{"openapi":"3.1.0","info":{"title":"NordStellar Enterprise Data API","description":"## Overview\nThe NordStellar Enterprise Data API provides comprehensive access to our data breach intelligence platform, enabling organizations to integrate real-time security monitoring and alerting capabilities directly into their existing infrastructure.\nThis API allows you to proactively protect your users by detecting when their sensitive information has been compromised in data breaches across the internet.\n\n**Key Features**:\n- **Real-time Breach Monitoring**: Receive immediate notifications when user data appears in newly discovered data breaches.\n- **Zero-Knowledge Architecture**: Search for compromised sensitive data (credit cards, national identification numbers) using secure hash-based methods that never transmit the actual sensitive information.\n- **Comprehensive Data Sources**: Access intelligence from multiple sources including corporate data breaches, malware infection logs, and stolen credential lists.\n- **Flexible Integration Options**: Support for webhook notifications, bulk operations, and subscription management to fit your organization's unique requirements.\n- **Enterprise-Grade Security**: Secure authentication methods, rate limiting, and quota management to ensure responsible and controlled API usage.","version":"3.1"},"servers":[{"url":"/api/v3/data"}],"security":[{"ApiKeyAuth":[]},{"BasicAuth":[]}],"tags":[{"name":"API User Management","description":"Endpoints for administering API keys, and web hook settings.\n\nThese operations enable administrators to list and manage API keys, update webhook configuration."},{"name":"Domain Intelligence","description":"Endpoints for investigating domain exposure in data breaches, including detailed breach information and compromise analysis.\nThese operations support protection against domain hijacking, phishing attacks, and other threats targeting domain owners."},{"name":"Email Intelligence","description":"Endpoints for comprehensive email address monitoring in data breaches, including detailed breach information, password exposure, and statistical analysis.\nThese operations enable robust email security protection, account takeover prevention, and exposure assessment at both individual and domain-wide levels."},{"name":"Phone Intelligence","description":"Endpoints for investigating phone number exposure in data breaches, including detailed breach information and compromise analysis. These operations support protection against SIM swapping, phone-based fraud, and other attacks targeting mobile devices and phone numbers."},{"name":"Credit Card Intelligence","description":"Endpoints for comprehensive credit card data monitoring in data breaches, including zero-knowledge search capabilities.\nThese operations enable robust credit card security protection and exposure assessment."},{"name":"National Identification Number Intelligence","description":"Endpoints for comprehensive national identification number data monitoring in data breaches, including zero-knowledge search capabilities.\nThese operations enable robust national identification number security protection and exposure assessment."},{"name":"Breached Databases","description":"Endpoints for retrieving detailed metadata about breach origins, including databases.\nThese operations provide comprehensive context about database breach incidents, affected platforms, and exposure scope to support your security investigations."},{"name":"Credential Lists","description":"Endpoints for retrieving detailed metadata about breach origins, including credential lists.\nThese operations provide comprehensive context about credential list breach incidents, affected platforms, and exposure scope to support your security investigations."},{"name":"Malware Logs Intelligence","description":"Endpoints for retrieving detailed metadata about breach origins, including malware logs.\nThese operations provide comprehensive context about malware logs breach incidents, affected platforms, and exposure scope to support your security investigations."},{"name":"Password Intelligence","description":"Endpoints for comprehensive password data monitoring in data breaches, including zero-knowledge search capabilities.\nThese operations enable robust password security protection and exposure assessment."},{"name":"Cookie Intelligence","description":"Endpoints for comprehensive cookie data monitoring in data breaches, including zero-knowledge search capabilities.\nThese operations enable robust cookie security protection and exposure assessment."},{"name":"Dark Web Intelligence","description":"Endpoints for searching scraped content from the dark web"},{"name":"Subscription Management","description":"Endpoints for managing user subscriptions to data breach monitoring services. These operations enable administrators to create, update, and delete subscriptions for email addresses, phone numbers, domains, and sensitive data types.\n\nWhen a subscription is created, Serity automatically sends requests to the user’s webhook whenever new or updated data matches the subscription criteria. The webhook destination must be specified through the APIs user-management endpoints.\n\n### Webhook Requirements\nTo ensure reliable delivery under high load, user webhooks **must support very high request throughput** — at least `100 requests per second`. Serity operates at scale and will **not throttle outbound traffic** based on slow client responses. Frequent `429 Too Many Requests` responses are retried, but they can **clog internal delivery queues**, thus, it is strongly recommended that webhook endpoints are backed by a **message queue** or similar buffering system that can **acknowledge requests immediately** and **process them asynchronously** at the desired pace. This ensures resilience and prevents backpressure issues during high traffic periods.\n\n### Delivery Semantics and Retry Policy\n- `2XX responses (200–299)` are treated as successful acknowledgements and are not retried.  \n- `404 responses` trigger internal alerts and are **not retried**, as they typically indicate an invalid or deprecated endpoint.\n- `429 (Too Many Requests)` responses are retried with backoff, but can cause delivery delays if they persist.\n- `All other 4XX and 5XX responses` are **retried** with exponential backoff.  \n- After prolonged retry failure, events are moved to a **DLQ**. In such cases, the platform team will contact the user.  \n### Webhook Payload\n```\n{\n  \"subscription_id\": \"string\",\n  \"document_type\": \"email-sha256 | phone-sha256 | cc-argon2id | nin-argon2id | cc-sha1 | nin-sha1\",\n  \"document_identifier\": \"string\",\n  \"operation_type\": \"update | insert\",\n  \"databases\": [],\n  \"credential_lists\": [],\n  \"malware_logs\": [],\n}\n```\nBy default, users receive only documents with the *insert* operation type.  If the corresponding subscription has the dispatch_on_update option enabled, the webhook also sends update events."},{"name":"Profiling","description":"Endpoints for generating OSINT-based profiling reports on email addresses and phone numbers. Reports aggregate data from external intelligence sources, enrich it with internal breach data, and produce an LLM-powered risk analysis.\n\nReports are processed asynchronously through a multi-stage pipeline: `pending` (data collection) → `analyzing` (LLM processing) → `completed`. Use the GET endpoint to poll for completion."},{"name":"Utility Endpoints","description":"Utility endpoints for supporting zero-knowledge functionalities, such as retrieving salts.\nThese operations are essential for the proper functioning of zero-knowledge security features."}],"paths":{"/user":{"get":{"tags":["API User Management"],"summary":"Get user information","description":"Used for getting the profile information associated with the user's credentials used to make the API call.\n\n**Rate limit: 10 per minute.**","operationId":"getUserDetails","responses":{"200":{"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}},"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserDetails"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"object","properties":{"body":{"type":"string","description":"Error description"}}}}}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"BasicAuth":[]}]}},"/user/subscription-endpoint":{"post":{"tags":["API User Management"],"summary":"Update user endpoint information","description":"Used for updating the subscription webhook endpoint information tied to current user.\nUsername and password are optional, these values should only be set if the subscription service uses BasicAuth to connect to the provided endpoint\n\n**Rate limit: 10 per minute.**","operationId":"updateUserEndpointDetails","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionEndpoint"}}}},"responses":{"200":{"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}},"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionEndpointSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"BasicAuth":[]}]}},"/auth/token":{"post":{"tags":["API User Management"],"summary":"Create API access token","description":"Used for creating the API access token.\n\nAPI access token can then be used for authentication to other non-administrative endpoints.\n\nThe **id** parameter is optional in the request body. Any unique name of alphanumeric characters\nto identify the holder or purpose of this token can be used. If left blank, the id will be assigned randomly.\n\n**Rate limit: 10 per minute.**","operationId":"createAccessToken","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetAccessToken"}}}},"responses":{"200":{"description":"Success","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessToken"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"BasicAuth":[]}]}},"/auth/token/{id}":{"delete":{"tags":["API User Management"],"summary":"Delete API access token","description":"Used for deleting the API access token.\n\nThis operation is non-reversible and the token will not be active anymore with no way to reactivate it.\n\n**Rate limit: 10 per minute.**","operationId":"deleteAccessToken","parameters":[{"$ref":"#/components/parameters/TokenId"}],"responses":{"200":{"description":"Success","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessToken"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"BasicAuth":[]}]},"get":{"tags":["API User Management"],"summary":"Get API access token","description":"Used for getting the API access token.\n\nAPI access token can then be used for authentication to other non-auth endpoints.\n\nToken IDs can be looked up via /user endpoint or created via /auth/token enpoint.\n\n**Rate limit: 10 per minute.**","operationId":"getAccessToken","parameters":[{"$ref":"#/components/parameters/TokenId"}],"responses":{"200":{"description":"Success","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per minute. Defaults 10 per minute"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessToken"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"BasicAuth":[]}]}},"/zero-knowledge/cc/{hash-type}/{hash}":{"get":{"tags":["Credit Card Intelligence"],"summary":"Credit card search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include the credit card number product (**SHA-1** or **Argon2id** hash),\ngenerated using specific secure algorithm.\n\nHashed credit card number is returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these credit cards.\nReturned data is grouped by **origin** & it's hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**)\n**Rate limit: 200 per second.**","operationId":"creditCardSearch","parameters":[{"$ref":"#/components/parameters/HashType"},{"$ref":"#/components/parameters/Hash"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/cc/{hash-type}/{hash-range}":{"get":{"tags":["Credit Card Intelligence"],"summary":"Credit cards search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include first 5 characters of the credit card number product (**SHA-1** or **Argon2id** hash),\ngenerated using specific secure algorithm.\n\nHashed credit card numbers are returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these credit cards.\nReturned data is grouped by **origin** & it's hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**)\n**Rate limit: 200 per second.**","operationId":"creditCardsSearch","parameters":[{"$ref":"#/components/parameters/HashType"},{"$ref":"#/components/parameters/HashRange"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeMultiSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/cc":{"post":{"tags":["Credit Card Intelligence"],"summary":"Bulk credit cards search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include a list of first 5 characters of credit card number products (**SHA-1** or **Argon2id** hash),\ngenerated using specific secure algorithm.\n\nHashed credit card numbers are returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these credit cards.\nReturned data is grouped by **origin** & it's hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**)\n**Rate limit: 200 per second.**","operationId":"creditCardsBulkSearch","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HashRangesSample"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeMultiSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/cc/lite":{"post":{"tags":["Credit Card Intelligence"],"summary":"Bulk lite credit cards search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include a list of first 5 characters of credit card number products (**SHA-1** or **Argon2id** hash),\ngenerated using specific secure algorithm.\n\nHashed credit card numbers are returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these credit cards.\nReturned data is grouped by **origin** and its hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**).\nFor **malware_logs** origin, each record includes **malware_details** (identifier, type, published/updated dates, **system_info**) when available from the malware-log service.\n\n**Rate limit: 200 per second.**","operationId":"creditCardsBulkSearchLite","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HashRangesSample"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeMultiLiteSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/cc/partial/sha256/{hash}":{"get":{"tags":["Credit Card Intelligence"],"summary":"Partial credit cards count lookup","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\nEndpoint is used to lookup the count of compromised credit cards that match the partial hash.\n\nThe request should include a SHA256 hash generated from the first 6 and last 4 digits of the credit card number. \nFor instance, given the credit card number **1234 5678 9012 3456**, the hash should be derived from the exact string **1234563456** (without spaces).\n\nThe response provides the count of matched compromised credit card entries.\n**Rate limit: 200 per second.**","operationId":"partialCreditCardSearch","parameters":[{"$ref":"#/components/parameters/Hash"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgePartialCreditCardsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/nin/{hash-type}/{hash}":{"get":{"tags":["National Identification Number Intelligence"],"summary":"National identification number search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include the national identification number product (**SHA-1** or **Argon2id** hash),\ngenerated using specific secure algorithm.\n\nHashed national identification number is returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these credit cards.\nReturned data is grouped by **origin** & it's hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**)\n**Rate limit: 200 per second.**","operationId":"ninSearch","parameters":[{"$ref":"#/components/parameters/HashType"},{"$ref":"#/components/parameters/Hash"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/nin/{hash-type}/{hash-range}":{"get":{"tags":["National Identification Number Intelligence"],"summary":"National identification numbers search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include first 5 characters of the national identification number product (**SHA-1** or **Argon2id** hash),\ngenerated using specific secret and secure algorithm.\n\nHashed national identification numbers are returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these nationa identification numbers.\nReturned data is grouped by **origin** & it's hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**)\n**Rate limit: 200 per second.**","operationId":"ninsSearch","parameters":[{"$ref":"#/components/parameters/HashType"},{"$ref":"#/components/parameters/HashRange"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeMultiSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/nin":{"post":{"tags":["National Identification Number Intelligence"],"summary":"Bulk national identification numbers search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include a list of first 5 characters of the national identification number products (**SHA-1** or **Argon2id** hash),\ngenerated using specific secret and secure algorithm.\n\nHashed national identification numbers are returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these nationa identification numbers.\nReturned data is grouped by **origin** & it's hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**)\n**Rate limit: 200 per second.**","operationId":"ninsBulkSearch","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HashRangesSample"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeMultiSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/email/domain/{domain}":{"get":{"tags":["Email Intelligence","Domain Intelligence"],"summary":"Domain search","description":"Used for looking up all email addresses and their data for a specific domain.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.\nIf a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned\nand the rest of its malware data truncated. Truncated data contains malware IDs that can be used\nto retrieve data using **data-source** endpoints*\n\nDefault is the maximum limit of **100** records \n(If the response returns exactly 100 records, it indicates the potential presence of more records. Initiate a subsequent request to retrieve any additional results)\n\n**Rate limit: 20 per second.**","operationId":"domain","parameters":[{"$ref":"#/components/parameters/Domain"},{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/Offset"},{"name":"last-id","in":"query","description":"A faster pagination alternative to offset. Set this instead of offset to get response for further pages quicker.","required":false,"schema":{"type":"string"}},{"$ref":"#/paths/~1email/post/parameters/0"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailsSample"}}}},"206":{"description":"Returns partial found data, with **errors** field on truncated records","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/paths/~1email/post/responses/206/content/application~1json/schema"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/email/domain/{domain}/lite":{"get":{"tags":["Email Intelligence","Domain Intelligence"],"summary":"Lite Domain search","description":"Used for looking up all email addresses and their data for a specific domain.\n\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.\nIf a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned\nand the rest of its malware data truncated. Truncated data contains malware IDs that can be used\nto retrieve data using **data-source** endpoints*\n\nDefault is the maximum limit of **100** records \n(If the response returns exactly 100 records, it indicates the potential presence of more records. Initiate a subsequent request to retrieve any additional results)\n\n**Lite version of /email/domain endpoint, which only includes credentials from malware logs.**\n\n**Rate limit: 100 per second.**","operationId":"domainLite","parameters":[{"$ref":"#/components/parameters/Domain"},{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/Offset"},{"$ref":"#/paths/~1email~1domain~1%7Bdomain%7D/get/parameters/3"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailsLiteSample"}}}},"206":{"description":"Returns partial found data, with **errors** field on truncated records","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EmailLiteSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0},"errors":{"type":"object","properties":{"body":{"type":"string"}},"description":"Contains errors signifying partial data"}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/email/{email-sha256}":{"get":{"tags":["Email Intelligence"],"summary":"Email Lookup","description":"Used for looking up email addresses and their data.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe returned sections can be narrowed using the **inclusive-projection** and **exclusive-projection** query parameters\n(see the parameter descriptions for the available sections, e.g. `databases`, `combo_lists`, `malware_logs`).\n\n**Rate limit: 200 per second.**","operationId":"singleEmail","parameters":[{"$ref":"#/components/parameters/Email"},{"$ref":"#/paths/~1email/post/parameters/0"},{"$ref":"#/paths/~1email/post/parameters/1"},{"$ref":"#/paths/~1email/post/parameters/2"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailSample"}}}},"206":{"description":"Returns partial found data, with **errors** field on truncated records","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","example":"2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3"},"email":{"type":"string","example":"example@example.com"},"databases":{"type":"array","items":{"$ref":"#/components/schemas/DatabaseDataItem"}},"malware_logs":{"type":"array","items":{"$ref":"#/components/schemas/MalwareDataItem"}},"credential_lists":{"type":"array","items":{"$ref":"#/components/schemas/CredentialDataItem"}},"errors":{"type":"object","properties":{"body":{"type":"string"}},"description":"Contains errors signifying partial data"}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/email/{email-sha256}/lite":{"get":{"tags":["Email Intelligence"],"summary":"Lite Email Lookup","description":"Used for looking up email addresses and their data.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\n**Lite version of /email endpoint, which only includes credentials from malware logs.**\n\n**Rate limit: 200 per second.**","operationId":"singleEmailLite","parameters":[{"$ref":"#/components/parameters/Email"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailLiteSample"}}}},"206":{"description":"Returns partial found data, with **errors** field on truncated records","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","example":"2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3"},"email":{"type":"string","example":"example@example.com"},"databases":{"type":"array","items":{"$ref":"#/components/schemas/DatabaseDataItem"}},"malware_logs":{"type":"array","items":{"$ref":"#/components/schemas/MalwareDataItemLite"}},"credential_lists":{"type":"array","items":{"$ref":"#/components/schemas/CredentialDataItem"}},"errors":{"type":"object","properties":{"body":{"type":"string"}},"description":"Contains errors signifying partial data"}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/email/{email-sha256}/databases":{"get":{"tags":["Email Intelligence","Breached Databases"],"summary":"Email databases lookup","description":"Used for looking up email addresses and their databases.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\n**Rate limit: 200 per second.**","operationId":"singleEmailDatabases","parameters":[{"$ref":"#/components/parameters/Email"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailDatabasesSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/email/{email-sha256}/malware-logs":{"get":{"tags":["Email Intelligence","Malware Logs Intelligence"],"summary":"Email malware logs lookup","description":"Used for looking up email addresses and their malware logs.