Dynamic Parameters

domains array Required*

example.com

Array of domains to conduct a search on.

🔍 External Domains Search

If you're not restricted by a whitelist of domains and wish to search for an external domain (e.g., example.other-domain.com), you can do so by using 'example' as the keyword and 'other-domain.com' as the domain.

Minimum 1 domain
Maximum 50 domains
Valid domain format required
Cannot be used with external_domains

*Either domains or external_domains must be provided, but not both

external_domains array Required*

example.other-domain.com

Array of external domains to conduct a search on.

🛡️ Brand Protection Use Case

For brand protection customers restricted to searching only their whitelisted and external domains, use this to monitor your organization's pre-approved external domains.

Minimum 1 domain
Maximum 50 domains
Valid domain format required
Cannot be used with domains
Must be pre-approved external domains

*Either domains or external_domains must be provided, but not both

Common Parameters

types array

employees users third_parties

Narrow down search to employees, users, or third parties.

*third_parties type is only available when 'domains' parameter is provided.

filter_credentials boolean default: true

true false

When true, returns only credentials matching the search criteria.

keywords_match string default: any

all any

Determines if all keywords must match or any single keyword is sufficient.

keywords array

Array of keywords to search in credentials data and URL parts.

sort_by string default: date_compromised

date_compromised date_uploaded

The field by which compromised records will be sorted.

sort_direction string default: desc

asc desc

The direction in which the results should be sorted.

start_date date-string

ISO 8601 formatted date to filter results from (inclusive). Context depends on sort_by parameter.

end_date date-string

ISO 8601 formatted date to filter results to (inclusive). Context depends on sort_by parameter.

cursor base64 string

Pagination token for fetching next page of results. Obtained from previous response's nextCursor field.

additional_fields array

installed_software employee_session_cookies

Additional data fields to include in the response.