type: string
          example:
          - 2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304
        limit:
          description: Default is the maximum limit of 100 records
          type: integer
          example: 10
        offset:
          type: integer
          example: 0
    MalwareLogSecretSample:
      type: object
      properties:
        identifier:
          type: string
          description: Malware identifier composed by malicious code
          example: US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]
        id:
          type: string
          description: Systemic hex ID of the record
          example: 678e9e47098d6b3b44f75ec8
        type:
          type: string
          description: Name or brand of the infostealer (may be empty or unknown)
          example: risepro
        incident_date:
          type: string
          description: Date of the infection
          example: '2025-01-20T19:04:39Z'
        published_date:
          type: string
          description: Date that malware log has been published
          example: '2025-01-22T19:04:39Z'
        secrets:
          type: array
          items:
            type: object
            properties:
              type:
                type: string
                example: aws-secret-key
              values:
                type: array
                items:
                  type: string
                  example: ABCDEFGH12345678
        system_info:
          $ref: '#/components/schemas/MalwareLogSystemInfoSampleItem'
    EmailSample:
      type: object
      properties:
        id:
          type: string
          example: 2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3
        email:
          type: string
          example: example@example.com
        databases:
          type: array
          items:
            $ref: '#/components/schemas/DatabaseDataItem'
        malware_logs:
          type: array
          items:
            $ref: '#/components/schemas/MalwareDataItem'
        credential_lists:
          type: array
          items:
            $ref: '#/components/schemas/CredentialDataItem'
        risk_assessment:
          type: object
          properties:
            level:
              type: string
              description: 'Risk level, one of the following: info, low, medium, high, critical'
              example: high
            recommendations_enabled:
              type: string
              description: If true, user has enabled recommendations for this request. If false, recommendations are not provided. This field is taken from user provided query parameter of the same name.
              example: 'true'
            recommendations:
              type: array
              items:
                type: object
                properties:
                  leaked_data_category:
                    type: string
                    description: Pretty name of general data category that triggered this recommendation
                    example: Password
                  recommendation:
                    type: string
                    description: Recommendation text
                    example: Avoid using your publicly known information in passwords. Threat actors routinely use other known information, such as email addresses, phone numbers, pet names, dates of birth, first/last names and other data in stuffing attacks to uncover passwords that were otherwise never leaked online.
    EmailMalwareLogsSample:
      type: object
      properties:
        id:
          type: string
          example: 2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3
        email:
          type: string
          example: example@example.com
        malware_logs:
          type: array
          items:
            $ref: '#/components/schemas/MalwareDataItem'
    MalwareLogsSecretsFeedSample:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/MalwareLogSecretSample'
        limit:
          type: integer
          example: 10
        offset:
          type: integer
          example: 0
    Emails:
      required:
      - data
      type: object
      properties:
        emails_sha256:
          type: array
          description: A list of SHA256 hashed lower-case email addresses to lookup
          items:
            type: string
          example:
          - 2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304
        limit:
          description: Default is the maximum limit of 100 records
          type: integer
          example: 10
        offset:
          type: integer
          example: 0
    MalwareLogsSample:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/MalwareDataItem'
        limit:
          type: integer
          example: 10
        offset:
          type: integer
          example: 0
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic
      description: Authorization string. Needs to be in the standard BasicAuth format - "Basic BASE64_CREDENTIALS", where BASE64_CREDENTIALS is the user username:password encoded in base64 format.
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-KEY