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\n**Rate limit: 200 per second.**","operationId":"singleEmailMalwareLogs","parameters":[{"$ref":"#/components/parameters/Email"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailMalwareLogsSample"}}}},"206":{"description":"Returns partial found data, with **errors** field on truncated records","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","example":"2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3"},"email":{"type":"string","example":"example@example.com"},"malware_logs":{"type":"array","items":{"$ref":"#/components/schemas/MalwareDataItem"}},"errors":{"type":"object","properties":{"body":{"type":"string"}},"description":"Contains errors signifying partial data"}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/email/{email-sha256}/credential-lists":{"get":{"tags":["Email Intelligence","Credential Lists"],"summary":"Email credential lists lookup","description":"Used for looking up email addresses and their credential lists.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\n**Rate limit: 200 per second.**","operationId":"singleEmailCredentialLists","parameters":[{"$ref":"#/components/parameters/Email"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailCredentialListsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/email/{email-sha256}/password":{"get":{"tags":["Email Intelligence","Password Intelligence"],"summary":"Single email ATO prevention","description":"Used for looking up an email address and its fuzzed passwords. Fuzzed passwords are passwords transformed according to pre-defined rules. The rule set, and thus the number of fuzzed passwords returned depends on the fuzzing_intensity parameter, which ranges from **0** to **10**, **0** being no fuzzing, only original password returned, and **10** being the biggest rule set that returns over 50,000 fuzzed passwords per original password.\n**Rate limit: 10 per second.**","operationId":"singleEmailPassword","parameters":[{"$ref":"#/components/parameters/Email"},{"$ref":"#/components/parameters/FuzzingIntensity"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailAtoPreventionSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/email":{"post":{"tags":["Email Intelligence"],"summary":"Bulk Email Lookup","description":"Used for looking up email addresses and their data in bulk.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\nThe returned sections can be narrowed using the **inclusive-projection** and **exclusive-projection** query parameters\n(see the parameter descriptions for the available sections, e.g. `databases`, `combo_lists`, `malware_logs`).\n\n*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.\nIf a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned\nand the rest of its malware data truncated. Truncated data contains malware IDs that can be used\nto retrieve data using **data-source** endpoints*\n\n**Rate limit: 10 per second.**","operationId":"email","parameters":[{"name":"recommendations_enabled","in":"query","description":"If you need data breach resolution recommendations, set this to true.","schema":{"type":"boolean"}},{"name":"inclusive-projection","in":"query","description":"Return **only** the listed fields, omitting everything else. Useful for trimming large responses (e.g. fetching just malware logs) and reducing payload size.\n\nValues are a comma-separated list (`?inclusive-projection=databases,malware_logs`) or repeated parameters (`?inclusive-projection=databases&inclusive-projection=malware_logs`).\n\nThe record's envelope fields (its `id`, the `email`/`phone` value, and `meta`) are always returned regardless of the projection.\n\n**Top-level sections:**\n- `databases` — breached database records (the `databases` response field).\n- `combo_lists` — credential list records (returned in the `credential_lists` response field; email endpoints only).\n- `malware_logs` — malware infection logs.\n\n`databases` and `malware_logs` also support selecting individual sub-fields with dot notation, e.g. `databases.identifier`, `malware_logs.credentials`, `malware_logs.cookies`. Only the listed sub-fields are returned — there are no implicit includes beyond the always-present `id`.\n\n**`id` is special:** each record's `id` is always present and may be named explicitly (e.g. `malware_logs.id`), but it can never be excluded — the only way to omit it is to exclude the whole enclosing object.\n\nMutually exclusive with **exclusive-projection** — supplying both returns `400 Bad Request`. Unknown field names also return `400 Bad Request`. A maximum of 100 fields may be supplied.","required":false,"style":"form","explode":false,"schema":{"type":"array","items":{"type":"string"}},"example":["malware_logs","databases"]},{"name":"exclusive-projection","in":"query","description":"Return the full email document **except** the listed fields. Useful for dropping heavy parts of the response (e.g. excluding malware logs) while keeping everything else.\n\nValues are a comma-separated list (`?exclusive-projection=malware_logs,combo_lists`) or repeated parameters (`?exclusive-projection=malware_logs&exclusive-projection=combo_lists`).\n\n**Top-level sections:**\n- `databases` — breached database records (the `databases` response field).\n- `combo_lists` — credential list records (returned in the `credential_lists` response field; email endpoints only).\n- `malware_logs` — malware infection logs.\n\n`databases` and `malware_logs` also support excluding individual sub-fields with dot notation, e.g. `malware_logs.cookies`, `malware_logs.installed_software`, `databases.data`. The rest of each record is still returned.\n\n**`id` cannot be excluded.** Any exclusion path that targets an `id` (e.g. `id` or `malware_logs.id`) returns `400 Bad Request` — to omit an object's id, exclude the whole object instead.\n\nMutually exclusive with **inclusive-projection** — supplying both returns `400 Bad Request`. Unknown field names also return `400 Bad Request`. A maximum of 100 fields may be supplied.","required":false,"style":"form","explode":false,"schema":{"type":"array","items":{"type":"string"}},"example":["malware_logs"]}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Emails"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"schema":{"type":"string","format":"date-time"},"description":"Date and time when quota limit resets"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailsSample"}}}},"206":{"description":"Returns partial found data, with **errors** field on truncated records","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EmailSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0},"errors":{"type":"object","properties":{"body":{"type":"string"}},"description":"Contains errors signifying partial data"}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/email/lite":{"post":{"tags":["Email Intelligence"],"summary":"Lite Bulk Email Lookup","description":"Used for looking up email addresses and their data in bulk.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.\nIf a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned\nand the rest of its malware data truncated. Truncated data contains malware IDs that can be used\nto retrieve data using **data-source** endpoints*\n\n**Lite version of /email endpoint, which only includes credentials from malware logs.**\n\n**Rate limit: 100 per second.**","operationId":"emailLite","requestBody":{"content":{"application/json":{"schema":{"required":["data"],"type":"object","properties":{"emails_sha256":{"type":"array","description":"A list of SHA256 hashed lower-case email addresses to lookup","items":{"type":"string"},"example":["2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304"]},"limit":{"description":"Default is the maximum limit of 100 records","type":"integer","example":10},"offset":{"type":"integer","example":0}}}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailsLiteSample"}}}},"206":{"description":"Returns partial found data, with **errors** field on truncated records","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/paths/~1email/post/responses/206/content/application~1json/schema"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/email/databases":{"post":{"tags":["Email Intelligence","Breached Databases"],"summary":"Bulk email databases lookup","description":"Used for looking up email addresses and their databases in bulk.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n**Rate limit: 200 per second.**","operationId":"emailDatabases","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Emails"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailsDatabasesSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/email/malware-logs":{"post":{"tags":["Email Intelligence","Malware Logs Intelligence"],"summary":"Bulk email malware logs lookup","description":"Used for looking up email addresses and their malware logs in bulk.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.\nIf a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned\nand the rest of its malware data truncated. Truncated data contains malware IDs that can be used\nto retrieve data using **data-source** endpoints*\n\n**Rate limit: 10 per second.**","operationId":"emailMalwareLogs","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Emails"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailsMalwareLogsSample"}}}},"206":{"description":"Returns partial found data, with **errors** field on truncated records","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EmailMalwareLogsSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0},"errors":{"type":"object","properties":{"body":{"type":"string"}},"description":"Contains errors signifying partial data"}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/email/credential-lists":{"post":{"tags":["Email Intelligence","Credential Lists"],"summary":"Bulk email credential lists lookup","description":"Used for looking up email addresses and their credential lists in bulk.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n**Rate limit: 200 per second.**","operationId":"emailCredentialLists","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Emails"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailsCredentialListsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/email/password":{"post":{"tags":["Email Intelligence","Password Intelligence"],"summary":"Bulk email ATO prevention","description":"Used for looking up email addresses and their fuzzed passwords in bulk. Fuzzed passwords are passwords transformed according to pre-defined rules. The rule set, and thus the number of fuzzed passwords returned depends on the **fuzzing_intensity** parameter, which ranges from **0** to **10**, **0** being no fuzzing, only original password returned, and **10** being the biggest rule set that returns over 50,000 fuzzed passwords per original password.\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n**Rate limit: 100 per second.**","operationId":"emailAtoPrevention","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailsAto"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailsAtoPreventionSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}],"x-codegen-request-body-name":"payload"}},"/email/password/filtered":{"post":{"tags":["Email Intelligence","Password Intelligence"],"summary":"Single email ATO prevention with filtering","description":"Used for looking up an email address and its fuzzed passwords. Fuzzed passwords are passwords transformed according to pre-defined rules. The rule set, and thus the number of fuzzed passwords returned depends on the fuzzing_intensity parameter, which ranges from **0** to **10**, **0** being no fuzzing, only original password returned, and **10** being the biggest rule set that returns over 50,000 fuzzed passwords per original password.\nThis endpoint provides the ability to only return fuzzed passwords from specific sources from IDs provided in the body.\n**Rate limit: 50 per second.**","operationId":"singleEmailFilteredAtoPrevention","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailAtoFiltered"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailAtoPreventionSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}],"x-codegen-request-body-name":"payload"}},"/email/password/filtered/bulk":{"post":{"tags":["Email Intelligence","Password Intelligence"],"summary":"Bulk email ATO prevention","description":"Used for looking up email addresses and their fuzzed passwords in bulk. Fuzzed passwords are passwords transformed according to pre-defined rules. The rule set, and thus the number of fuzzed passwords returned depends on the **fuzzing_intensity** parameter, which ranges from **0** to **10**, **0** being no fuzzing, only original password returned, and **10** being the biggest rule set that returns over 50,000 fuzzed passwords per original password.\nThis endpoint provides the ability to only return fuzzed passwords from specific sources from IDs provided in the body.\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n**Rate limit: 10 per second.**","operationId":"emailFilteredAtoPrevention","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailsAtoFiltered"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailsAtoPreventionSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}],"x-codegen-request-body-name":"payload"}},"/email/statistics/{email-sha256}":{"get":{"tags":["Email Intelligence"],"summary":"Email statistics","description":"This API endpoint is designed for retrieving statistics associated with a specific email address.\nThe information regarding this email, including their associated data, is sourced and aggregated from\na multitude of databases that are publicly accessible on the internet.\n\nEach email can be affected by **three** incident types - data breaches, malware infections, and stolen credential lists.\n\n**Rate limit: 100 per second.**","operationId":"emailStatistics","parameters":[{"$ref":"#/components/parameters/Email"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailStatistics"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/email/domain/statistics/{domain}":{"get":{"tags":["Email Intelligence","Domain Intelligence"],"summary":"Email domain statistics","description":"This API endpoint is designed for retrieving statistics associated with all email addresses under a specific domain.\nThe information regarding these email addresses, including their associated data, is sourced and aggregated from\na multitude of databases that are publicly accessible on the internet.\n\nEach email can be affected by **three** incident types - data breaches, malware infections, and stolen credential lists.\n\n**Rate limit: 10 per second.**","operationId":"emailDomainStatistics","parameters":[{"$ref":"#/components/parameters/Domain"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailStatistics"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/email/domain/blacklist":{"get":{"tags":["Email Intelligence","Domain Intelligence"],"summary":"Email domain blacklist","description":"This API endpoint is designed to retrieve a list of public email \ndomains that are blacklisted and cannot be used for domain lookup or subscription operations.\n\n**Rate limit: 20 per second.**","operationId":"emailDomainBlacklist","parameters":[{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/Offset"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"string"},"example":["example.com","gmail.com"]}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/phone/{phone-sha256}":{"get":{"tags":["Phone Intelligence"],"summary":"Phone lookup","description":"Used for looking up phone numbers and their data.\nThese phone numbers and their data have been collected and aggregated from various databases openly accessible on the internet.\n\n**Rate limit: 200 per second.**","operationId":"singlePhone","parameters":[{"$ref":"#/components/parameters/Phone"},{"$ref":"#/paths/~1email/post/parameters/0"},{"$ref":"#/paths/~1email/post/parameters/1"},{"$ref":"#/paths/~1email/post/parameters/2"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PhoneSample"}}}},"206":{"description":"Returns partial found data, with **errors** field on truncated records","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","example":"631dadc9288c13b61bb83c480292c11154b35b5bb777a4946980de62f70477eb"},"phone":{"type":"string","example":"13855550193","description":"International format phone number"},"databases":{"type":"array","items":{"$ref":"#/components/schemas/DatabaseDataItem"}},"malware_logs":{"type":"array","items":{"$ref":"#/components/schemas/MalwareDataItem"}},"errors":{"type":"object","properties":{"body":{"type":"string"}},"description":"Contains errors signifying partial data"}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/phone/{phone-sha256}/databases":{"get":{"tags":["Phone Intelligence","Breached Databases"],"summary":"Phone databases lookup","description":"Used for looking up phone numbers and their databases.\nThese phone numbers and their data have been collected and aggregated from various databases openly accessible on the internet.\n\n**Rate limit: 200 per second.**","operationId":"singlePhoneDatabases","parameters":[{"$ref":"#/components/parameters/Phone"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PhoneDatabasesSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/phone/{phone-sha256}/malware-logs":{"get":{"tags":["Phone Intelligence","Malware Logs Intelligence"],"summary":"Phone malware logs lookup","description":"Used for looking up phone numbers and their malware logs.\nThese phone numbers and their data have been collected and aggregated from various databases openly accessible on the internet.\n\n**Rate limit: 200 per second.**","operationId":"singlePhoneMalwareLogs","parameters":[{"$ref":"#/components/parameters/Phone"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PhoneMalwareLogsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/phone":{"post":{"tags":["Phone Intelligence"],"summary":"Bulk phone lookup","description":"Used for looking up phones numbers and their data in bulk.\nThese phone numbers and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.\nIf a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned\nand the rest of its malware data truncated. Truncated data contains malware IDs that can be used\nto retrieve data using **data-source** endpoints*\n\n**Rate limit: 200 per second.**","operationId":"phone","parameters":[{"$ref":"#/paths/~1email/post/parameters/0"},{"$ref":"#/paths/~1email/post/parameters/1"},{"$ref":"#/paths/~1email/post/parameters/2"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Phone"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PhonesSample"}}}},"206":{"description":"Returns partial found data, with **errors** field on truncated records","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/PhoneSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0},"errors":{"type":"object","properties":{"body":{"type":"string"}},"description":"Contains errors signifying partial data"}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/phone/databases":{"post":{"tags":["Phone Intelligence","Breached Databases"],"summary":"Bulk phone databases lookup","description":"Used for looking up phones numbers and their databases in bulk.\nThese phone numbers and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n**Rate limit: 200 per second.**","operationId":"phonesDatabases","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Phone"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PhonesDatabasesSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/phone/malware-logs":{"post":{"tags":["Phone Intelligence","Malware Logs Intelligence"],"summary":"Bulk phone malware logs lookup","description":"Used for looking up phones numbers and their malware logs in bulk.\nThese phone numbers and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.\nIf a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned\nand the rest of its malware data truncated. Truncated data contains malware IDs that can be used\nto retrieve data using **data-source** endpoints*\n\n**Rate limit: 200 per second.**","operationId":"phonesMalwareLogs","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Phone"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PhonesMalwareLogsSample"}}}},"206":{"description":"Returns partial found data, with **errors** field on truncated records","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/PhoneMalwareLogsSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0},"errors":{"type":"object","properties":{"body":{"type":"string"}},"description":"Contains errors signifying partial data"}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/database/{id}":{"get":{"tags":["Breached Databases"],"summary":"Database Lookup","description":"Used to look up breached databases, that are publicly accessible on the internet, and their metadata.\nThese databases may have been collected from both clearnet and deep/dark web.\nThe breach date of these databases is by no means exact, since, if no official statement by the breached company is made, it is taken from the data publication source, be it a hacker forum, a ransomware group website or some place else.\nDatabase description can not exceed 1000 characters.\n\n**Rate limit: 200 per second.**","operationId":"database","parameters":[{"$ref":"#/components/parameters/HexId"},{"$ref":"#/paths/~1data-source~1database/post/parameters/0"},{"$ref":"#/paths/~1data-source~1database/post/parameters/1"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DatabaseSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/database/domain/{domain}":{"get":{"tags":["Breached Databases","Domain Intelligence"],"summary":"Database Lookup by Domain","description":"Used to look up breached databases, that are publicly accessible on the internet, and their metadata.\nThese databases may have been collected from both clearnet and deep/dark web.\nThe breach date of these databases is by no means exact, since, if no official statement by the breached company is made, it is taken from the data publication source, be it a hacker forum, a ransomware group website or some place else.\nDatabase description can not exceed 1000 characters. \n\n**Rate limit: 200 per second.**","operationId":"databaseByDomain","parameters":[{"$ref":"#/components/parameters/Domain"},{"$ref":"#/paths/~1data-source~1database/post/parameters/0"},{"$ref":"#/paths/~1data-source~1database/post/parameters/1"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DatabaseSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/database":{"post":{"tags":["Breached Databases"],"summary":"Bulk databases lookup","description":"Used to look up breached databases, that are publicly accessible on the internet, and their metadata in bulk.\nThese databases may have been collected from both clearnet and deep/dark web.\nThe breach date of these databases is by no means exact, since, if no official statement by the breached company is made, it is taken from the data publication source, be it a hacker forum, a ransomware group website or some place else.\nDatabase description can not exceed 1000 characters.\n\n**One of the following fields in request body is required: ids, date_from**\n\nThe databases can be lookuped **either** by **id** or by **published_date**. If **ids** are provided, the lookup is executed using them. If you wish to lookup databases by **published_date**, fill in **published_date_from**, **published_date_to** and leave **ids** empty or absent.\n**Providing both ids and published_date_from or published_date_to will result in 400 BAD REQUEST response.**\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n**Rate limit: 200 per second.**","operationId":"databases","parameters":[{"name":"inclusive-projection","in":"query","description":"Return **only** the listed fields of the database record, omitting everything else.\n\nValues are a comma-separated list (`?inclusive-projection=name,breach_date`) or repeated parameters (`?inclusive-projection=name&inclusive-projection=breach_date`).\n\n**Available fields:** `id`, `name`, `identifier`, `type`, `domain`, `breach_date`, `description`, `logo_url`, `data_keys`, `unique_email_count`, `unique_phone_count`, `published` (controls the `published_date` response field).\n\nOnly the listed fields are returned — there are no implicit includes beyond the always-present `id`.\n\n**`id` is special:** it is always present and may be named explicitly, but it can never be excluded.\n\nMutually exclusive with **exclusive-projection** — supplying both returns `400 Bad Request`. Unknown field names also return `400 Bad Request`. A maximum of 100 fields may be supplied.","required":false,"style":"form","explode":false,"schema":{"type":"array","items":{"type":"string"}},"example":["name","breach_date"]},{"name":"exclusive-projection","in":"query","description":"Return the full database record **except** the listed fields.\n\nValues are a comma-separated list (`?exclusive-projection=data_keys,description`) or repeated parameters (`?exclusive-projection=data_keys&exclusive-projection=description`).\n\n**Available fields:** `name`, `identifier`, `type`, `domain`, `breach_date`, `description`, `logo_url`, `data_keys`, `unique_email_count`, `unique_phone_count`, `published` (controls the `published_date` response field).\n\n**`id` cannot be excluded** — supplying `id` returns `400 Bad Request`.\n\nMutually exclusive with **inclusive-projection** — supplying both returns `400 Bad Request`. Unknown field names also return `400 Bad Request`. A maximum of 100 fields may be supplied.","required":false,"style":"form","explode":false,"schema":{"type":"array","items":{"type":"string"}},"example":["data_keys"]}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Databases"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DatabasesSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"413":{"description":"Too many emails on single request","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/credential-list/{id}":{"get":{"tags":["Credential Lists"],"summary":"Credential list Lookup","description":"Used to look up credential lists that are publicly accessible on the internet, and their metadata.\nThese credential lists may have been collected from both clearnet and deep/dark web.\nThe origin of these credential lists is not known, they might have been collected from breached databases, by stuffing attacks or other means.\n\n**Rate limit: 200 per second.**","operationId":"credentialList","parameters":[{"$ref":"#/components/parameters/HexId"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CredentialListSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/credential-list":{"post":{"tags":["Credential Lists"],"summary":"Bulk credential lists lookup","description":"Used to look up credential lists that are publicly accessible on the internet, and their metadata in bulk.\nThese credential lists may have been collected from both clearnet and deep/dark web.\nThe origin of these credential lists is not known, they might have been collected from breached databases, by stuffing attacks or other means.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n**Rate limit: 200 per second.**","operationId":"credentialLists","requestBody":{"content":{"application/json":{"schema":{"required":["ids"],"type":"object","properties":{"ids":{"type":"array","description":"A list of credential list IDs to lookup.\nID should consist of 24 hexadecimal digits.","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CredentialListsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"413":{"description":"Too many lists on single request","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/malware-log/{id}":{"get":{"tags":["Malware Logs Intelligence"],"summary":"Malware Log Lookup","description":"Used to look up malware logs that are publicly accessible on the internet, and their metadata.\nThese malware logs may have been collected from both clearnet and deep/dark web.\nEach malware log record pertains to a particular instance of infection and contains data gathered from the affected machine at the time of the attack.\n\nThe returned sections can be narrowed using the **inclusive-projection** and **exclusive-projection** query parameters\n(see the parameter descriptions for the available sections, e.g. `credentials`, `cookies`, `secrets`).\n\n**Rate limit: 200 per second.**","operationId":"malwareLog","parameters":[{"$ref":"#/components/parameters/HexId"},{"$ref":"#/paths/~1data-source~1malware-log/post/parameters/0"},{"$ref":"#/paths/~1data-source~1malware-log/post/parameters/1"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MalwareDataItem"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/malware-log":{"post":{"tags":["Malware Logs Intelligence"],"summary":"Bulk Malware Log Lookup","description":"Used to look up malware logs that are publicly accessible on the internet, and their metadata.\nThese malware logs may have been collected from both clearnet and deep/dark web.\nEach malware log record pertains to a particular instance of infection and contains data gathered from the affected machine at the time of the attack.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\nThe returned sections can be narrowed using the **inclusive-projection** and **exclusive-projection** query parameters\n(see the parameter descriptions for the available sections, e.g. `credentials`, `cookies`, `secrets`).\n\n**Rate limit: 200 per second.**","operationId":"malwareLogs","parameters":[{"name":"inclusive-projection","in":"query","description":"Return **only** the listed fields of each malware log, omitting everything else. Useful for trimming large responses (malware logs can be very large) and reducing payload size.\n\nValues are a comma-separated list (`?inclusive-projection=credentials,cookies`) or repeated parameters (`?inclusive-projection=credentials&inclusive-projection=cookies`).\n\n**Available fields:** `id`, `identifier`, `type`, `system_info`, `identification_level`, `credentials`, `credit_cards`, `cookies`, `autofills`, `grabbed_files`, `secrets`, `metadata`, `ftp`, `installed_software`, `process_list`, `rdp`, `rac`, `ssh`, `vpn`, `email_clients`, `downloads`.\n\nOnly the listed fields are returned — there are no implicit includes beyond the always-present `id`.\n\n**`id` is special:** it is always present and may be named explicitly, but it can never be excluded.\n\nMutually exclusive with **exclusive-projection** — supplying both returns `400 Bad Request`. Unknown field names also return `400 Bad Request`. A maximum of 100 fields may be supplied.","required":false,"style":"form","explode":false,"schema":{"type":"array","items":{"type":"string"}},"example":["credentials","cookies"]},{"name":"exclusive-projection","in":"query","description":"Return each full malware log **except** the listed fields. Useful for dropping heavy parts of the response (e.g. excluding cookies or grabbed files) while keeping everything else.\n\nValues are a comma-separated list (`?exclusive-projection=cookies,grabbed_files`) or repeated parameters (`?exclusive-projection=cookies&exclusive-projection=grabbed_files`).\n\n**Available fields:** `identifier`, `type`, `system_info`, `identification_level`, `credentials`, `credit_cards`, `cookies`, `autofills`, `grabbed_files`, `secrets`, `metadata`, `ftp`, `installed_software`, `process_list`, `rdp`, `rac`, `ssh`, `vpn`, `email_clients`, `downloads`.\n\n**`id` cannot be excluded** — supplying `id` returns `400 Bad Request`.\n\nMutually exclusive with **inclusive-projection** — supplying both returns `400 Bad Request`. Unknown field names also return `400 Bad Request`. A maximum of 100 fields may be supplied.","required":false,"style":"form","explode":false,"schema":{"type":"array","items":{"type":"string"}},"example":["cookies","grabbed_files"]}],"requestBody":{"content":{"application/json":{"schema":{"required":["ids"],"type":"object","properties":{"ids":{"type":"array","description":"A list of malware log IDs to lookup.\nID should consist of 24 hexadecimal digits.","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]},"limit":{"description":"Default is the maximum limit of 20 records","type":"integer","example":10},"offset":{"type":"integer","example":0}}}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MalwareLogsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"413":{"description":"Too many logs on single request","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/malware-log/details":{"post":{"tags":["Malware Logs Intelligence"],"summary":"Bulk Malware Log Details Lookup","description":"Used to look up malware log details (identifier, malware type, published date, updated date and system information) for a list of malware log IDs.\nReturns a lightweight representation of each malware log, including the identifier, type, published date, updated date, and system information.\nThis endpoint does not return the full malware log data (credentials, cookies, etc.).\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n**Rate limit: 200 per second.**","operationId":"malwareLogDetails","requestBody":{"content":{"application/json":{"schema":{"required":["ids"],"type":"object","properties":{"ids":{"type":"array","description":"A list of malware log IDs to lookup details for.\nID should consist of 24 hexadecimal digits.","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]},"limit":{"description":"Default is the maximum limit of 500 records","type":"integer","example":10},"offset":{"type":"integer","example":0}}}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"identifier":{"type":"string","description":"Malware identifier","example":"US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]"},"id":{"type":"string","description":"Systemic hex ID of the record","example":"678e9e47098d6b3b44f75ec8"},"type":{"type":"string","description":"Name of the infostealer","example":"risepro"},"published_date":{"type":"string","description":"Date that malware log has been published","example":"2025-01-20T19:04:39Z"},"updated_date":{"type":"string","description":"Date that malware log has been last updated","example":"2025-02-15T12:30:00Z"},"system_info":{"$ref":"#/components/schemas/MalwareLogSystemInfoSampleItem"}}}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"413":{"description":"Too many logs on single request","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/malware-log/stats":{"post":{"tags":["Malware Logs Intelligence"],"summary":"Bulk Malware Log Statistics Lookup","description":"Returns the number of records held in each data category of a malware log, without returning the records themselves.\n\nFor a set of malware log identifiers, each result reports how many credentials, cookies, autofills, credit cards, secrets and other artifacts were recovered from the infected machine, together with its system information, metadata and identification level. This offers a lightweight way to assess the size and composition of a malware log before retrieving its full contents.\n\n**Rate limit: 200 per second.**","operationId":"malwareLogStatistics","requestBody":{"content":{"application/json":{"schema":{"required":["ids"],"type":"object","properties":{"ids":{"type":"array","description":"A list of malware log IDs to look up statistics for. Up to 500 IDs per request.\nID should consist of 24 hexadecimal digits.","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]}}}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"identifier":{"type":"string","description":"Malware identifier composed by malicious code","example":"US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]"},"id":{"type":"string","description":"Systemic hex ID of the record","example":"678e9e47098d6b3b44f75ec8"},"type":{"type":"string","description":"Name or brand of the infostealer (may be empty or unknown)","example":"risepro"},"published_date":{"type":"string","description":"Date that malware log has been published","example":"2025-01-20T19:04:39Z"},"statistics":{"type":"object","description":"Number of records recovered in each data category","properties":{"credentials_count":{"type":"integer","example":42},"cookies_count":{"type":"integer","example":1337},"autofills_count":{"type":"integer","example":12},"grabbed_files_count":{"type":"integer","example":87},"credit_cards_count":{"type":"integer","example":0},"secrets_count":{"type":"integer","example":3},"ftp_count":{"type":"integer","example":0},"installed_software_count":{"type":"integer","example":65},"process_list_count":{"type":"integer","example":120},"rdp_count":{"type":"integer","example":0},"rac_count":{"type":"integer","example":0},"vpn_count":{"type":"integer","example":1},"email_clients_count":{"type":"integer","example":2},"downloads_count":{"type":"integer","example":5},"ssh_keys_count":{"type":"integer","example":4},"ssh_known_hosts_count":{"type":"integer","example":9}}},"system_info":{"$ref":"#/components/schemas/MalwareLogSystemInfoSampleItem"},"metadata":{"type":"object","properties":{"incident_date":{"type":"string","example":"2021-05-26T08:19:13Z"},"emails":{"type":"array","items":{"type":"string","example":"example@example.com"}},"phones":{"type":"array","items":{"type":"string","example":"15551234567"}},"ips":{"type":"array","items":{"type":"string","example":"203.0.113.42"}},"hardware_id":{"type":"string","example":"89f3221e-2138-48c9-bbe2-8f68-806e6f6e6963"},"machine_id":{"type":"string","example":"89f3221e-2138-48c9-bbe2-ab615454c7ef"},"country":{"type":"string","example":"US"}}},"identification_level":{"type":"string","description":"Indicates how well the system information was identified during parsing. Empty string when value was not set","enum":["","identified","partially_identified","unidentified"],"example":"identified"}}}}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/malware-log/credentials/url/{credentials_url}/id":{"get":{"tags":["Malware Logs Intelligence"],"summary":"Malware Log IDs Lookup","description":"Used to look up malware logs ids that contains specified url domain/subdomain values in their credentials.\n\nNote that  domain/subdomain values need to be exact match. That means for example:\nIf 'domain.com' is given in the request. The response credentials will not contain 'subdomain.domain.com'. \nFor those cases, 'subdomain.domain.com' should be given in the request.\n\nThe request data requires pagination object. Pagination behaviour can be modified using **limit** and **offset** parameters.\nDefault is the maximum limit of 2000. \n\n**Rate limit: 200 per second.**","operationId":"malwareLogIdsByCred","parameters":[{"$ref":"#/components/parameters/Url"},{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/Offset"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"credentials_url":{"type":"string","example":"example.com"},"malware_log_ids":{"type":"array","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/malware-log/{id}/credentials/url/{credentials_url}":{"get":{"tags":["Malware Logs Intelligence"],"summary":"Malware Log Credentials Lookup","description":"Used to look up a malware log by ID and credential url. \nThe credentials of the malware will be filtered out to match the request url by domain/subdomain.\n\nNote that  domain/subdomain values need to be exact match. That means for example:\nIf 'domain.com' is given in the request. The response credentials will not contain 'subdomain.domain.com'. \nFor those cases, 'subdomain.domain.com' should be given in the request.\n\n**Rate limit: 200 per second.**","operationId":"malwareLogByCred","parameters":[{"$ref":"#/components/parameters/HexId"},{"$ref":"#/components/parameters/Url"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"identifier":{"type":"string","description":"Malware identifier composed by malicious code","example":"US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]"},"id":{"type":"string","description":"Systemic hex ID of the record","example":"678e9e47098d6b3b44f75ec8"},"incident_date":{"type":"string","description":"Date of the infection","example":"2025-01-20T19:04:39Z"},"published_date":{"type":"string","description":"Date that malware log has been published","example":"2025-01-20T19:04:39Z"},"credentials":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string","example":"https://login.example.com/path/to/login"},"cleaned_url":{"type":"string","example":"login.example.com"},"username":{"type":"string","example":"username"},"email":{"type":"string","example":"example@example.com"},"password":{"type":"string","example":"password1"},"application":{"type":"string","example":"Google Chrome"}}}},"system_info":{"$ref":"#/components/schemas/MalwareLogSystemInfoSampleItem"}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/malware-log/secrets/type/{type}/id":{"get":{"tags":["Malware Logs Intelligence"],"summary":"Malware Log IDs With Secrets Lookup","description":"Used to look up malware logs ids that contains specified secret type values in their secrets list.\n    \n**Rate limit: 200 per second.**","operationId":"malwareLogIdsBySecret","parameters":[{"$ref":"#/components/parameters/SecretType"},{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/Offset"},{"$ref":"#/components/parameters/PublishedTsFrom"},{"$ref":"#/components/parameters/PublishedTsTo"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/paths/~1data-source~1malware-log~1secrets~1type~1id/get/responses/200/content/application~1json/schema"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/malware-log/{id}/secrets/type/{type}":{"get":{"tags":["Malware Logs Intelligence"],"summary":"Malware Log Secrets Lookup","description":"Used to look up a malware log by ID and secret type. \nThe secrets of the malware will be filtered out to match the secret type.\n    \nThe request data requires pagination object. Pagination behaviour can be modified using **limit** and **offset** parameters.\nDefault is the maximum limit of 2000. \n\n**Rate limit: 200 per second.**","operationId":"malwareLogBySecret","parameters":[{"$ref":"#/components/parameters/HexId"},{"$ref":"#/components/parameters/SecretType"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MalwareLogSecretSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/malware-log/secrets/type/id":{"get":{"tags":["Malware Logs Intelligence"],"summary":"Malware Log IDs With Unspecified Secrets Lookup","description":"Used to look up malware logs ids that contains any secrets types.\n\n**Rate limit: 200 per second.**","operationId":"malwareLogIdsWithSecrets","parameters":[{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/Offset"},{"$ref":"#/components/parameters/PublishedTsFrom"},{"$ref":"#/components/parameters/PublishedTsTo"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"type":{"type":"string","example":"aws-access-token"},"malware_log_ids":{"type":"array","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/malware-log/{id}/secrets/type":{"get":{"tags":["Malware Logs Intelligence"],"summary":"Malware Log Unspecified Secrets Lookup","description":"Used to look up a malware log by ID. \nThe secret list of the log will not be filtered.\n    \nThe request data requires pagination object. Pagination behaviour can be modified using **limit** and **offset** parameters.\nDefault is the maximum limit of 2000. \n\n**Rate limit: 200 per second.**","operationId":"malwareLogWithSecrets","parameters":[{"$ref":"#/components/parameters/HexId"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MalwareLogSecretSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/malware-log/secrets/feed":{"post":{"tags":["Malware Logs Intelligence"],"summary":"Malware Log Secrets Feed","description":"\nUsed to get a feed of malware logs secrets based on specified secret type(s) & date ranges.\nDates can be specified either with exact values (range) or relative value (lookback days).\nIf no secret values are specified, all secret types will be returned.\n\nThe data is returned using pagination by default, \npagination behaviour can be modified using **limit** and **offset** parameters.\n\n**Rate limit: 200 per second.**","operationId":"malwareLogsSecretsFeed","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"published_ts_from":{"description":"Unix timestamp of the earliest published date to include in the results","type":"integer","example":1747186400},"published_ts_to":{"description":"Unix timestamp of the latest published date to include in the results","type":"integer","example":1747186400},"lookback_days":{"description":"Lookback days to include in the results (max 180)","type":"integer","example":15},"types":{"type":"array","description":"Any of the following: \n  - 1password-secret-key\n  - 1password-service-account-token\n  - adafruit-api-key\n  - adobe-client-id\n  - adobe-client-secret\n  - age-secret-key\n  - airtable-api-key\n  - airtable-personnal-access-token\n  - algolia-api-key\n  - alibaba-access-key-id\n  - alibaba-secret-key\n  - anthropic-admin-api-key\n  - anthropic-api-key\n  - artifactory-api-key\n  - artifactory-reference-token\n  - asana-client-id\n  - asana-client-secret\n  - assemblyai-api-key\n  - atlassian-api-token\n  - authress-service-client-access-key\n  - aws-access-token\n  - aws-amazon-bedrock-api-key-long-lived\n  - aws-amazon-bedrock-api-key-short-lived\n  - aws-secret-key\n  - azure-ad-client-secret\n  - beamer-api-token\n  - bitbucket-client-id\n  - bitbucket-client-secret\n  - bittrex-access-key\n  - bittrex-secret-key\n  - cerebras-api-key\n  - cisco-meraki-api-key\n  - clickhouse-cloud-api-secret-key\n  - clojars-api-token\n  - cloudflare-api-key\n  - cloudflare-global-api-key\n  - cloudflare-origin-ca-key\n  - codecov-access-token\n  - cohere-api-token\n  - coinbase-access-token\n  - confluent-access-token\n  - confluent-secret-key\n  - contentful-delivery-api-token\n  - curl-auth-header\n  - curl-auth-user\n  - cursor-api-key\n  - databricks-api-token\n  - datadog-access-token\n  - deepgram-api-key\n  - deepseek-api-key\n  - defined-networking-api-token\n  - digitalocean-access-token\n  - digitalocean-pat\n  - digitalocean-refresh-token\n  - discord-api-token\n  - discord-client-id\n  - discord-client-secret\n  - doppler-api-token\n  - droneci-access-token\n  - dropbox-api-token\n  - dropbox-long-lived-api-token\n  - dropbox-short-lived-api-token\n  - duffel-api-token\n  - dynatrace-api-token\n  - easypost-api-token\n  - easypost-test-api-token\n  - elevenlabs-api-key\n  - endorlabs-api-key\n  - endorlabs-api-secret\n  - etsy-access-token\n  - facebook-access-token\n  - facebook-page-access-token\n  - facebook-secret\n  - fastly-api-token\n  - figma-personal-access-header-token\n  - figma-personal-access-token\n  - finicity-api-token\n  - finicity-client-secret\n  - finnhub-access-token\n  - flickr-access-token\n  - flutterwave-encryption-key\n  - flutterwave-public-key\n  - flutterwave-secret-key\n  - flyio-access-token\n  - frameio-api-token\n  - freemius-secret-key\n  - freshbooks-access-token\n  - gcp-api-key\n  - gcp-service-account-json\n  - gitea-access-token\n  - github-app-token\n  - github-fine-grained-pat\n  - github-oauth\n  - github-pat\n  - github-refresh-token\n  - gitlab-cicd-job-token\n  - gitlab-deploy-token\n  - gitlab-feature-flag-client-token\n  - gitlab-feed-token\n  - gitlab-kubernetes-agent-token\n  - gitlab-oauth-app-secret\n  - gitlab-pat\n  - gitlab-pat-routable\n  - gitlab-ptt\n  - gitlab-rrt\n  - gitlab-runner-authentication-token\n  - gitlab-runner-authentication-token-routable\n  - gitlab-scim-token\n  - gitlab-session-cookie\n  - gitter-access-token\n  - gocardless-api-token\n  - grafana-api-key\n  - grafana-cloud-api-token\n  - grafana-service-account-token\n  - greptile-api-key\n  - groq-api-key\n  - harness-api-key\n  - hashicorp-tf-api-token\n  - hashicorp-tf-password\n  - heroku-api-key\n  - hubspot-api-key\n  - huggingface-access-token\n  - huggingface-organization-api-token\n  - infracost-api-token\n  - intercom-api-key\n  - intra42-client-secret\n  - jfrog-api-key\n  - jfrog-identity-token\n  - kraken-access-token\n  - kubernetes-secret-yaml\n  - kucoin-access-token\n  - kucoin-secret-key\n  - launchdarkly-access-token\n  - linear-api-key\n  - linear-client-secret\n  - linkedin-client-id\n  - linkedin-client-secret\n  - lob-api-key\n  - lob-pub-api-key\n  - looker-client-id\n  - looker-client-secret\n  - mailchimp-api-key\n  - mailgun-private-api-token\n  - mailgun-pub-key\n  - mailgun-signing-key\n  - mapbox-api-token\n  - mattermost-access-token\n  - maxmind-license-key\n  - messagebird-api-token\n  - messagebird-client-id\n  - microsoft-teams-webhook\n  - mistral-api-key\n  - mongodb-atlas-service-account-id\n  - mongodb-atlas-service-account-secret\n  - mongodb-connection-string\n  - netlify-access-token\n  - new-relic-browser-api-token\n  - new-relic-insert-key\n  - new-relic-user-api-id\n  - new-relic-user-api-key\n  - nexos-ai-user-api-key\n  - npm-access-token\n  - nuget-config-password\n  - nvidia-api-key\n  - nytimes-access-token\n  - octopus-deploy-api-key\n  - okta-access-token\n  - ollama-api-key\n  - openai-api-key\n  - openrouter-api-key\n  - openshift-user-token\n  - ovh-application-key\n  - ovh-application-secret\n  - ovh-consumer-key\n  - perplexity-api-key\n  - pkcs12-file\n  - plaid-api-token\n  - plaid-client-id\n  - plaid-secret-key\n  - planetscale-api-token\n  - planetscale-id\n  - planetscale-oauth-token\n  - planetscale-password\n  - polymarket-address\n  - polymarket-api-key\n  - polymarket-api-secret\n  - polymarket-passphrase\n  - polymarket-private-key\n  - posthog-personal-api-key\n  - posthog-project-api-key\n  - postman-api-token\n  - prefect-api-token\n  - private-key\n  - privateai-api-token\n  - pulumi-api-token\n  - pypi-upload-token\n  - rapidapi-access-token\n  - readme-api-token\n  - replicate-api-token\n  - rubygems-api-token\n  - scalingo-api-token\n  - sendbird-access-id\n  - sendbird-access-token\n  - sendgrid-api-token\n  - sendinblue-api-token\n  - sentry-access-token\n  - sentry-org-token\n  - sentry-user-token\n  - settlemint-application-access-token\n  - settlemint-personal-access-token\n  - settlemint-service-access-token\n  - shippo-api-token\n  - shopify-access-token\n  - shopify-custom-access-token\n  - shopify-private-app-access-token\n  - shopify-shared-secret\n  - sidekiq-secret\n  - sidekiq-sensitive-url\n  - slack-app-token\n  - slack-bot-token\n  - slack-config-access-token\n  - slack-config-refresh-token\n  - slack-legacy-bot-token\n  - slack-legacy-token\n  - slack-legacy-workspace-token\n  - slack-session-cookie\n  - slack-session-token\n  - slack-user-token\n  - slack-webhook-url\n  - snyk-api-token\n  - sonar-api-token\n  - sourcegraph-access-token\n  - square-access-token\n  - squarespace-access-token\n  - stability-ai-api-key\n  - stripe-access-token\n  - sumologic-access-id\n  - sumologic-access-token\n  - telegram-bot-api-token\n  - togetherai-api-key\n  - travisci-access-token\n  - twilio-api-key\n  - twitch-api-token\n  - twitter-access-secret\n  - twitter-access-token\n  - twitter-api-key\n  - twitter-api-secret\n  - twitter-bearer-token\n  - typeform-api-token\n  - vault-batch-token\n  - vault-service-token\n  - vercel-ai-gateway-key\n  - vercel-api-token\n  - vercel-app-access-token\n  - vercel-app-refresh-token\n  - vercel-integration-token\n  - vercel-personal-access-token\n  - weights-and-biases-api-key\n  - weights-and-biases-api-key-v1\n  - xai-api-key\n  - yandex-access-token\n  - yandex-api-key\n  - yandex-aws-access-token\n  - zendesk-secret-key","items":{"type":"string"},"example":["aws-access-token","stripe-access-token"]},"limit":{"description":"Default is the maximum limit of 100 records","type":"integer","example":10},"offset":{"type":"integer","example":0},"last_id":{"description":"A faster pagination alternative to offset. Set this instead of offset to get response for further pages quicker.","type":"string","example":"655f334bca9e4393edf56f0b"}}}}}},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MalwareLogsSecretsFeedSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/data-source/malware-log/credentials/feed":{"post":{"tags":["Malware Logs Intelligence"],"summary":"Malware Log Credentials Feed","description":"\nUsed to get a feed of malware logs credentials based on specified date ranges.\nDates can be specified either with exact values (range) or relative value (lookback days).\n\nBecause some malware logs can contain an abnormally large number of credentials,\nthe number of credentials returned is capped. When the cap is reached the response\ncontains fewer malware logs than the pagination limit and is returned with HTTP\nstatus **206 Partial Content**. Continue paging (using the id of the last returned\nrecord as **last_id**) to retrieve the remainder.\n\nThe data is returned using pagination by default,\npagination behaviour can be modified using **limit** and **offset** parameters.\n\n**Rate limit: 200 per second.**","operationId":"malwareLogsCredentialsFeed","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"published_ts_from":{"description":"Unix timestamp of the earliest published date to include in the results","type":"integer","example":1747186400},"published_ts_to":{"description":"Unix timestamp of the latest published date to include in the results","type":"integer","example":1747186400},"lookback_days":{"description":"Lookback days to include in the results (max 180)","type":"integer","example":15},"limit":{"description":"Default is the maximum limit of 100 records","type":"integer","example":10},"offset":{"type":"integer","example":0},"last_id":{"description":"A faster pagination alternative to offset. Set this instead of offset to get response for further pages quicker.","type":"string","example":"655f334bca9e4393edf56f0b"},"domain":{"description":"Filter the credentials for a specific domain target.","type":"string","example":"example.com"}}}}}},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"identifier":{"type":"string","description":"Malware identifier composed by malicious code","example":"US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]"},"id":{"type":"string","description":"Systemic hex ID of the record","example":"678e9e47098d6b3b44f75ec8"},"type":{"type":"string","description":"Name or brand of the infostealer (may be empty or unknown)","example":"risepro"},"incident_date":{"type":"string","description":"Date of the infection","example":"2025-01-20T19:04:39Z"},"published_date":{"type":"string","description":"Date that malware log has been published","example":"2025-01-22T19:04:39Z"},"credentials":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string","example":"https://login.example.com/path/to/login"},"cleaned_url":{"type":"string","example":"login.example.com"},"username":{"type":"string","example":"username"},"email":{"type":"string","example":"example@example.com"},"password":{"type":"string","example":"password1"},"application":{"type":"string","example":"Google Chrome"}}}},"system_info":{"$ref":"#/components/schemas/MalwareLogSystemInfoSampleItem"}}}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}}}}},"206":{"description":"Partial content. The credential cap was reached, so fewer malware logs than the pagination limit are returned. Continue paging with last_id to retrieve the remainder.","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/paths/~1data-source~1malware-log~1credentials~1feed/post/responses/200/content/application~1json/schema"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/password/{hash-type}/{hash-range}":{"get":{"tags":["Password Intelligence"],"summary":"Passwords search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nUsed for checking if the password has been compromised previously. The\nrequest must include first 6 characters of the password, hashed using\n**SHA-256** algorithm.\n\nHashed passwords are returned in a response that start with the filter characters provided in the request.\n**Rate limit: 200 per second.**","operationId":"passwordsSearch","parameters":[{"name":"hash-type","in":"path","required":true,"description":"Currently only **sha256**","schema":{"type":"string"}},{"$ref":"#/components/parameters/HashRange"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgePasswordSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/password":{"post":{"tags":["Password Intelligence"],"summary":"Bulk passwords search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nUsed for checking if the password has been compromised previously. The\nrequest must include first 6 characters of the password, hashed using\n**SHA-256** algorithm.\n\nHashed passwords are returned in a response that start with the filter characters provided in the request.\n**Rate limit: 200 per second.**","operationId":"passwordsBulkSearch","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasswordHashRangesSample"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgePasswordSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/cookie/{hash-type}/{hash-range}":{"get":{"tags":["Cookie Intelligence"],"summary":"Cookies search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nUsed for checking if the specific cookie has been compromised. The\nrequest must include first 8 characters of the *cookie* value, hashed using\n**SHA-256** algorithm.\n\nHashed cookies are returned in a response that start with the filter characters provided in the request.\n**Rate limit: 1000 per second.**","operationId":"cookiesSearch","parameters":[{"name":"hash-type","in":"path","required":true,"description":"Currently only **sha256**","schema":{"type":"string"}},{"$ref":"#/components/parameters/HashRange"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeCookiesSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/cookie":{"post":{"tags":["Cookie Intelligence"],"summary":"Bulk cookies search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nUsed for checking if the specific cookie has been compromised. The\nrequest must include an array of first 8 characters of the *cookie value*, hashed using\n**SHA-256** algorithm.\n\nHashed cookies are returned in a response that start with the filter characters provided in the request.\nOne request may have up to *100* hash ranges.\n\n**Rate limit: 500 per second.**","operationId":"cookiesBulkSearch","requestBody":{"content":{"application/json":{"schema":{"required":["data"],"type":"object","properties":{"hash_ranges":{"type":"array","description":"A list of hash ranges (8 hexadecimal characters) to lookup zero knowledge data","items":{"type":"string"},"example":["00000000","ffffffff"]}}}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeCookiesSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/salt/{sha256-prefix}":{"get":{"tags":["Credit Card Intelligence","National Identification Number Intelligence","Utility Endpoints"],"summary":"Generates a salt based on the provided input data","description":"A specific salt is required to successfully use zero knowledge credit card and national identification number lookups.\n\nTo get a salt, hash lookup value (CC or NIN) as SHA256, then use this endpoint and provide first 5 symbols of a lookup value hash.\n**Rate limit: 200 per second.**","operationId":"salt","parameters":[{"$ref":"#/components/parameters/HashPrefix"}],"responses":{"200":{"description":"Returns a generated salt","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeSaltSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/salt":{"post":{"tags":["Credit Card Intelligence","National Identification Number Intelligence","Utility Endpoints"],"summary":"Generates many salts based on the provided input data","description":"A specific salt is required to successfully use zero knowledge credit card and national identification number lookups.\n\nTo get a salt, hash lookup value (CC or NIN) as SHA256, then use this endpoint and provide first 5 symbols of a lookup value hash.\n**Rate limit: 200 per second.**","operationId":"salts","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeSaltsEndpoint"}}}},"responses":{"200":{"description":"Returns a generated salt","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeSaltsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription":{"get":{"tags":["Subscription Management"],"summary":"Get user subscriptions","description":"Used for looking up current users subscriptions.\nDefault limit is the maximum limit of 1000 records","operationId":"getSubscriptions","parameters":[{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/Offset"}],"responses":{"200":{"description":"Returns found data","headers":{"Next-Page":{"schema":{"type":"string"},"description":"Response is limited to 50 items per request by default. If this is not empty, there are more items to retrieve."},"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription/email-sha256":{"post":{"tags":["Subscription Management"],"summary":"Create email subscription","description":"Used for creating an email address subscription for current user.\nWhen a new data breach is added, that affects this email address,\nthis subscription will generate and send out events to the user according to their custom event handling mechanism.","operationId":"createEmailSubscription","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AssetSubscription"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription/phone-sha256":{"post":{"tags":["Subscription Management"],"summary":"Create phone subscription","description":"Used for creating a phone number subscription for current user.\nWhen a new data breach is added, that affects this phone number,\nthis subscription will generate and send out events to the user according to their custom event handling mechanism.","operationId":"createPhoneSubscription","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AssetSubscription"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription/domain":{"post":{"tags":["Subscription Management"],"summary":"Create domain subscription","description":"Used for creating a domain subscription for the current user.\nWhen a new data breach is added, that affects any of email addresses with this domain,\nthis subscription will generate and send out events to the user according to their custom event handling mechanism.","operationId":"createDomainSubscription","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainSubscription"}}},"required":true},"responses":{"200":{"description":"Returns created data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription/{cc-hash-type}":{"post":{"tags":["Subscription Management"],"summary":"Create zero knowledge credit card subscription","description":"Used for creating a zero knowledge credit card subscription for current user.\nWhen a new data breach is added, that affects this credit card,\nthis subscription will generate and send out events to the user according to their custom event handling mechanism.","operationId":"createZkCcSubscription","parameters":[{"name":"cc-hash-type","in":"path","required":true,"description":"**cc-argon2id** or **cc-sha1**.","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZKSubscription"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription/{nin-hash-type}":{"post":{"tags":["Subscription Management"],"summary":"Create zero knowledge national identification number subscription","description":"Used for creating a zero knowledge national identification number subscription for current user.\nWhen a new data breach is added, that affects this national identification number,\nthis subscription will generate and send out events to the user according to their custom event handling mechanism.","operationId":"createZkNinSubscription","parameters":[{"name":"nin-hash-type","in":"path","required":true,"description":"**nin-argon2id** or **nin-sha1**.","schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZKSubscription"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription/email-sha256/bulk":{"post":{"tags":["Subscription Management"],"summary":"Create email subscriptions","description":"Used for creating multiple email address subscriptions for current user.\nWhen a new data breach is added, that affects these email addresses,\nthis subscription will generate and send out events to the user according to their custom event handling mechanism.","operationId":"createEmailSubscriptions","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AssetSubscriptions"}}},"required":true},"responses":{"200":{"description":"Returns created data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatedSubscriptionsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription/phone-sha256/bulk":{"post":{"tags":["Subscription Management"],"summary":"Create phone subscriptions","description":"Used for creating multiple phone number subscriptions for current user.\nWhen a new data breach is added, that affects these phone numbers,\nthis subscription will generate and send out events to the user according to their custom event handling mechanism.","operationId":"createPhoneSubscriptions","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AssetSubscriptions"}}},"required":true},"responses":{"200":{"description":"Returns created data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatedSubscriptionsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription/domain/bulk":{"post":{"tags":["Subscription Management"],"summary":"Create domain subscriptions","description":"Used for creating multipe domain subscriptions for the current user.\nWhen a new data breach is added, that affects any of email addresses with these domains,\nthis subscription will generate and send out events to the user according to their custom event handling mechanism.","operationId":"createDomainSubscriptions","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainSubscriptions"}}},"required":true},"responses":{"200":{"description":"Returns created data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatedSubscriptionsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription/{cc-hash-type}/bulk":{"post":{"tags":["Subscription Management"],"summary":"Create zero knowledge credit card subscriptions","description":"Used for creating multiple zero knowledge credit card subscriptions for current user.\nWhen a new data breach is added, that affects these credit cards,\nthis subscription will generate and send out events to the user according to their custom event handling mechanism.","operationId":"createZkCcSubscriptions","parameters":[{"$ref":"#/paths/~1subscription~1%7Bcc-hash-type%7D/post/parameters/0"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZKSubscriptions"}}},"required":true},"responses":{"200":{"description":"Returns created data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatedSubscriptionsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription/{nin-hash-type}/bulk":{"post":{"tags":["Subscription Management"],"summary":"Create zero knowledge national identification number subscriptions","description":"Used for creating multiple zero knowledge national identification number subscriptions for current user.\nWhen a new data breach that affects these national identification numbers is added,\nthis subscription will generate and send out events to the user according to their custom event handling mechanism.","operationId":"createZkNinSubscriptions","parameters":[{"$ref":"#/paths/~1subscription~1%7Bnin-hash-type%7D/post/parameters/0"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZKSubscriptions"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatedSubscriptionsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription/bulk":{"delete":{"tags":["Subscription Management"],"summary":"Delete subscriptions","description":"Used for deleting multiple subscriptions for the current user.\nAccepts between 1 and 1000 subscription IDs.\n\n**This operation is non-reversible.**","operationId":"deleteSubscriptionsBulk","requestBody":{"content":{"application/json":{"schema":{"required":["ids"],"type":"object","properties":{"ids":{"type":"array","description":"List of subscription IDs to delete. Minimum 1, maximum 1000.","minItems":1,"maxItems":1000,"items":{"type":"string","example":"507f1f77bcf86cd799439011"}}}}}},"required":true},"responses":{"200":{"description":"Returns deleted subscriptions data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/SubscriptionSample"}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/subscription/{id}":{"get":{"tags":["Subscription Management"],"summary":"Get subscription","description":"Used for looking up a subscription for current user.\nThis endpoint allows to lookup the subscription by the ID.","operationId":"getSubscriptionByIdentifier","parameters":[{"$ref":"#/components/parameters/SubscriptionId"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]},"delete":{"tags":["Subscription Management"],"summary":"Delete subscription","description":"Used for deleting a current users subscription.\n\n**This operation is non-reversible.**","operationId":"deleteSubscriptions","parameters":[{"$ref":"#/components/parameters/SubscriptionId"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"No data found","content":{}}},"security":[{"ApiKeyAuth":[]}]}},"/profiling/reports":{"post":{"tags":["Profiling"],"summary":"Generate a profiling report","description":"Creates a new profiling report for the given email addresses and/or phone numbers.\nThe report is generated asynchronously — the response returns immediately with the report ID\nand a `pending` state. Use the GET endpoint to poll for completion.\n\nIdentifiers are normalized (emails lowercased, whitespace trimmed) and deduplicated\nbefore processing. Between 1 and 5 unique identifiers are accepted per report.\n\nIf a report for the same set of identifiers already exists in a non-failed state,\n`409 Conflict` is returned. Failed reports are automatically reset and re-initiated.","operationId":"generateReport","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["external_user_id"],"properties":{"emails":{"type":"array","description":"Email addresses to profile","maxItems":5,"items":{"type":"string","format":"email"},"example":["user@example.com"]},"phones":{"type":"array","description":"Phone numbers in international format (E.164)","maxItems":5,"items":{"type":"string"},"example":["+12025551234"]},"external_user_id":{"type":"string","description":"External user identifier being profiled","example":"ext-user-123"}}}}}},"responses":{"201":{"description":"Report created successfully","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"Deterministic report identifier (SHA256 hash)","example":"a1b2c3d4e5f6..."},"state":{"type":"string","description":"Current report state","enum":["pending","analyzing","completed","failed"],"example":"pending"}}}}}},"400":{"description":"Invalid request (missing identifiers, invalid format, count out of range)","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"409":{"description":"Report already exists for this identifier set","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]},"get":{"tags":["Profiling"],"summary":"List profiling reports","description":"Returns profiling reports for the authenticated tenant scoped to the given external user.\nResults are sorted by creation date (newest first).\nHeavy fields (accounts, activities, breaches, analysis) are excluded from the response.","operationId":"listReports","parameters":[{"name":"external_user_id","in":"query","required":true,"schema":{"type":"string"},"description":"External user identifier to scope the report list"},{"name":"page","in":"query","required":false,"schema":{"type":"integer","minimum":1,"default":1},"description":"Page number (1-indexed)"},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":50,"default":10},"description":"Number of reports per page"}],"responses":{"200":{"description":"Returns report summaries","content":{"application/json":{"schema":{"type":"object","properties":{"reports":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"Report identifier"},"state":{"type":"string","enum":["pending","analyzing","completed","failed"]},"emails":{"type":"array","items":{"type":"string"}},"phones":{"type":"array","items":{"type":"string"}},"total_items":{"type":"integer"},"date_created":{"type":"string","format":"date-time"},"date_updated":{"type":"string","format":"date-time"}}}},"page":{"type":"integer","description":"Current page number"},"limit":{"type":"integer","description":"Number of items per page"},"total":{"type":"integer","description":"Total number of reports"}}}}}},"400":{"description":"Missing external_user_id parameter","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/profiling/reports/{id}":{"get":{"tags":["Profiling"],"summary":"Get a profiling report","description":"Retrieves a full profiling report by ID, scoped to the authenticated tenant and external user.\nThe response includes activities, accounts, breaches, and LLM analysis when available.\n\nPoll this endpoint to check report completion — the `state` field transitions through:\n`pending` → `analyzing` → `completed` (or `failed`).","operationId":"getReport","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"},"description":"Report identifier"},{"name":"external_user_id","in":"query","required":true,"schema":{"type":"string"},"description":"External user identifier"}],"responses":{"200":{"description":"Returns the full report","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"Report identifier"},"state":{"type":"string","enum":["pending","analyzing","completed","failed"]},"date_created":{"type":"string","format":"date-time"},"date_updated":{"type":"string","format":"date-time"},"accounts":{"type":"array","description":"Discovered platform accounts","items":{"type":"object","properties":{"platform":{"type":"string"},"category":{"type":"string"},"registered":{"type":"boolean"},"profile":{"type":"object","properties":{"url":{"type":"string"},"id":{"type":"string"},"verified":{"type":"boolean"},"display_name":{"type":"string"},"username":{"type":"string"},"description":{"type":"string"},"picture":{"type":"string"},"gender":{"type":"string"},"language":{"type":"string"},"job_title":{"type":"string"},"location":{"type":"string"},"followers":{"type":"integer"},"following":{"type":"integer"},"premium":{"type":"boolean"}}},"contact":{"type":"object","properties":{"phones":{"type":"array","items":{"type":"string"}},"emails":{"type":"array","items":{"type":"string"}}}},"activity":{"type":"object","properties":{"date_created":{"type":"string"},"last_seen":{"type":"string"},"profile_updated":{"type":"string"},"verification":{"type":"object","properties":{"phone":{"type":"string"},"email":{"type":"string"}}}}}}}},"activities":{"type":"array","description":"Location-aware events extracted from OSINT data","items":{"type":"object","properties":{"platform":{"type":"string"},"type":{"type":"string"},"label":{"type":"string"},"date_created":{"type":"string"},"location":{"type":"object","properties":{"points":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"latitude":{"type":"number"},"longitude":{"type":"number"}}}},"polyline":{"type":"string"},"city":{"type":"string"},"region":{"type":"string"},"country":{"type":"string"},"country_code":{"type":"string"},"address":{"type":"string"},"postal_code":{"type":"string"},"timezone":{"type":"string"},"local_date":{"type":"string"},"device_name":{"type":"string"}}}}}},"breaches":{"type":"array","description":"Breach matches from internal asset databases","items":{"type":"object","properties":{"type":{"type":"string","enum":["database","malware_log","credential_list"]},"identifier_type":{"type":"string","description":"Identifier type (email or phone)"},"name":{"type":"string","description":"Breach source identifier (e.g. domain name)"},"published_date":{"type":"string","format":"date-time","description":"When the breach was first recorded"}}}},"analysis":{"type":"object","description":"LLM-generated risk analysis (present when state is completed)","properties":{"exposure_summary":{"type":"string"},"platforms":{"type":"array","items":{"type":"object","properties":{"platform_id":{"type":"string"},"platform_category":{"type":"string"},"data_points_exposed":{"type":"array","items":{"type":"string"}},"most_recent_activity":{"type":"string"},"risk_level":{"type":"string"},"reasoning":{"type":"string"}}}},"correlation_risks":{"type":"array","items":{"type":"object","properties":{"risk_name":{"type":"string"},"severity":{"type":"string"},"explanation":{"type":"string"},"contributing_data_points":{"type":"array","items":{"type":"object","properties":{"platform_id":{"type":"string"},"type":{"type":"string"}}}}}}},"overall_risk":{"type":"object","properties":{"score":{"type":"integer","minimum":0,"maximum":100},"justification":{"type":"string"}}},"recommendations":{"type":"object","properties":{"immediate":{"type":"array","items":{"type":"object","properties":{"action":{"type":"string"},"expected_impact":{"type":"string"},"addresses":{"type":"array","items":{"type":"object","properties":{"platform_id":{"type":"string"},"type":{"type":"string"}}}}}}},"short_term":{"type":"array","items":{"type":"object","properties":{"action":{"type":"string"},"expected_impact":{"type":"string"},"addresses":{"type":"array","items":{"type":"object","properties":{"platform_id":{"type":"string"},"type":{"type":"string"}}}}}}},"ongoing":{"type":"array","items":{"type":"object","properties":{"action":{"type":"string"},"expected_impact":{"type":"string"},"addresses":{"type":"array","items":{"type":"object","properties":{"platform_id":{"type":"string"},"type":{"type":"string"}}}}}}}}},"metadata":{"type":"object","properties":{"platforms_analyzed":{"type":"integer"},"data_points_analyzed":{"type":"integer"},"earliest_observed":{"type":"string"},"latest_observed":{"type":"string"}}},"risk_scoring":{"type":"object","description":"Deterministic, code-computed risk score independent of the LLM's qualitative assessment. Clients can subtract resolved signal weights from raw_score and re-clamp to [0, max_score] for adjusted scoring.","properties":{"score":{"type":"integer","minimum":0,"maximum":100,"description":"Clamped risk score"},"raw_score":{"type":"integer","description":"Uncapped sum of all signal weights"},"max_score":{"type":"integer","description":"Maximum possible score (always 100)"},"level":{"type":"string","enum":["low","medium","high"]},"signals":{"type":"array","items":{"type":"object","properties":{"category":{"type":"string","description":"Signal category (identifying_data, location_data, breach_data, pseudonymous, sensitive_platform, correlation, non_identifying, profile_discovered)"},"source":{"type":"string","description":"Platform or source that produced this signal"},"detail":{"type":"string","description":"Human-readable description of the signal"},"weight":{"type":"integer","description":"Points contributed to the raw score"},"level":{"type":"string","enum":["low","medium","high"]}}}}}}}}}}}}},"400":{"description":"Missing required parameters","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"Report not found","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/profiling/reports/{id}/regenerate":{"post":{"tags":["Profiling"],"summary":"Regenerate a profiling report","description":"Resets a completed or failed report back to `pending` state and re-fetches all data.\nStale source records are re-fetched from OSINT, fresh cached records are reused.\n\nReturns `412 Precondition Failed` if the report is still being processed (pending or analyzing state).","operationId":"regenerateReport","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"},"description":"Report identifier"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["external_user_id"],"properties":{"external_user_id":{"type":"string","description":"External user identifier","example":"ext-user-123"}}}}}},"responses":{"200":{"description":"Report regeneration initiated","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"Report identifier"},"state":{"type":"string","description":"Report state after regeneration","example":"pending"}}}}}},"400":{"description":"Missing required parameters","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"404":{"description":"Report not found","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"412":{"description":"Report is still processing (pending or analyzing)","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/scraped-content/forum":{"post":{"tags":["Dark Web Intelligence"],"summary":"Scraped forum content search","description":"This endpoint allows users to search through scraped forum content found on the dark web using a Lucene query as the main search query.\nIt provides a powerful and flexible search capability by allowing users to construct complex queries to filter and retrieve specific forum content.\n\n**Example Lucene Query:**\n- To search for posts with the word \"malware\" in the content field, authored by \"john doe\":\n\n`content:malware AND author_name:\"john doe\"`\n\nSearch phrases can be optionally highlighted in the search results using the `highlight_params` object.\nAll keywords that are matched by the query will be wrapped with passed starting and ending tags.\n\nThe endpoint can return a maximum of 10,000 records. An offset plus limit that exceeds 10,000 will result in a bad request\n\n**Rate limit: 50 per second.**","operationId":"forumSearch","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForumSearchRequest"}}}},"responses":{"200":{"description":"Returns a list of forum threads","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForumSearchResponse"},"examples":{"forumPosts":{"summary":"Example of a forum thread search response","value":{"data":[{"id":"6715e928a3dd3128e8a357b4","content":{"title":"A SMALL PART OF THE LYCA MOBILE SYSTEM (UK)","content":"WE ADMIT THAT WE HAVE ATTACKED AND STAYED IN THE LYCA MOBILE COMPANY SYSTEM FOR A YEAR. THE COMPANY HAS FRAUDULENT CARD INFORMATION SECURITY BY ONLY EXPOSING THE LAST 4 DIGITS OF CUSTOMERS' CARDS WHILE WE HAVE CONSUMED MORE THAN 2 MILLION CREDIT CARDS WITH FULL USER INFORMATION DOWNLOAD: https://example.com/Information/some-file-1.csv\nhttps://example.com/Information/some-file-2.csv","extracted_links":["https://example.com/Information/some-file-2.csv"],"author_name":"KryptonZambie","author_url":"https://breachforums.st/User-KryptonZambie","date_posted":"2024-10-20T11:14:00Z","url":"https://breachforums.st/Thread-DATABASE-A-SMALL-PART-OF-THE-LYCA-MOBILE-SYSTEM-UK","onion_url":"http://breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion/Thread-DATABASE-A-SMALL-PART-OF-THE-LYCA-MOBILE-SYSTEM-UK"},"metadata":{"tags":["DATABASE","TOP_5000_CF"],"date_scraped":"2024-10-21T05:39:52Z"},"target_data":{"site_url":"https://breachforums.st","site_domain_name":"breachforums.st","site_subdomain_url":"Forum-Databases","onion_domain_name":"breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion"}},{"id":"67111ac33311a66e3bd0b195","content":{"title":"OVER 110GB OF DRIVER'S LICENSE AND BANK STATEMENTS FROM CMELITEGROUP.COM USERS (USA)","content":"Date Of Leak : 26-09-2024 Website: https://www.example-company.com/ ALL IDENTIFICATION DOCUMENTS AND BANK STATEMENTS OF THE AMERICAN STOCK EXCHANGE SYSTEM CMELITEGROUP.COM SAMPLE: https://example.com/Information/some-file-3.zip Hidden Content","extracted_links":["https://example.com/Information/some-file-3.zip","https://www.example-company.com/"],"author_name":"KryptonZambie","author_url":"https://breachforums.st/User-KryptonZambie","date_posted":"2024-10-17T13:51:11Z","url":"https://breachforums.st/Thread-DATABASE-OVER-110GB-OF-DRIVER-S-LICENSE-AND-BANK-STATEMENTS-FROM-CMELITEGROUP-COM-USERS-USA","onion_url":"http://breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion/Thread-DATABASE-OVER-110GB-OF-DRIVER-S-LICENSE-AND-BANK-STATEMENTS-FROM-CMELITEGROUP-COM-USERS-USA"},"metadata":{"tags":["DATABASE","TOP_50000_CF"],"date_scraped":"2024-10-17T14:10:11Z"},"target_data":{"site_url":"https://breachforums.st","site_domain_name":"breachforums.st","site_subdomain_url":"Forum-Databases","onion_domain_name":"breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion"}},{"id":"67124fd618588a5f28bbd1d9","content":{"title":"OVER 110GB OF DRIVER'S LICENSE AND BANK STATEMENTS FROM CMELITEGROUP.COM USERS (USA)","content":"Date Of Leak : 26-09-2024 Website: https://www.example-company.com/ ALL IDENTIFICATION DOCUMENTS AND BANK STATEMENTS OF THE AMERICAN STOCK EXCHANGE SYSTEM CMELITEGROUP.COM SAMPLE: https://example.com/Information/some-file-3.zip Hidden Content You must reply to this thread to view this content.","extracted_links":["https://example.com/Information/some-file-3.zip","https://www.example-company.com/"],"author_name":"KryptonZambie","author_url":"https://breachforums.st/User-KryptonZambie","date_posted":"2024-10-17T13:49:00Z","url":"https://breachforums.st/Thread-OVER-110GB-OF-DRIVER-S-LICENSE-AND-BANK-STATEMENTS-FROM-CMELITEGROUP-COM-USERS-USA","onion_url":"http://breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion/Thread-OVER-110GB-OF-DRIVER-S-LICENSE-AND-BANK-STATEMENTS-FROM-CMELITEGROUP-COM-USERS-USA"},"metadata":{"tags":["DATABASE","TOP_50000_CF"],"date_scraped":"2024-10-18T12:08:54Z"},"target_data":{"site_url":"https://breachforums.st","site_domain_name":"breachforums.st","site_subdomain_url":"Forum-Databases-Removed-Content","onion_domain_name":"breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion"}},{"id":"67111ac43311a66e3bd0b197","content":{"title":"152GB PHILIPPINE ID CARD (WITH PHONE NUMBERS OF MORE THAN 4 MILLION PEOPLE )","content":"152GB PHILIPPINES ID CARD (INCLUDING PHONE NUMBERS OF MORE THAN 4 MILLION PEOPLE) SAMPLE: https://example.com/Information/some-file-4.rar Hidden Content\nhttps://example.com/Information/some-file-4.rar","extracted_links":["https://example.com/Information/some-file-4.rar"],"author_name":"KryptonZambie","author_url":"https://breachforums.st/User-KryptonZambie","date_posted":"2024-10-17T13:36:12Z","url":"https://breachforums.st/Thread-DATABASE-152GB-PHILIPPINE-ID-CARD-WITH-PHONE-NUMBERS-OF-MORE-THAN-4-MILLION-PEOPLE","onion_url":"http://breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion/Thread-DATABASE-152GB-PHILIPPINE-ID-CARD-WITH-PHONE-NUMBERS-OF-MORE-THAN-4-MILLION-PEOPLE"},"metadata":{"tags":["CARD","PHOTO","TOP_10000_CF","TOP_5000_CF"],"date_scraped":"2024-10-17T14:10:12Z"},"target_data":{"site_url":"https://breachforums.st","site_domain_name":"breachforums.st","site_subdomain_url":"Forum-Databases","onion_domain_name":"breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion"}}],"total_results":30}}}}}},"206":{"description":"Returns a list of forum threads (Partial content if response would exceed 4MB)","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForumSearchResponse"}}}},"400":{"description":"Bad request (Indicates incorrect / missing values)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Unprocessable Entity (Indicates invalid Lucene query)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/scraped-content/telegram":{"post":{"tags":["Dark Web Intelligence"],"summary":"Scraped Telegram content search","description":"This endpoint allows users to search through scraped Telegram content found on the variety of channels in Telegram Ecosystem using a Lucene query as the main search query.\nIt provides a powerful and flexible search capability by allowing users to construct complex queries to filter and retrieve specific telegram content.\n\n**Example Lucene Query:**\n- To search for messages with the word \"malware\" in the content field, authored by \"john doe\":\n\n`content:malware AND author_name:\"john doe\"`\n\nSearch phrases can be optionally highlighted in the search results using the `highlight_params` object.\nAll keywords that are matched by the query will be wrapped with passed starting and ending tags.\n\nThe endpoint can return a maximum of 10,000 records. An offset plus limit that exceeds 10,000 will result in a bad request\n\n**Rate limit: 50 per second.**","operationId":"telegramSearch","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TelegramSearchRequest"}}},"required":true},"responses":{"200":{"description":"Returns a list of telegram messages","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TelegramSearchResponse"},"examples":{"telegramMessages":{"summary":"Example of a telegram message search response","value":{"data":[{"id":"6841b62e41c5cf44ee3ffa94","content":{"title":"REvil-Ransomware | Announcement #101","content":"We are back! REvil ransomware group is recruiting new affiliates for high-profile targets. Contact us for partnership. #Ransomware #REvil","author_name":"REvilOfficial","external_author_id":1234567890,"date_posted":"2025-06-05T15:12:32Z","url":"https://t.me/c/1234567890/101"},"metadata":{"tags":["RANSOMWARE","MALWARE"],"date_scraped":"2025-06-05T15:22:24Z"},"target_data":{"external_channel_id":1234567890,"channel_name":"REvil Official Announcements","channel_identifier":"REvilOfficial"}},{"id":"6841b75fd77610afbeff7a0b","content":{"title":"ShadowMarket | Sale #554","content":"Fresh database from major e-commerce site for sale. 10M user records with email, password hashes, and addresses. Price: 2 BTC. DM for sample.","author_name":"DataSeller","external_author_id":9876543210,"date_posted":"2025-06-05T14:57:53Z","url":"https://t.me/c/9876543210/554"},"metadata":{"tags":["DATABASE","SALE"],"date_scraped":"2025-06-05T15:27:28Z"},"target_data":{"external_channel_id":9876543210,"channel_name":"Shadow Market","channel_identifier":"shadow_market_sales"}},{"id":"6841c68aeb9bce48fb5b3901","content":{"title":"CRD_TRDR | Message #5053","content":"#SecureVPN \n\n𝗘𝗺𝗮𝗶𝗹:𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱\n\njohn.doe@example.com\nExamplePass1!\n\nalex.smith@example.com\nPassExample2!\n\nandy.j@example.co.uk\nAnotherP4ss!\n\nm.pont@example.fr\nFr3nchP4ss","author_name":"CRD_TRDR","external_author_id":1765503461,"date_posted":"2025-06-05T13:52:13Z","url":"https://t.me/c/1765503461/5053"},"metadata":{"tags":["CREDENTIALS"],"date_scraped":"2025-06-05T16:32:11Z"},"target_data":{"external_channel_id":1765503461,"channel_name":"CRD_TRDR_CHANNEL","channel_identifier\"":"CRD_TRDR"}},{"id":"683f1dc8f211bc0c044bbcfa","content":{"title":"PhishKits | New Product #42","content":"New Bank of America phishing kit available. High quality, undetectable. Includes login page, CC form, and admin panel. $250 in XMR. Link: http://example-phish-kit.com/boa_kit.zip","extracted_links":["http://example-phish-kit.com/boa_kit.zip"],"extracted_domains":["example-phish-kit.com"],"author_name\"":"PhishMaster","external_author_id\"":1034068795,"date_posted\"":"2025-06-03T12:34:47Z","url":"https://t.me/c/1034068795/42"},"metadata":{"tags":["PHISHING","SALE"],"date_scraped":"2025-06-03T16:07:38Z"},"target_data":{"external_channel_id":1034068795,"channel_name":"Phishing Kits & Tools","channel_identifier":"phish_kits"}}],"total_results":5277}}}}}},"206":{"description":"Returns a list of telegram messages (Partial content if response would exceed 4MB)","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TelegramSearchResponse"}}}},"400":{"description":"Bad request (Indicates incorrect / missing values)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Unprocessable Entity (Indicates invalid Lucene query)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/scraped-content/ransomware":{"post":{"tags":["Dark Web Intelligence"],"summary":"Scraped ransomware content search","description":"This endpoint allows users to search through scraped ransomware incident content found on the variety of groups in dark web ecosystem using a Lucene query as the main search query.\nIt provides a powerful and flexible search capability by allowing users to construct complex queries to filter and retrieve specific ransomware blog content.\n\n**Example Lucene Query:**\n- To search for messages with the word \"malware\" in the content field, authored by \"john doe\":\n\n`content:malware AND author_name:\"john doe\"`\n\nSearch phrases can be optionally highlighted in the search results using the `highlight_params` object.\nAll keywords that are matched by the query will be wrapped with passed starting and ending tags.\n\nThe endpoint can return a maximum of 10,000 records. An offset plus limit that exceeds 10,000 will result in a bad request\n\n**Rate limit: 50 per second.**","operationId":"ransomwareSearch","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RansomwareSearchRequest"}}},"required":true},"responses":{"200":{"description":"Returns a list of ransomware incidents","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RansomwareSearchResponse"},"examples":{"ransomwareIncidents":{"summary":"Example of a ransomware incident search response","value":{"data":[{"id":"6842bc300046021e79cbf22b","content":{"title":"Synopsys/synopsys.com targeted in ransomware attack by Arkana","author_name":"Arkana","date_posted":"2025-06-06T12:04:54Z"},"ransom_data":{"victim_name\"":"Synopsys","victim_domain\"":"synopsys.com"},"metadata":{"tags":["RANSOMWARE_INCIDENT","TOP_50000_CF"],"date_scraped":"2025-06-06T10:00:16Z","screenshot_identifier":"6842bc300046021e79cbf22b"},"enrichment_data":{"name":"Synopsys Inc","domain":"synopsys.com","website":"https://www.synopsys.com","industry":"Software Development","type":"Public Company","size_range":"10,001+ employees","location":{"country":"United States","country_iso2":"US","location":"Sunnyvale, California 94085, US","full_address":"675 Almanor Ave; Sunnyvale, California 94085, US"},"socials":[{"platform":1,"url":"https://www.facebook.com/synopsys"},{"platform":2,"url":"https://www.linkedin.com/company/synopsys"},{"platform\"":3,"url":"https://www.twitter.com/synopsys"},{"platform":4,"url":"https://www.crunchbase.com/organization/synopsys"},{"platform":5,"url":"https://www.instagram.com/synopsyslife"},{"platform":6,"url":"https://www.youtube.com/user/synopsys"}]}}],"total_results":1}}}}}},"206":{"description":"Returns a list of ransomware incidents (Partial content if response would exceed 4MB)","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RansomwareSearchResponse"}}}},"400":{"description":"Bad request (Indicates incorrect / missing values)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Unprocessable Entity (Indicates invalid Lucene query)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/scraped-content/marketplace":{"post":{"tags":["Dark Web Intelligence"],"summary":"Scraped marketplace content search","description":"This endpoint allows users to search through scraped marketplace post content found on the variety of groups in dark web ecosystem using a Lucene query as the main search query.\nIt provides a powerful and flexible search capability by allowing users to construct complex queries to filter and retrieve specific marketplace content.\n\n**Example Lucene Query:**\n- To search for messages with the word \"malware\" in the content field, authored by \"john doe\":\n\n`content:malware AND author_name:\"john doe\"`\n\nSearch phrases can be optionally highlighted in the search results using the `highlight_params` object.\nAll keywords that are matched by the query will be wrapped with passed starting and ending tags.\n\nThe endpoint can return a maximum of 10,000 records. An offset plus limit that exceeds 10,000 will result in a bad request\n\n**Rate limit: 50 per second.**","operationId":"marketplaceSearch","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MarketplaceSearchRequest"}}},"required":true},"responses":{"200":{"description":"Returns a list of marketplace posts","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MarketplaceSearchResponse"},"examples":{"marketplacePosts":{"summary":"Example of a marketplace post search response","value":{"data":[{"id":"67ea417b4ffad2783e9acbed","display_price":"14.00$","type":1,"content":{"title":"Malware Logs | Stealer [Unknown] | source | 14.00$","content":"Stealer: Unknown\nLog Identifier: _RO_188.27.152.93\nVictim OS: Windows 10 Pro (10.0.19045) x64\nDate: 2025-03-30T02:34:01\nCountry: RO\nLinks: \n\ntplinkrepeater.net | discord.com | signin.rockstargames.com | guns.lol | tzproject.com | store.steampowered.com | www.instagram.com | www.facebook.com | accounts.spotify.com | tria.ge | accounts.google.com | ring-1.io | www.paypal.com | totaljerkface.com | www.epicgames.com | authenticate.riotgames.com | www.spotify.com | steamcommunity.com | cheater.fun | panel.sharky.ro | doxbin.com | auth0.openai.com | botlucky.com","author_name":"source","author_url":"http://exodusyzzpcnxxvpqoyyv3g4yvcy2zbfj4u7jxb56mlcfguqvehyjeqd.onion/vendor/source","date_posted":"2025-03-30T02:34:01Z","url":"http://exodusyzzpcnxxvpqoyyv3g4yvcy2zbfj4u7jxb56mlcfguqvehyjeqd.onion/bot/6ff9d472-0d0f-11f0-9fd7-002590371a8e"},"metadata":{"tags":["MARKETPLACE","LOGS","TOP_200_CF","TOP_50000_CF","TOP_20000_CF","TOP_500_CF"],"date_scraped":"2025-03-30T02:34:01Z","screenshot_identifier":"exodusmarket.io/67ea417b4ffad2783e9acbed"},"target_data":{"site_url":"http://exodusyzzpcnxxvpqoyyv3g4yvcy2zbfj4u7jxb56mlcfguqvehyjeqd.onion","site_domain_name":"[Exodus Market] exodusyzzpcnxxvpqoyyv3g4yvcy2zbfj4u7jxb56mlcfguqvehyjeqd.onion","site_subdomain_url":"http://exodusyzzpcnxxvpqoyyv3g4yvcy2zbfj4u7jxb56mlcfguqvehyjeqd.onion/bots"}},{"id":"682c3405292eec1a44f7e38f","display_price":"19.89$","type":2,"content":{"title":"Credit Cards | [CREDIT] | [441770][05/2027] | seller55184 | 19.89$","content":"Type: VISA\nBin: 441770\nBank: KASIKORNBANK PUBLIC CO., LTD.\nClass: CREDIT\nLevel: BUSINESS\nEXP: 05/2027\nDatabase: [19.05.2025] MIX ASIA from sniffer HQ\nCountry: Thailand\nState: BA\nCity: Bangkok\nZip: 10600\nSSN: Not Provided\nDOB: Not Provided","author_name\"":"seller55184","author_url":"https://bidenjxwb7khlh3djrmi6zkkmggiuoh6cnxll7my7uk25ohe27pcfryd.onion/vendor/seller55184","date_posted":"2025-05-20T07:49:25Z","url":"https://bidenjxwb7khlh3djrmi6zkkmggiuoh6cnxll7my7uk25ohe27pcfryd.onion"},"metadata":{"tags":["MARKETPLACE","CARD"],"date_scraped":"2025-05-20T07:49:25Z","screenshot_identifier":"bidencash.asia/682c3405292eec1a44f7e38e"},"target_data":{"site_url":"https://bidenjxwb7khlh3djrmi6zkkmggiuoh6cnxll7my7uk25ohe27pcfryd.onion","site_domain_name":"[BidenCash] bidenjxwb7khlh3djrmi6zkkmggiuoh6cnxll7my7uk25ohe27pcfryd.onion","site_subdomain_url":"https://bidenjxwb7khlh3djrmi6zkkmggiuoh6cnxll7my7uk25ohe27pcfryd.onion/cards"}}],"total_results":2}}}}}},"206":{"description":"Returns a list of marketplace posts (Partial content if response would exceed 4MB)","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MarketplaceSearchResponse"}}}},"400":{"description":"Bad request (Indicates incorrect / missing values)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Unprocessable Entity (Indicates invalid Lucene query)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/scraped-content/tags":{"post":{"tags":["Dark Web Intelligence"],"summary":"Scraped content tags lookup","description":"This endpoint provides a lookup for all tags currently used internally for classification of scraped content.\nBased on the specified source, it returns the tags used within that particular collection.\nThese tags help in categorizing and filtering the scraped content effectively.\n\n**Rate limit: 50 per second.**","operationId":"scrapedContentTags","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TagsSearchRequest"}}}},"responses":{"200":{"description":"Returns scraped content tags","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TagsResponse"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/scraped-content/screenshot":{"post":{"tags":["Dark Web Intelligence"],"summary":"Scraped content screenshot lookup","description":"This endpoint provides a lookup of scraped content screenshots based on the specified source & identifier.\nThe endpoint returns the screenshot of the scraped content in JPEG format.\n\n**Rate limit: 50 per second.**","operationId":"scrapedContentScreenshot","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScreenshotRequest"}}}},"responses":{"200":{"description":"Returns image in JPEG format, returned as bytes.","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}}},"content":{"image/jpeg":{"schema":{"type":"string","format":"binary"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"security":[{"ApiKeyAuth":[]}]}}},"components":{"schemas":{"AccessToken":{"type":"object","properties":{"id":{"type":"string","example":"my-token"},"token":{"type":"string","example":"a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a"}}},"UserDetails":{"type":"object","properties":{"username":{"type":"string","example":"username"},"api_tokens":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"}}},"example":[{"id":"token1"},{"id":"token2"}]},"endpoint":{"$ref":"#/components/schemas/SubscriptionEndpointSample"}}},"GetAccessToken":{"type":"object","properties":{"id":{"type":"string","description":"Client token ID","example":"my-token"}}},"ZeroKnowledgeSample":{"type":"object","properties":{"hash":{"type":"string"},"data":{"type":"array","description":"Contains data grouped by **origin**.","items":{"type":"object","properties":{"origin":{"type":"string","example":"databases","description":"Contains data origin (either **databases** or **malware_logs**)"},"data":{"type":"array","description":"Contains origin items with leaked data keys.","items":{"type":"object","properties":{"id":{"type":"string","description":"Origin record id.","example":"66c4d3912b183418f7743576"},"compromised_data":{"type":"array","description":"Compromised data keys","items":{"type":"string"},"example":["password","nin","surname"]}}}}}}}}},"ZeroKnowledgeMultiSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ZeroKnowledgeSample"}}}},"ZeroKnowledgeLiteSample":{"type":"object","properties":{"hash":{"type":"string","description":"First characters of the hashed credit card value used for this bucket.","example":"a1b2c"},"data":{"type":"array","description":"Contains data grouped by **origin**.","items":{"type":"object","properties":{"origin":{"type":"string","example":"databases","description":"Data origin (**databases** or **malware_logs**)."},"data":{"type":"array","description":"Records for this origin with compromised data keys and optional malware metadata.","items":{"type":"object","properties":{"id":{"type":"string","description":"Origin record id (hex).","example":"66c4d3912b183418f7743576"},"compromised_data":{"type":"array","description":"Compromised data keys associated with this record.","items":{"type":"string"},"example":["password","nin","surname"]},"malware_details":{"$ref":"#/components/schemas/MalwareLogDetailsLite"}}}}}}}}},"ZeroKnowledgeMultiLiteSample":{"type":"object","description":"Paginated bulk credit card zero-knowledge response (lite variant with malware log details).","properties":{"data":{"type":"array","description":"One entry per requested hash range (structure matches lite CC-by-hash grouping).","items":{"$ref":"#/components/schemas/ZeroKnowledgeLiteSample"}},"limit":{"type":"integer","description":"Pagination limit applied to this response (validated against the maximum bulk size).","example":10},"offset":{"type":"integer","description":"Pagination offset applied to this response.","example":0}}},"MalwareLogDetailsLite":{"type":"object","description":"Malware log metadata attached when **origin** is **malware_logs** and details were loaded from the malware-log service. For other origins this object is present but typically has empty or default-shaped fields.","properties":{"id":{"type":"string","description":"Malware log document id.","example":"66c4d3912b183418f7743576"},"identifier":{"type":"string","description":"Malware log identifier (e.g. infection or log label).","example":"log-2024-01-redline"},"type":{"type":"string","description":"Malware or stealer family/type when known.","example":"redline"},"published_date":{"type":"string","format":"date-time","nullable":true,"description":"When the malware log was published.","example":"2024-01-15T10:30:00Z"},"updated_date":{"type":"string","format":"date-time","nullable":true,"description":"When the malware log record was last updated.","example":"2024-01-16T08:00:00Z"},"system_info":{"$ref":"#/components/schemas/MalwareLogSystemInfoSampleItem"}}},"EmailSample":{"type":"object","properties":{"id":{"type":"string","example":"2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3"},"email":{"type":"string","example":"example@example.com"},"databases":{"type":"array","items":{"$ref":"#/components/schemas/DatabaseDataItem"}},"malware_logs":{"type":"array","items":{"$ref":"#/components/schemas/MalwareDataItem"}},"credential_lists":{"type":"array","items":{"$ref":"#/components/schemas/CredentialDataItem"}},"risk_assessment":{"type":"object","properties":{"level":{"type":"string","description":"Risk level, one of the following: info, low, medium, high, critical","example":"high"},"recommendations_enabled":{"type":"string","description":"If true, user has enabled recommendations for this request. If false, recommendations are not provided. This field is taken from user provided query parameter of the same name.","example":"true"},"recommendations":{"type":"array","items":{"type":"object","properties":{"leaked_data_category":{"type":"string","description":"Pretty name of general data category that triggered this recommendation","example":"Password"},"recommendation":{"type":"string","description":"Recommendation text","example":"Avoid using your publicly known information in passwords. Threat actors routinely use other known information, such as email addresses, phone numbers, pet names, dates of birth, first/last names and other data in stuffing attacks to uncover passwords that were otherwise never leaked online."}}}}}}}},"EmailLiteSample":{"type":"object","properties":{"id":{"type":"string","example":"2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3"},"email":{"type":"string","example":"example@example.com"},"databases":{"type":"array","items":{"$ref":"#/components/schemas/DatabaseDataItem"}},"malware_logs":{"type":"array","items":{"$ref":"#/components/schemas/MalwareDataItemLite"}},"credential_lists":{"type":"array","items":{"$ref":"#/components/schemas/CredentialDataItem"}}}},"EmailDatabasesSample":{"type":"object","properties":{"id":{"type":"string","example":"2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3"},"email":{"type":"string","example":"example@example.com"},"databases":{"type":"array","items":{"$ref":"#/components/schemas/DatabaseDataItem"}}}},"EmailMalwareLogsSample":{"type":"object","properties":{"id":{"type":"string","example":"2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3"},"email":{"type":"string","example":"example@example.com"},"malware_logs":{"type":"array","items":{"$ref":"#/components/schemas/MalwareDataItem"}}}},"EmailCredentialListsSample":{"type":"object","properties":{"id":{"type":"string","example":"2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3"},"email":{"type":"string","example":"example@example.com"},"credential_lists":{"type":"array","items":{"$ref":"#/components/schemas/CredentialDataItem"}}}},"EmailsSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EmailSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"EmailsLiteSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EmailLiteSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"EmailsDatabasesSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EmailDatabasesSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"EmailsMalwareLogsSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EmailMalwareLogsSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"EmailsCredentialListsSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EmailCredentialListsSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"Emails":{"required":["data"],"type":"object","properties":{"emails_sha256":{"type":"array","description":"A list of SHA256 hashed lower-case email addresses to lookup","items":{"type":"string"},"example":["2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304"]},"limit":{"description":"Default is the maximum limit of 100 records","type":"integer","example":10},"offset":{"type":"integer","example":0}}},"EmailsAto":{"required":["emails_sha256"],"type":"object","properties":{"emails_sha256":{"type":"array","description":"A list of SHA256 hashed email addresses to generate fuzzed passwords","items":{"type":"string"},"example":["2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304"]},"fuzzing_intensity":{"type":"integer","description":"Fuzzing intensity level parameter, which ranges from 0 to 10, 0 being no fuzzing, only original password returned, and 10 being the biggest rule set that returns over 50,000 fuzzed passwords per original password.","default":1,"example":0},"limit":{"description":"Default is the maximum limit of 5 records","type":"integer","example":10},"offset":{"type":"integer","example":0}}},"EmailAtoFiltered":{"required":["email_sha256"],"type":"object","properties":{"email_sha256":{"type":"string","description":"A SHA256 hashed email address to generate fuzzed passwords for","example":"2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304"},"database_ids":{"type":"array","description":"A list of datbase IDs to generate fuzzed passwords","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]},"malware_ids":{"type":"array","description":"A list of malware IDs to generate fuzzed passwords","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]},"credential_list_ids":{"type":"array","description":"A list of credential list IDs to generate fuzzed passwords","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]},"fuzzing_intensity":{"type":"integer","description":"Fuzzing intensity level parameter, which ranges from 0 to 10, 0 being no fuzzing, only original password returned, and 10 being the biggest rule set that returns over 50,000 fuzzed passwords per original password.","default":1}}},"EmailsAtoFiltered":{"required":["emails_sha256"],"type":"object","properties":{"data":{"type":"array","description":"A list of SHA256 hashed email addresses together with source IDs to generate fuzzed passwords","items":{"type":"object","properties":{"email_sha256":{"type":"string","description":"A SHA256 hashed email address to generate fuzzed passwords for","example":"e9e7d0a8f5792167a054b4b1788fbe0bf0eb3d8ba8a6eee8ef42d3d7acb67f18"},"database_ids":{"type":"array","description":"A list of datbase IDs to generate fuzzed passwords","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]},"malware_ids":{"type":"array","description":"A list of malware IDs to generate fuzzed passwords","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]},"credential_list_ids":{"type":"array","description":"A list of credential list IDs to generate fuzzed passwords","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]}}}},"fuzzing_intensity":{"type":"integer","description":"Fuzzing intensity level parameter, which ranges from 0 to 10, 0 being no fuzzing, only original password returned, and 10 being the biggest rule set that returns over 50,000 fuzzed passwords per original password.","default":1,"example":1},"limit":{"description":"Default is the maximum limit of 5 records","type":"integer","example":10},"offset":{"type":"integer","example":0}}},"Phone":{"required":["data"],"type":"object","properties":{"phones_sha256":{"type":"array","description":"A list of SHA256 hashed phone numbers to lookup","items":{"type":"string"},"example":["2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304"]},"limit":{"description":"Default is the maximum limit of 100 records","type":"integer","example":10},"offset":{"type":"integer","example":0}}},"PhonesAto":{"required":["phones"],"type":"object","properties":{"phones_sha256":{"type":"array","description":"A list of SHA256 hashed phone numbers to generate fuzzed passwords","items":{"type":"string"},"example":["2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304"]},"fuzzing_intensity":{"type":"integer","description":"Fuzzing intensity level parameter, which ranges from 0 to 10, 0 being no fuzzing, only original password returned, and 10 being the biggest rule set that returns over 50,000 fuzzed passwords per original password.","default":0,"example":0},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"PhoneSample":{"type":"object","properties":{"id":{"type":"string","example":"631dadc9288c13b61bb83c480292c11154b35b5bb777a4946980de62f70477eb"},"phone":{"type":"string","example":"13855550193","description":"International format phone number"},"databases":{"type":"array","items":{"$ref":"#/components/schemas/DatabaseDataItem"}},"malware_logs":{"type":"array","items":{"$ref":"#/components/schemas/MalwareDataItem"}},"risk_assessment":{"$ref":"#/components/schemas/EmailSample/properties/risk_assessment"}}},"PhoneDatabasesSample":{"type":"object","properties":{"id":{"type":"string","example":"631dadc9288c13b61bb83c480292c11154b35b5bb777a4946980de62f70477eb"},"phone":{"type":"string","example":"13855550193","description":"International format phone number"},"databases":{"type":"array","items":{"$ref":"#/components/schemas/DatabaseDataItem"}}}},"PhoneMalwareLogsSample":{"type":"object","properties":{"id":{"type":"string","example":"631dadc9288c13b61bb83c480292c11154b35b5bb777a4946980de62f70477eb"},"phone":{"type":"string","example":"13855550193","description":"International format phone number"},"malware_logs":{"type":"array","items":{"$ref":"#/components/schemas/MalwareDataItem"}}}},"PhoneCredentialListsSample":{"type":"object","properties":{"id":{"type":"string","example":"631dadc9288c13b61bb83c480292c11154b35b5bb777a4946980de62f70477eb"},"phone":{"type":"string","example":"13855550193","description":"International format phone number"},"credential_lists":{"type":"array","items":{"$ref":"#/components/schemas/CredentialDataItem"}}}},"PhoneAtoPreventionSample":{"type":"object","properties":{"id":{"type":"string","example":"631dadc9288c13b61bb83c480292c11154b35b5bb777a4946980de62f70477eb"},"phone":{"type":"string","example":"13855550193","description":"International format phone number"},"password":{"type":"array","items":{"type":"string"},"example":["password1","password2"]}}},"PhonesSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/PhoneSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"PhonesDatabasesSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/PhoneDatabasesSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"PhonesMalwareLogsSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/PhoneMalwareLogsSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"PhonesCredentialListsSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/PhoneCredentialListsSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"PhonesAtoPreventionSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/PhoneAtoPreventionSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"MalwareDataItem":{"type":"object","properties":{"identifier":{"type":"string","description":"Malware identifier composed by malicious code","example":"US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]"},"id":{"type":"string","description":"Systemic hex ID of the record","example":"678e9e47098d6b3b44f75ec8"},"type":{"type":"string","description":"Name or brand of the infostealer (may be empty or unknown)","example":"risepro"},"published_date":{"type":"string","description":"Date that malware log has been published","example":"2025-01-20T19:04:39Z"},"data":{"type":"object","properties":{"credentials":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string","example":"https://login.example.com/path/to/login"},"cleaned_url":{"type":"string","example":"login.example.com"},"username":{"type":"string","example":"username"},"email":{"type":"string","example":"example@example.com"},"password":{"type":"string","example":"password1"},"application":{"type":"string","example":"Google Chrome"}}}},"cookies":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","example":"SEARCH_SAMESITE"},"value":{"type":"string","example":"CgQItZIB"},"path":{"type":"string","example":"/"},"domain":{"type":"string","example":"google.com"},"expires":{"type":"string","example":"2021-10-21T12:22:38Z"}}}},"autofills":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","example":"0000000000000000011"},"value":{"type":"string","example":"example@example.com"},"browser":{"type":"string","example":"Google Chrome"}}}},"grabbed_files":{"type":"array","items":{"type":"string","example":"/work/important.docx"}},"credit_cards":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","example":"John Doe"},"card_number":{"type":"string","example":"4111111111111111"},"cvv":{"type":"string","example":"123"},"expiration_date":{"type":"string","example":"12/25"}}}},"system_info":{"$ref":"#/components/schemas/MalwareLogSystemInfoSampleItem"},"metadata":{"type":"object","properties":{"incident_date":{"type":"string","example":"2021-05-26T08:19:13Z"},"emails":{"type":"array","items":{"type":"string","example":"example@example.com"}},"phones":{"type":"array","items":{"type":"string","example":"15551234567"}},"ips":{"type":"array","items":{"type":"string","example":"203.0.113.42"}},"hardware_id":{"type":"string","example":"89f3221e-2138-48c9-bbe2-8f68-806e6f6e6963"},"machine_id":{"type":"string","example":"89f3221e-2138-48c9-bbe2-ab615454c7ef"},"country":{"type":"string","example":"US"}}},"secret":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","example":"aws-access-token"},"values":{"type":"array","items":{"type":"string","example":"AKIAIOSFODNN7EXAMPLE"}}}}},"ftp":{"type":"array","items":{"type":"object","properties":{"host":{"type":"string","example":"ftp.example.com"},"port":{"type":"integer","example":21},"username":{"type":"string","example":"username"},"password":{"type":"string","example":"password1"},"applications":{"type":"array","items":{"type":"string","example":"FileZilla"}},"cert":{"type":"object","properties":{"data":{"type":"string","example":"abcd123123123123123123123"},"activation_time":{"type":"integer","example":1652227200},"expiration_time":{"type":"integer","example":1660089599},"host":{"type":"string","example":"ftp.example.com"},"port":{"type":"integer","example":21},"trust_sans":{"type":"integer","example":1}}}}}},"installed_software":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","example":"FileZilla Server"},"version":{"type":"string","example":"0.9.60"}}}},"process_list":{"type":"array","items":{"type":"object","properties":{"pid":{"type":"integer","example":11708},"name":{"type":"string","example":"uTorrent.exe"},"session_name":{"type":"string","example":"Console"},"cmd":{"type":"string","example":"C:\\Users\\steam\\AppData\\Roaming\\utorrent\\uTorrent.exe  /MINIMIZED"}}}},"rdp":{"type":"array","items":{"type":"object","properties":{"server":{"type":"string","example":"Yandex.Browser"},"username":{"type":"string","example":"username"},"password":{"type":"string","example":"password1"}}}},"rac":{"type":"array","items":{"type":"object","properties":{"private_key":{"type":"string","example":"-----BEGIN PRIVATE KEY----..***..-----END PRIVATE"},"certificate":{"type":"string","example":"-----BEGIN CERTIFICATE----..***..-----END CERTIFICATE"}}}},"ssh":{"type":"object","properties":{"known_hosts":{"type":"array","items":{"type":"object","properties":{"host":{"type":"string","example":"github.com"},"key_type":{"type":"string","example":"ssh-ed25519"},"key_value":{"type":"string","example":"AAAAC1NzaC2lZDI2NTE5AAAAIOMqqnkVzrm0SdG1UOoqKLsabgH5C9okWi1dh1l1GKJl"}}}},"keys":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","example":"id_ed25519.pub"},"type":{"type":"string","example":"public"},"value":{"type":"string","example":"AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"}}}}}},"vpn":{"type":"array","items":{"type":"object","properties":{"vpn_name":{"type":"string","example":"NordVPN"},"credentials":{"type":"array","items":{"type":"object","properties":{"username":{"type":"string","example":"username"},"password":{"type":"string","example":"password1"}}}},"user_config":{"type":"array","items":{"type":"string","example":"IsThreatProtectionTurnOffByConnection: False"}},"openvpn":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","example":"filename.ovpn"},"options":{"type":"array","items":{"type":"string","example":"cipher AES-256-CBC"}},"openvpn_certificates":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","example":"tls-crypt-v2"},"data":{"type":"string","example":"-----BEGIN CERTIFICATE----..***..-----END CERTIFICATE"}}}}}}}}}},"email_clients":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","example":"Mozilla Thunderbird"},"credentials":{"type":"array","items":{"type":"object","properties":{"server":{"type":"string","example":"imap.example.com"},"username":{"type":"string","example":"username"},"password":{"type":"string","example":"password1"}}}}}}},"downloads":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string","example":"https://example.com/download"},"file_path":{"type":"string","example":"/work/important.docx"},"browser":{"type":"string","example":"Google Chrome"}}}},"identification_level":{"type":"string","description":"Indicates how well the system information was identified during parsing. Empty string when value was not set","enum":["","identified","partially_identified","unidentified"],"example":"identified"}}},"risk_assessment":{"$ref":"#/components/schemas/EmailSample/properties/risk_assessment"}}},"MalwareDataItemLite":{"type":"object","properties":{"identifier":{"type":"string","description":"Malware identifier composed by malicious code","example":"US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]"},"id":{"type":"string","description":"Systemic hex ID of the record","example":"678e9e47098d6b3b44f75ec8"},"type":{"type":"string","description":"Name or brand of the infostealer (may be empty or unknown)","example":"risepro"},"published_date":{"type":"string","description":"Date that malware log has been published","example":"2025-01-20T19:04:39Z"},"data":{"type":"object","properties":{"credentials":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string","example":"https://login.example.com/path/to/login"},"cleaned_url":{"type":"string","example":"login.example.com"},"username":{"type":"string","example":"username"},"email":{"type":"string","example":"example@example.com"},"password":{"type":"string","example":"password1"},"application":{"type":"string","example":"Google Chrome"}}}}}}}},"MalwareLogSystemInfoSampleItem":{"type":"object","properties":{"ip":{"type":"string","example":"192.168.1.1"},"username":{"type":"string","example":"diego.lebon"},"country":{"type":"string","example":"US"},"zip":{"type":"string","example":"10001"},"location":{"type":"string","example":"New York, USA"},"hardware_id":{"type":"string","example":"89f3221e-2138-48c9-bbe2-8f68-806e6f6e6963"},"language":{"type":"string","example":"es-ES"},"timezone":{"type":"string","example":"UTC1"},"os":{"type":"string","example":"Windows 10 Pro [x64]"},"system_name":{"type":"string","example":"DESKTOP-42R6V1I"},"guid":{"type":"string","example":"91788e64-8fdf-11eb-8f68-806e6f6e6963"},"machine_id":{"type":"string","example":"89f3221e-2138-48c9-bbe2-ab615454c7ef"},"date":{"type":"string","example":"2021-05-26T08:19:13Z"},"execution_path":{"type":"string","example":"C:\\Program Files\\Example\\example.exe"},"antivirus_software":{"type":"array","items":{"type":"string","example":"Norton Antivirus"}},"work_dir":{"type":"string","example":"C:\\Users\\appdata"},"oem_id":{"type":"string","example":"00000000-0000-0000-0000-0000"},"screen_size":{"type":"string","example":"1920x1080"},"uac":{"type":"string","example":"AllowAll"},"process_elevation":{"type":"boolean","example":true},"keyboard_layouts":{"type":"array","items":{"type":"string","example":"English (United States)"}},"hardwares":{"type":"array","items":{"type":"string","example":"Intel(R) Core(TM) i7-9700 CPU @ 3.00GHz"}}}},"CredentialDataItem":{"type":"object","properties":{"id":{"type":"string","description":"Systemic hex ID of the record","example":"66c4d3912b183418f7743576"},"passwords":{"type":"array","items":{"type":"string"},"example":["password1","password2"]},"published_date":{"type":"string","description":"Date when the credential list data was published onto the asset","example":"2025-01-20T19:04:39Z"},"combos":{"type":"array","items":{"type":"object","properties":{"domain":{"type":"string","example":"example.com"},"password":{"type":"string","example":"password1"},"url":{"type":"string","example":"https://example.com/login"}}}},"risk_assessment":{"$ref":"#/components/schemas/EmailSample/properties/risk_assessment"}}},"DatabaseDataItem":{"type":"object","properties":{"identifier":{"type":"string","description":"Identifier in the following format {domain}_{top level domain}","example":"example_com"},"id":{"type":"string","description":"Systemic hex ID of the record","example":"66c4d3912b183418f7743576"},"published_date":{"type":"string","description":"Date when the database data was published onto the asset","example":"2025-01-20T19:04:39Z"},"data":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string","description":"Key of the data point, complete list can be found [HERE](https://docs.nordstellar.com/enterprise-apis/product-integrations/data-categories#data-points)","example":"password"},"value":{"type":"array","items":{"type":"string"},"description":"Value of the data point","example":["password1","password2"]}}}},"risk_assessment":{"$ref":"#/components/schemas/EmailSample/properties/risk_assessment"}}},"Databases":{"type":"object","properties":{"ids":{"type":"array","description":"A list of database IDs to lookup.\nID should consist of 24 hexadecimal digits.","items":{"type":"string"},"example":["5f4e1f2e4b1d4d4e4b1d4d4e","5f4e1f2e4b1d4d4e4b1d4d4f"]},"published_date_from":{"type":"string","description":"A date from filter. Has to be in ISO 8601 format YYYY-MM-DD","example":"2021-01-01"},"published_date_to":{"type":"string","description":"A date to filter. Has to be in ISO 8601 format YYYY-MM-DD. Default is todays date","example":"2021-01-02"},"limit":{"description":"Default is the maximum limit of 1000 records","type":"integer","example":10},"offset":{"type":"integer","example":0}}},"CredentialListSample":{"type":"object","properties":{"id":{"type":"string","description":"Systemic hex ID of the record","example":"63bec0fab4f037082c187d70"},"type":{"type":"string","description":"Credential list type - combo_list or ato_list. ATO list is a list of credentials that have a target domain","example":"combo_list"},"date_created":{"type":"string","example":"2023-01-01T00:00:00Z"},"domain":{"type":"string","example":"example.com"},"valid_credential_count":{"type":"integer","example":99923}}},"CredentialListsSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/CredentialListSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"DatabaseSample":{"type":"object","properties":{"identifier":{"type":"string","description":"Identifier in the following format {domain}_{top level domain}","example":"example_com"},"id":{"type":"string","description":"Systemic hex ID of the record","example":"6698de5af71724f56f4076df"},"breach_date":{"type":"string","example":"2024-01-16T00:00:00Z"},"data_keys":{"type":"array","items":{"type":"string"},"description":"List of data keys that are exposed in the database, all possible values can be found [HERE](https://docs.nordstellar.com/enterprise-apis/product-integrations/data-categories#data-points)","example":["alternate_email","bio","email","homepage","name","profile_picture","username"]},"description":{"type":"string","example":"On July 18, 2024, a database related to the example.com website was found circulating the web. The potential data leak reportedly occurred on January 16, 2024. Over 15 million email addresses were exposed, together with social media, credential and personal data. Leaked records include username, name, home page, bio, Parent email address and Profile picture's URL. The validity of the data exposed couldn't be verified. Yet we're still informing you about a potential data leak – but keep in mind there's a chance of it being a false positive."},"logo_url":{"type":"string","example":null},"name":{"type":"string","example":"example.com"},"published_date":{"type":"string","example":"2024-07-18T09:20:26Z"},"unique_email_count":{"type":"integer","example":15111576},"unique_phone_count":{"type":"integer","example":123516},"type":{"type":"string","description":"Type of the database - identified (has a domain or name), unidentified or collection","example":"identified"},"domain":{"type":"string","example":"example.com"}}},"DatabasesSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/DatabaseSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"MalwareLogSample":{"$ref":"#/components/schemas/MalwareDataItem"},"MalwareLogsSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/MalwareDataItem"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"MalwareLogSecretSample":{"type":"object","properties":{"identifier":{"type":"string","description":"Malware identifier composed by malicious code","example":"US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]"},"id":{"type":"string","description":"Systemic hex ID of the record","example":"678e9e47098d6b3b44f75ec8"},"type":{"type":"string","description":"Name or brand of the infostealer (may be empty or unknown)","example":"risepro"},"incident_date":{"type":"string","description":"Date of the infection","example":"2025-01-20T19:04:39Z"},"published_date":{"type":"string","description":"Date that malware log has been published","example":"2025-01-22T19:04:39Z"},"secrets":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","example":"aws-secret-key"},"values":{"type":"array","items":{"type":"string","example":"ABCDEFGH12345678"}}}}},"system_info":{"$ref":"#/components/schemas/MalwareLogSystemInfoSampleItem"}}},"MalwareLogsSecretsFeedSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/MalwareLogSecretSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"EmailAtoPreventionSample":{"type":"object","properties":{"id":{"type":"string","example":"2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3"},"email":{"type":"string","example":"email@example.com"},"password":{"type":"array","items":{"type":"string"},"example":["password1","password2"]}}},"EmailStatistics":{"type":"object","properties":{"unique_email_count":{"type":"integer","description":"Number of unique email addresses that were affected by any incident (This number is always **1** for single email statistics)","example":1},"unique_password_count":{"type":"integer","description":"Number of unique passwords","example":3},"password_count":{"type":"integer","description":"Total number of passwords","example":5},"breached_email_count":{"type":"integer","description":"Total number of email appearances in data breaches","example":4},"malware_affected_email_count":{"type":"integer","description":"Total number of email appearances in malware infections","example":1},"stolen_email_count":{"type":"integer","description":"Total number of email appearances in stolen credential lists","example":2},"database_count":{"type":"integer","description":"Number of unique data breaches that this email appears in","example":3},"malware_infection_count":{"type":"integer","description":"Number of unique malware infections that this email appears in","example":1},"credential_list_count":{"type":"integer","description":"Number of unique stolen credential lists that this email appears in","example":2}}},"EmailsAtoPreventionSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EmailAtoPreventionSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"ZeroKnowledgePasswordSample":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"hash":{"type":"string","example":"961b6dd3ede3cb8ecbaacbd68de040cd78eb2ed5889130cceb4c49268ea4d506"},"count":{"type":"integer","example":11534}}}}}},"ZeroKnowledgePasswordsSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ZeroKnowledgePasswordSample"}}}},"ZeroKnowledgeSaltSample":{"type":"object","properties":{"sha256_prefix":{"type":"string","example":"915af","description":"Corresponding input for generated salt"},"salt":{"type":"string","description":"Zero knowledge lookup salt, calculated using request input","example":"0e4f4b0e81bad42097299d18869f8d7f"}}},"ZeroKnowledgeSaltsEndpoint":{"required":["sha256_prefixes"],"type":"object","properties":{"sha256_prefixes":{"type":"array","description":"A list of first 5 symbols of SHA256 hashes of the lookup values","items":{"type":"string"},"example":["00000","fffff"]}}},"ZeroKnowledgeSaltsSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ZeroKnowledgeSaltSample"}}}},"ZeroKnowledgeCookieSample":{"type":"object","properties":{"hash":{"type":"string","description":"SHA256 hash of the cookie *value*","example":"2f8785a49e0e3f5652784701f97474b3ddf7b2a92c8572fc3111eab716349218"},"name":{"type":"string","description":"Cookie name","example":"auth-token"},"path":{"type":"string","description":"Cookie path","example":"/"},"domain":{"type":"string","description":"Cookie domain name","example":"twitch.tv"},"expiry_date":{"type":"string","description":"Cookie expiration date","example":"2025-07-21T18:05:22Z"},"data":{"type":"array","description":"Contains data grouped by **origin**.","items":{"type":"object","properties":{"origin":{"type":"string","example":"malware_logs","description":"Contains data origin (Currently only **malware_logs**)"},"data":{"type":"array","description":"Contains origin items with leaked data keys.","items":{"type":"object","properties":{"id":{"type":"string","description":"Origin record id.","example":"66c4d3912b183418f7743576"},"compromised_data":{"type":"array","description":"Compromised data keys","items":{"type":"string"},"example":["saved_credentials","cookies","autofill_information"]}}}}}}}}},"ZeroKnowledgeCookiesSample":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ZeroKnowledgeCookieSample"}}}},"ZeroKnowledgePartialCreditCardsSample":{"type":"object","properties":{"count":{"type":"integer","description":"Count of compromised credit cards that match partial hash","example":10}}},"HashRangesSample":{"required":["hash_ranges","hash_type"],"type":"object","properties":{"hash_ranges":{"type":"array","description":"A list of hash ranges (5 hexadecimal characters) to lookup zero knowledge data","items":{"type":"string"},"example":["00000","fffff"]},"hash_type":{"type":"string","description":"One of the following: **sha1**, **argon2id**.   When using **argon2id**, follow these steps:\n1. **Produce a SHA-256 hash** of the initial value.  \n\n2. **Retrieve the secret salt**  \n   - Take the first 5 characters of the SHA-256 hex string.  \n   - Call the endpoint: **/v3/data/zero-knowledge/salt/{first5}**.  \n   - The endpoint returns JSON containing the salt.\n   - ⚠️ The `salt` field is a **hex-encoded string**.  \n     You must decode it to raw bytes (e.g. `bytes.fromhex(salt)` in Python).  \n     Do **not** use the string value directly as text (`salt.encode(...)`) because it will produce a different final hash.\n\n\n3. **Derive the Argon2id hash** \n   - Input: Initial raw value (not the SHA-256 hash)\n   - Algorithm: **argon2id**  \n   - Parameters:  \n     - Memory: **64 MB (65536 KiB)**  \n     - Iterations: **4**  \n     - Parallelism: **1**  \n     - Key Length: **32 bytes**  \n     - Salt: the raw bytes from step 2  \n   - The output must be the **bare hex-encoded digest** (no Argon2 parameters).  \n\n\n4. **Use the produced hash** to query zero-knowledge endpoints.","example":"argon2id"},"limit":{"description":"Default is the maximum limit of 500 records","type":"integer","example":10},"offset":{"type":"integer","example":0}}},"PasswordHashRangesSample":{"required":["data"],"type":"object","properties":{"hash_ranges":{"type":"array","description":"A list of hash ranges (6 hexadecimal characters) to lookup zero knowledge data","items":{"type":"string"},"example":["000000","ffffff"]},"hash_type":{"type":"string","description":"Currently only **sha256** is supported.","example":"sha256"}}},"Subscription":{"required":["document_type","document_identifier"],"type":"object","properties":{"subscription_type":{"type":"string","description":"Subscription type - **email-sha256**, **phone-sha256** or **domain**","example":"email-sha256"},"subscription_identifier":{"type":"string","description":"Subscribed document identifier - domain, SHA-256 hashed email address or SHA-256 hashed phone number (only digits)","example":"2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304"},"dispatch_on_update":{"type":"boolean","description":"Dispatch alert on existing data breach updates, e.g. when more data keys are added to the data","example":false}}},"AssetSubscription":{"required":["subscription_identifier"],"type":"object","properties":{"subscription_identifier":{"type":"string","description":"**SHA-256** hashed email address or phone number (only digits)","example":"2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304"},"dispatch_on_update":{"type":"boolean","description":"Dispatch alert on existing data breach updates, e.g. when more data keys are added to the data","example":false}}},"DomainSubscription":{"required":["subscription_identifier"],"type":"object","properties":{"subscription_identifier":{"type":"string","description":"Raw email address domain, e.g. \"example.com\"","example":"example.com"},"dispatch_on_update":{"type":"boolean","description":"Dispatch alert on existing data breach updates, e.g. when more data keys are added to the data","example":false}}},"ZKSubscription":{"required":["subscription_identifier"],"type":"object","properties":{"subscription_identifier":{"type":"string","description":"**Argon2ID** or **SHA1** hashed credit card or national ID number.","example":"2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304"},"dispatch_on_update":{"type":"boolean","description":"Dispatch alert on existing data breach updates, e.g. when more data keys are added to the data","example":false}}},"AssetSubscriptions":{"required":["subscription_identifier"],"type":"object","properties":{"subscription_identifiers":{"type":"array","description":"Up to 200 **SHA-256** hashed email addresses or phone numbers (only digits)","items":{"type":"string"},"example":["2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304"]},"dispatch_on_update":{"type":"boolean","description":"Dispatch alert on existing data breach updates, e.g. when more data keys are added to the data","example":false}}},"DomainSubscriptions":{"required":["subscription_identifier"],"type":"object","properties":{"subscription_identifiers":{"type":"array","description":"Up to 200 raw email address domains, e.g. [\"example.com\", \"example.org\"]","items":{"type":"string"},"example":["example.com","example.org"]},"dispatch_on_update":{"type":"boolean","description":"Dispatch alert on existing data breach updates, e.g. when more data keys are added to the data","example":false}}},"ZKSubscriptions":{"required":["subscription_identifier"],"type":"object","properties":{"subscription_identifiers":{"type":"array","description":"Up to 200 **Argon2ID** or **SHA1** hashed credit cards or national ID numbers.","items":{"type":"string"},"example":["2fc8583f3be53fcf1a6e0f972869478e392ef2a6f62b7b3735ca53af921ea304"]},"dispatch_on_update":{"type":"boolean","description":"Dispatch alert on existing data breach updates, e.g. when more data keys are added to the data","example":false}}},"SubscriptionSample":{"type":"object","properties":{"id":{"type":"string","description":"Subscription ID","example":"507f1f77bcf86cd799439011"},"subscription_type":{"type":"string","description":"Subscription type - **domain**, **email-sha256**, **phone-sha256**, **cc-argon2id**, **nin-argon2id**, **cc-sha1** or **nin-sha1**","example":"email-sha256"},"subscription_identifier":{"type":"string","description":"Subscription identifier - domain, SHA-256 hashed email address, SHA-256 hashed phone number (only digits), Argon2ID or SHA-1 hashed credit card number or Argon2ID or SHA-1 hashed national identification number"},"date_created":{"type":"string"},"dispatch_on_update":{"type":"boolean","description":"Dispatch alert on existing data breach updates, e.g. when more data keys are added to the data","example":true}}},"SubscriptionsSample":{"type":"object","properties":{"subscriptions":{"type":"array","items":{"$ref":"#/components/schemas/SubscriptionSample"}},"limit":{"type":"integer","example":10},"offset":{"type":"integer","example":0}}},"CreatedSubscriptionsSample":{"type":"object","properties":{"subscriptions":{"type":"array","items":{"$ref":"#/components/schemas/SubscriptionSample"}}}},"SubscriptionEndpoint":{"required":["endpoint-url"],"type":"object","properties":{"url":{"type":"string","description":"Subscription webhook endpoint URL","example":"https://example.com/webhook"},"username":{"type":"string","description":"Subscription webhook endpoint BasicAuth username","example":"username"},"password":{"type":"string","description":"Subscription webhook endpoint BasicAuth password (hidden)","example":"password"}}},"SubscriptionEndpointSample":{"type":"object","properties":{"url":{"type":"string","example":"https://api.example.com/v1/subscriptions/webhook"},"username":{"type":"string","example":"username"},"password":{"type":"string","example":"password123"}}},"ForumSearchRequest":{"type":"object","properties":{"query":{"$ref":"#/components/schemas/SearchQuery"},"highlight_params":{"$ref":"#/components/schemas/HighlightParams"},"pagination":{"$ref":"#/components/schemas/Pagination"}}},"TelegramSearchRequest":{"type":"object","properties":{"query":{"$ref":"#/components/schemas/SearchQuery"},"highlight_params":{"$ref":"#/components/schemas/HighlightParams"},"pagination":{"$ref":"#/components/schemas/Pagination"}}},"RansomwareSearchRequest":{"type":"object","properties":{"query":{"$ref":"#/components/schemas/SearchQuery"},"highlight_params":{"$ref":"#/components/schemas/HighlightParams"},"pagination":{"$ref":"#/components/schemas/Pagination"}}},"MarketplaceSearchRequest":{"type":"object","properties":{"query":{"$ref":"#/components/schemas/SearchQuery"},"highlight_params":{"$ref":"#/components/schemas/HighlightParams"},"pagination":{"$ref":"#/components/schemas/Pagination"}}},"TagsSearchRequest":{"required":["source_types"],"type":"object","properties":{"source_types":{"type":"array","description":"List of source types\nEnum values:\n- 0 - SOURCE_TYPE_UNSPECIFIED\n- 1 - SOURCE_TYPE_FORUM\n- 2 - SOURCE_TYPE_TELEGRAM\n- 3 - SOURCE_TYPE_RANSOMWARE\n- 4 - SOURCE_TYPE_MARKETPLACE\n","items":{"type":"integer","enum":[0,1,2,3,4]}}}},"ScreenshotRequest":{"required":["source_type","identifier"],"type":"object","properties":{"source_type":{"type":"integer","enum":[0,1,2,3,4],"description":"List of source types\nEnum values:\n- 0 - SOURCE_TYPE_UNSPECIFIED\n- 1 - SOURCE_TYPE_FORUM\n- 2 - SOURCE_TYPE_TELEGRAM\n- 3 - SOURCE_TYPE_RANSOMWARE\n- 4 - SOURCE_TYPE_MARKETPLACE\n"},"identifier":{"type":"string","description":"Identifier for the scraped content"},"properties":{"description":"Parameters for the image resizing (optional)","$ref":"#/components/schemas/ImageProperties"}}},"ForumSearchResponse":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ForumThread"}},"total_results":{"type":"integer","description":"Total number of records found"}}},"TelegramSearchResponse":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/TelegramMessage"}},"total_results":{"type":"integer","description":"Total number of records found"}}},"RansomwareSearchResponse":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/RansomwareIncident"}},"total_results":{"type":"integer","description":"Total number of records found"}}},"MarketplaceSearchResponse":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/MarketplacePost"}},"total_results":{"type":"integer","description":"Total number of records found"}}},"TagsResponse":{"type":"object","properties":{"tags":{"type":"array","description":"List of scraped content tags based on type","items":{"type":"string"}}}},"ForumThread":{"type":"object","properties":{"id":{"type":"string","description":"Internal ID of the record"},"content":{"$ref":"#/components/schemas/ScrapedContent"},"metadata":{"$ref":"#/components/schemas/ScrapedContentMetadata"},"target_data":{"$ref":"#/components/schemas/WebTargetData"}}},"RansomwareIncident":{"type":"object","properties":{"id":{"type":"string","description":"Internal ID of the record"},"external_id":{"type":"integer","description":"External ID of the incident"},"ai_description":{"type":"string","description":"Description of the incident generated by AI"},"content":{"$ref":"#/components/schemas/ScrapedContent"},"ransom_data":{"$ref":"#/components/schemas/RansomData"},"metadata":{"$ref":"#/components/schemas/ScrapedContentMetadata"},"target_data":{"$ref":"#/components/schemas/WebTargetData"},"enrichment_data":{"description":"Company enrichment data of the incident victim","$ref":"#/components/schemas/EnrichmentData"}}},"EnrichmentData":{"type":"object","properties":{"name":{"type":"string","description":"Name of the company"},"domain":{"type":"string","description":"Domain of the company"},"website":{"type":"string","description":"Website of the company"},"industry":{"type":"string","description":"Industry of the company (Raw string, unprocessed)"},"type":{"type":"string","description":"Type of the company (Private, LLD, etc.) (Raw string, unprocessed)"},"size_range":{"type":"string","description":"Size range of the company - \"1-10 employees\", \"11-50 employees\", etc."},"revenue_range":{"type":"string","description":"Revenue range of the company - \"$1M-$10M\", \"$10M-$50M\", etc. including currency sign"},"company_logo_base64":{"type":"string","description":"Base64 encoded company logo. 50x50px"},"location":{"$ref":"#/components/schemas/LocationData","description":"Enrichment location data"},"socials":{"type":"array","description":"List of social media URLs associated with the company","items":{"$ref":"#/components/schemas/SocialMediaURL"}}}},"LocationData":{"type":"object","properties":{"country":{"type":"string","description":"Country name of the company"},"country_iso2":{"type":"string","description":"Country ISO2 code"},"location":{"type":"string","description":"Country, city & state of the company"},"full_address":{"type":"string","description":"Full address including street, city, state, country, and postal code"}}},"RansomData":{"type":"object","properties":{"claim_url":{"type":"string","description":"Complete ransomware incident claim URL"},"victim_name":{"type":"string","description":"Name of the ransomware victim organization"},"victim_domain":{"type":"string","description":"Domain name of the ransomware victim organization website"}}},"ScrapedContent":{"type":"object","properties":{"title":{"type":"string","description":"Title of the content (Forum thread name, Telegram message caption or ransomware incident title)"},"content":{"type":"string","description":"Scraped content (Forum thread content with stripped HTML tags, Telegram message text or external ransomware incident description)"},"content_hash":{"type":"string","description":"SHA256 hash of the content (In forums & Telegram)"},"extracted_links":{"type":"array","description":"List of extracted links from the content (In forums & Telegram)","items":{"type":"string"}},"extracted_domains":{"type":"array","description":"List of extracted domains from the content (In forums & Telegram)","items":{"type":"string"}},"author_name":{"type":"string","description":"Name of the author of the content (Attacker group name in ransomware incidents or forum user name)"},"author_url":{"type":"string","description":"URL of the author's profile (In forums & ransomware incidents - attacker group blog URL or forum user profile URL)"},"external_author_id":{"type":"integer","description":"External ID of the author (Only in Telegram)"},"date_posted":{"type":"string","description":"Date when the content was posted"},"url":{"type":"string","description":"URL of the content"},"onion_url":{"type":"string","description":"Onion URL of the content (Only in forums)"},"url_hash":{"type":"string","description":"Hash of the URL"}}},"SocialMediaURL":{"type":"object","properties":{"platform":{"type":"integer","enum":[0,1,2,3,4,5,6,7,8,9,10,11],"description":"List of social media types\nEnum values:\n- 0 -  SOCIAL_MEDIA_PLATFORM_UNSPECIFIED\n- 1 -  SOCIAL_MEDIA_PLATFORM_FACEBOOK\n- 2 -  SOCIAL_MEDIA_PLATFORM_LINKEDIN\n- 3 -  SOCIAL_MEDIA_PLATFORM_TWITTER\n- 4 -  SOCIAL_MEDIA_PLATFORM_CRUNCHBASE\n- 5 -  SOCIAL_MEDIA_PLATFORM_INSTAGRAM\n- 6 -  SOCIAL_MEDIA_PLATFORM_YOUTUBE\n- 7 -  SOCIAL_MEDIA_PLATFORM_GITHUB\n- 8 -  SOCIAL_MEDIA_PLATFORM_REDDIT\n- 9 -  SOCIAL_MEDIA_PLATFORM_DISCORD\n- 10 - SOCIAL_MEDIA_PLATFORM_PINTEREST\n- 11 - SOCIAL_MEDIA_PLATFORM_TIKTOK\n"},"url":{"type":"string","description":"URL of the social media profile"}}},"ScrapedContentMetadata":{"type":"object","properties":{"tags":{"type":"array","description":"List of tags associated with the content","items":{"type":"string"}},"date_scraped":{"type":"string","description":"Date when the record was scraped"},"date_updated":{"type":"string","description":"Date when the record was last updated"},"screenshot_identifier":{"type":"string","description":"Identifier for scraped content screenshot retrieval"}}},"WebTargetData":{"type":"object","properties":{"site_url":{"type":"string","description":"URL of the web target from which the content was scraped"},"site_domain_name":{"type":"string","description":"Domain name of the web target (Only in forums)"},"onion_domain_name":{"type":"string","description":"Onion name of the web target (Only in forums)"},"site_subdomain_url":{"type":"string","description":"Subdomain URL of the web target (Only in forums)"},"display_name":{"type":"string","description":"Display name of the target from which the content was scraped"}}},"TelegramMessage":{"type":"object","properties":{"id":{"type":"string","description":"Internal ID of the record"},"external_id":{"type":"integer","description":"External ID of the message (in Telegram API)"},"content":{"$ref":"#/components/schemas/ScrapedContent"},"metadata":{"$ref":"#/components/schemas/ScrapedContentMetadata"},"target_data":{"$ref":"#/components/schemas/TelegramTargetData"},"file_data":{"$ref":"#/components/schemas/TelegramFileData"}}},"TelegramFileData":{"type":"object","properties":{"file_name":{"type":"string","description":"Name of the file attached to the message"},"file_size_bytes":{"type":"integer","description":"Size of the file attached to the message"}}},"TelegramTargetData":{"type":"object","properties":{"external_channel_id":{"type":"integer","description":"External ID of the Telegram channel"},"channel_name":{"type":"string","description":"Name of the Telegram channel"},"channel_identifier":{"type":"string","description":"Identifier of the Telegram channel"}}},"MarketplacePost":{"type":"object","properties":{"id":{"type":"string","description":"Internal ID of the record"},"display_price":{"type":"string","description":"Display price of the marketplace post (with currency)"},"type":{"type":"array","description":"List of marketplace types\nEnum values:\n- 0 - MARKETPLACE_TYPE_UNSPECIFIED\n- 1 - MARKETPLACE_TYPE_LOGS\n- 2 - MARKETPLACE_TYPE_CREDIT_CARDS\n- 3 - MARKETPLACE_TYPE_HOSTS\n- 4 - MARKETPLACE_TYPE_SEND\n- 5 - MARKETPLACE_TYPE_WEB_MAIL\n- 6 - MARKETPLACE_TYPE_LEADS\n- 7 - MARKETPLACE_TYPE_ACCOUNTS\n- 8 - MARKETPLACE_TYPE_OTHER","items":{"type":"integer","enum":[0,1,2,3,4,5,6,7,8]}},"content":{"$ref":"#/components/schemas/ScrapedContent"},"metadata":{"$ref":"#/components/schemas/ScrapedContentMetadata"},"target_data":{"$ref":"#/components/schemas/WebTargetData"}}},"Error":{"type":"object","properties":{"errors":{"type":"object","properties":{"body":{"type":"string","description":"Error description"}}}}},"DateRange":{"type":"object","properties":{"date_from":{"type":"string","description":"Start date of the range.\nSupported date formats:\n- \"2006-01-02T15:04:05Z\"\n- \"2006-01-02 15:04:05 -0700 MST\"\n- \"2006-01-02 15:04:05\"\n"},"date_to":{"type":"string","description":"End date of the range.\nSupported date formats:\n- \"2006-01-02T15:04:05Z\"\n- \"2006-01-02 15:04:05 -0700 MST\"\n- \"2006-01-02 15:04:05\"\n"},"mode":{"type":"string","enum":["DATE_RANGE_MODE_UNSPECIFIED","DATE_RANGE_MODE_INCLUDE","DATE_RANGE_MODE_EXCLUDE"],"default":"DATE_RANGE_MODE_UNSPECIFIED","description":"Filter mode for the date range.\n- UNSPECIFIED/INCLUDE: results within [date_from, date_to] (default, current behavior).\n- EXCLUDE: results outside the range (date < date_from OR date > date_to).\nOpen-ended ranges are supported independently per bound:\nonly date_from set — INCLUDE: date >= date_from, EXCLUDE: date < date_from.\nOnly date_to set — INCLUDE: date <= date_to, EXCLUDE: date > date_to.\n"}}},"Pagination":{"type":"object","properties":{"limit":{"type":"integer","description":"The number of items to return (Max 100)"},"offset":{"type":"integer","description":"The number of items to skip"}}},"SearchQuery":{"type":"object","description":"Object that is used for Lucene query & date filtering in the search request","properties":{"query":{"type":"string","description":"The search query string in Lucene syntax\nAvailable fields in the query:\n- \"tags\"\n- \"content\"\n- \"title\"\n- \"author_name\"\n- \"channel_name\" (Telegram only)\n- \"site_domain_name\" (Forums only)\n"},"date_posted_range":{"$ref":"#/components/schemas/DateRange"},"date_scraped_range":{"$ref":"#/components/schemas/DateRange"}}},"ImageProperties":{"type":"object","properties":{"width":{"type":"integer","description":"Width of the resized image (Max 3841)"},"height":{"type":"integer","description":"Height of the resized image (Max 2161)"},"quality":{"type":"integer","description":"Quality ratio of the resized image (Max 100)"}}},"HighlightParams":{"type":"object","description":"Optional object that is used for matched phrase highlights in the search results.\nAll keywords that are matched by the query will be wrapped with passed starting and ending tags.\nHighlighting is applied on all of the fields the phrase is matched in.\n","properties":{"pre_tags":{"type":"array","description":"List of opening wrapper tags (applied in the order they are listed)","items":{"type":"string","enum":["<span class='text-highlight'>"]}},"post_tags":{"type":"array","description":"List of closing wrapper tags (applied in the reverse order)","items":{"type":"string","enum":["</span>"]}}}}},"parameters":{"HashRange":{"name":"hash-range","in":"path","required":true,"schema":{"type":"string"}},"HashType":{"name":"hash-type","in":"path","required":true,"description":"One of the following: **sha1**, **argon2id**.   When using **argon2id**, follow these steps:\n1. **Produce a SHA-256 hash** of the initial value.  \n\n2. **Retrieve the secret salt**  \n   - Take the first 5 characters of the SHA-256 hex string.  \n   - Call the endpoint: **/v3/data/zero-knowledge/salt/{first5}**.  \n   - The endpoint returns JSON containing the salt.\n   - ⚠️ The `salt` field is a **hex-encoded string**.  \n     You must decode it to raw bytes (e.g. `bytes.fromhex(salt)` in Python).  \n     Do **not** use the string value directly as text (`salt.encode(...)`) because it will produce a different final hash.\n\n\n3. **Derive the Argon2id hash** \n   - Input: Initial raw value (not the SHA-256 hash)\n   - Algorithm: **argon2id**  \n   - Parameters:  \n     - Memory: **64 MB (65536 KiB)**  \n     - Iterations: **4**  \n     - Parallelism: **1**  \n     - Key Length: **32 bytes**  \n     - Salt: the raw bytes from step 2  \n   - The output must be the **bare hex-encoded digest** (no Argon2 parameters).  \n\n\n4. **Use the produced hash** to query zero-knowledge endpoints.  ","schema":{"type":"string"}},"Domain":{"name":"domain","in":"path","required":true,"schema":{"type":"string"}},"Email":{"name":"email-sha256","in":"path","required":true,"description":"Hashed lower-cased email address using SHA256 algorithm","schema":{"type":"string"}},"Phone":{"name":"phone-sha256","in":"path","required":true,"description":"Hashed phone number using SHA256 algorithm","schema":{"type":"string"}},"HexId":{"name":"id","in":"path","required":true,"description":"Record ID to lookup. ID should consist of 24 hexadecimal digits.","schema":{"type":"string"}},"Url":{"name":"credentials_url","in":"path","required":true,"description":"Credentials URL that must be sanitized, excluding protocols and any extraneous details.","schema":{"type":"string"}},"SubscriptionId":{"name":"id","in":"path","required":true,"description":"Subscription ID which was provided upon subscription creation","schema":{"type":"string"}},"TokenId":{"name":"id","in":"path","required":true,"description":"A token id to lookup.","schema":{"type":"string"}},"Hash":{"name":"hash","in":"path","required":true,"schema":{"type":"string"}},"Limit":{"name":"limit","in":"query","description":"Limit the count of records in results","required":false,"schema":{"type":"integer"}},"Offset":{"name":"offset","in":"query","description":"Offset the results by an integer","schema":{"type":"integer"}},"FuzzingIntensity":{"name":"fuzzing-intensity","in":"query","description":"Fuzzing intensity level parameter, which ranges from 0 to 10, 0 being no fuzzing, only original password returned, and 10 being the biggest rule set that returns over 50,000 fuzzed passwords per original password.","schema":{"type":"integer"}},"Hashed":{"name":"hashed","in":"query","description":"If querying with SHA256 hashed values, set this as True","schema":{"type":"boolean"}},"HashPrefix":{"name":"sha256-prefix","in":"path","required":true,"description":"First 5 symbols of SHA256 hash of the lookup value","schema":{"type":"string"}},"SecretType":{"name":"type","in":"path","required":true,"description":"Any of the following: \n  - 1password-secret-key\n  - 1password-service-account-token\n  - adafruit-api-key\n  - adobe-client-id\n  - adobe-client-secret\n  - age-secret-key\n  - airtable-api-key\n  - airtable-personnal-access-token\n  - algolia-api-key\n  - alibaba-access-key-id\n  - alibaba-secret-key\n  - anthropic-admin-api-key\n  - anthropic-api-key\n  - artifactory-api-key\n  - artifactory-reference-token\n  - asana-client-id\n  - asana-client-secret\n  - assemblyai-api-key\n  - atlassian-api-token\n  - authress-service-client-access-key\n  - aws-access-token\n  - aws-amazon-bedrock-api-key-long-lived\n  - aws-amazon-bedrock-api-key-short-lived\n  - aws-secret-key\n  - azure-ad-client-secret\n  - beamer-api-token\n  - bitbucket-client-id\n  - bitbucket-client-secret\n  - bittrex-access-key\n  - bittrex-secret-key\n  - cerebras-api-key\n  - cisco-meraki-api-key\n  - clickhouse-cloud-api-secret-key\n  - clojars-api-token\n  - cloudflare-api-key\n  - cloudflare-global-api-key\n  - cloudflare-origin-ca-key\n  - codecov-access-token\n  - cohere-api-token\n  - coinbase-access-token\n  - confluent-access-token\n  - confluent-secret-key\n  - contentful-delivery-api-token\n  - curl-auth-header\n  - curl-auth-user\n  - cursor-api-key\n  - databricks-api-token\n  - datadog-access-token\n  - deepgram-api-key\n  - deepseek-api-key\n  - defined-networking-api-token\n  - digitalocean-access-token\n  - digitalocean-pat\n  - digitalocean-refresh-token\n  - discord-api-token\n  - discord-client-id\n  - discord-client-secret\n  - doppler-api-token\n  - droneci-access-token\n  - dropbox-api-token\n  - dropbox-long-lived-api-token\n  - dropbox-short-lived-api-token\n  - duffel-api-token\n  - dynatrace-api-token\n  - easypost-api-token\n  - easypost-test-api-token\n  - elevenlabs-api-key\n  - endorlabs-api-key\n  - endorlabs-api-secret\n  - etsy-access-token\n  - facebook-access-token\n  - facebook-page-access-token\n  - facebook-secret\n  - fastly-api-token\n  - figma-personal-access-header-token\n  - figma-personal-access-token\n  - finicity-api-token\n  - finicity-client-secret\n  - finnhub-access-token\n  - flickr-access-token\n  - flutterwave-encryption-key\n  - flutterwave-public-key\n  - flutterwave-secret-key\n  - flyio-access-token\n  - frameio-api-token\n  - freemius-secret-key\n  - freshbooks-access-token\n  - gcp-api-key\n  - gcp-service-account-json\n  - gitea-access-token\n  - github-app-token\n  - github-fine-grained-pat\n  - github-oauth\n  - github-pat\n  - github-refresh-token\n  - gitlab-cicd-job-token\n  - gitlab-deploy-token\n  - gitlab-feature-flag-client-token\n  - gitlab-feed-token\n  - gitlab-kubernetes-agent-token\n  - gitlab-oauth-app-secret\n  - gitlab-pat\n  - gitlab-pat-routable\n  - gitlab-ptt\n  - gitlab-rrt\n  - gitlab-runner-authentication-token\n  - gitlab-runner-authentication-token-routable\n  - gitlab-scim-token\n  - gitlab-session-cookie\n  - gitter-access-token\n  - gocardless-api-token\n  - grafana-api-key\n  - grafana-cloud-api-token\n  - grafana-service-account-token\n  - greptile-api-key\n  - groq-api-key\n  - harness-api-key\n  - hashicorp-tf-api-token\n  - hashicorp-tf-password\n  - heroku-api-key\n  - hubspot-api-key\n  - huggingface-access-token\n  - huggingface-organization-api-token\n  - infracost-api-token\n  - intercom-api-key\n  - intra42-client-secret\n  - jfrog-api-key\n  - jfrog-identity-token\n  - kraken-access-token\n  - kubernetes-secret-yaml\n  - kucoin-access-token\n  - kucoin-secret-key\n  - launchdarkly-access-token\n  - linear-api-key\n  - linear-client-secret\n  - linkedin-client-id\n  - linkedin-client-secret\n  - lob-api-key\n  - lob-pub-api-key\n  - looker-client-id\n  - looker-client-secret\n  - mailchimp-api-key\n  - mailgun-private-api-token\n  - mailgun-pub-key\n  - mailgun-signing-key\n  - mapbox-api-token\n  - mattermost-access-token\n  - maxmind-license-key\n  - messagebird-api-token\n  - messagebird-client-id\n  - microsoft-teams-webhook\n  - mistral-api-key\n  - mongodb-atlas-service-account-id\n  - mongodb-atlas-service-account-secret\n  - mongodb-connection-string\n  - netlify-access-token\n  - new-relic-browser-api-token\n  - new-relic-insert-key\n  - new-relic-user-api-id\n  - new-relic-user-api-key\n  - nexos-ai-user-api-key\n  - npm-access-token\n  - nuget-config-password\n  - nvidia-api-key\n  - nytimes-access-token\n  - octopus-deploy-api-key\n  - okta-access-token\n  - ollama-api-key\n  - openai-api-key\n  - openrouter-api-key\n  - openshift-user-token\n  - ovh-application-key\n  - ovh-application-secret\n  - ovh-consumer-key\n  - perplexity-api-key\n  - pkcs12-file\n  - plaid-api-token\n  - plaid-client-id\n  - plaid-secret-key\n  - planetscale-api-token\n  - planetscale-id\n  - planetscale-oauth-token\n  - planetscale-password\n  - polymarket-address\n  - polymarket-api-key\n  - polymarket-api-secret\n  - polymarket-passphrase\n  - polymarket-private-key\n  - posthog-personal-api-key\n  - posthog-project-api-key\n  - postman-api-token\n  - prefect-api-token\n  - private-key\n  - privateai-api-token\n  - pulumi-api-token\n  - pypi-upload-token\n  - rapidapi-access-token\n  - readme-api-token\n  - replicate-api-token\n  - rubygems-api-token\n  - scalingo-api-token\n  - sendbird-access-id\n  - sendbird-access-token\n  - sendgrid-api-token\n  - sendinblue-api-token\n  - sentry-access-token\n  - sentry-org-token\n  - sentry-user-token\n  - settlemint-application-access-token\n  - settlemint-personal-access-token\n  - settlemint-service-access-token\n  - shippo-api-token\n  - shopify-access-token\n  - shopify-custom-access-token\n  - shopify-private-app-access-token\n  - shopify-shared-secret\n  - sidekiq-secret\n  - sidekiq-sensitive-url\n  - slack-app-token\n  - slack-bot-token\n  - slack-config-access-token\n  - slack-config-refresh-token\n  - slack-legacy-bot-token\n  - slack-legacy-token\n  - slack-legacy-workspace-token\n  - slack-session-cookie\n  - slack-session-token\n  - slack-user-token\n  - slack-webhook-url\n  - snyk-api-token\n  - sonar-api-token\n  - sourcegraph-access-token\n  - square-access-token\n  - squarespace-access-token\n  - stability-ai-api-key\n  - stripe-access-token\n  - sumologic-access-id\n  - sumologic-access-token\n  - telegram-bot-api-token\n  - togetherai-api-key\n  - travisci-access-token\n  - twilio-api-key\n  - twitch-api-token\n  - twitter-access-secret\n  - twitter-access-token\n  - twitter-api-key\n  - twitter-api-secret\n  - twitter-bearer-token\n  - typeform-api-token\n  - vault-batch-token\n  - vault-service-token\n  - vercel-ai-gateway-key\n  - vercel-api-token\n  - vercel-app-access-token\n  - vercel-app-refresh-token\n  - vercel-integration-token\n  - vercel-personal-access-token\n  - weights-and-biases-api-key\n  - weights-and-biases-api-key-v1\n  - xai-api-key\n  - yandex-access-token\n  - yandex-api-key\n  - yandex-aws-access-token\n  - zendesk-secret-key","schema":{"type":"string"}},"PublishedTsFrom":{"name":"published_ts_from","in":"query","description":"Unix timestamp of the earliest published date to include in the results","schema":{"type":"integer"}},"PublishedTsTo":{"name":"published_ts_to","in":"query","description":"Unix timestamp of the latest published date to include in the results","schema":{"type":"integer"}}},"responses":{"MaskError":{"description":"When any error occurs on mask","content":{}},"ParseError":{"description":"When a mask can't be parsed","content":{}}},"headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per minute"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window"},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"},"description":"Date and time when rate limit counter resets"},"X-Quota-Limit":{"schema":{"type":"integer"},"description":"Quota limit per minute"},"X-Quota-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the period"},"X-Quota-Reset":{"$ref":"#/components/headers/X-Quota-Limit"}},"securitySchemes":{"BasicAuth":{"type":"http","scheme":"basic","description":"Authorization string. Needs to be in the standard BasicAuth format - \"Basic BASE64_CREDENTIALS\", where BASE64_CREDENTIALS is the user username:password encoded in base64 format."},"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-API-KEY"}}}}