# Cavalier Infostealers API Documentation > Documentation for Cavalier Infostealers API ## Guides - [🕵️‍♂️ Overview](https://docs.hudsonrock.com/docs/getting-started.md) - [📖 Introduction](https://docs.hudsonrock.com/docs/introduction.md) - [📝 Raw Data](https://docs.hudsonrock.com/docs/raw-data.md) - [🔐 Permissions](https://docs.hudsonrock.com/docs/permissions.md) - [🤖 AI Assistant](https://docs.hudsonrock.com/docs/ai-assistant.md) - [Stealer Schema](https://docs.hudsonrock.com/docs/stealers-schema.md) - [Credential Schema](https://docs.hudsonrock.com/docs/credentials-schema.md) - [Domain Schema](https://docs.hudsonrock.com/docs/domain-schema.md) - [URL Schema](https://docs.hudsonrock.com/docs/domain-schema-copy.md) - [Cavalier MCP](https://docs.hudsonrock.com/docs/mcp.md) - [Overview](https://docs.hudsonrock.com/docs/domain-intelligence-overview.md): The search-by-domain endpoint enables searching for compromised credentials and related intelligence associated with specific domains. This guide outlines all supported query patterns and combinations. - [The Basics](https://docs.hudsonrock.com/docs/domain-intelligence-the-basics.md): Request Parameters - [Domain Search](https://docs.hudsonrock.com/docs/domain-search.md): Search for domain-wide compromises, with options for internal or external domains. - [Domain Overview](https://docs.hudsonrock.com/docs/domain-overview.md): Get overview about domain-wide compromises and intelligence - [Assets Discovery](https://docs.hudsonrock.com/docs/assets-discovery.md): Perform a discovery search to identify potential compromises. - [Third-Party Risk Assessment](https://docs.hudsonrock.com/docs/third-party-risk-assessment.md): Perform an assessment search to evaluate potential risks. - [File Search](https://docs.hudsonrock.com/docs/file-search.md) - [AI Infection Analysis](https://docs.hudsonrock.com/docs/ai-infection-analysis-new.md) - [Overview](https://docs.hudsonrock.com/docs/end-user-protection-overview.md) - [The Basics](https://docs.hudsonrock.com/docs/end-user-protection-the-basics.md): Request Parameters - [Email Search](https://docs.hudsonrock.com/docs/email-search.md) - [Username Search](https://docs.hudsonrock.com/docs/username-search.md) - [IP/CIDR Search](https://docs.hudsonrock.com/docs/ipcidr-search.md) - [Stealer Search](https://docs.hudsonrock.com/docs/stealer-search.md) - [ 🔍 Advanced Search Guide](https://docs.hudsonrock.com/docs/advanced-search-endpoint.md) - [Password Search](https://docs.hudsonrock.com/docs/password-search.md) - [Keyword Search](https://docs.hudsonrock.com/docs/keyword-search.md) - [URLs by Keyword](https://docs.hudsonrock.com/docs/external-attack-surface.md) ## API Reference - [Getting Started](https://docs.hudsonrock.com/reference/getting-started.md): Search for domain-wide compromises and intelligence - [Authentication](https://docs.hudsonrock.com/reference/authentication.md): The Cavalier API uses API keys to authenticate requests. - [My Requests](https://docs.hudsonrock.com/reference/my-requests.md): Set up My Requests to enable your users to debug their requests. - [Cavalier MCP](https://docs.hudsonrock.com/reference/mcp.md) - [Get Account Information](https://docs.hudsonrock.com/reference/getmyaccount.md): Retrieve current user's account information based on API key authentication - [Company Management](https://docs.hudsonrock.com/reference/company-management.md): The Company Management endpoints let you manage the companies on your account - [Add Company](https://docs.hudsonrock.com/reference/addcompany.md): Add a new company to the authenticated user's account. The request must include the company `name` and at least one initial asset value across `domains`, `apks`, and/or `external_domains`. If the authenticated user belongs to an organization with `synced_data: true`, only the user with `organization.role: "owner"` can call this endpoint. Other members receive `403 Forbidden`. - [Remove Company](https://docs.hudsonrock.com/reference/removecompany.md): Remove a company by id from the authenticated user's account. If the authenticated user belongs to an organization with `synced_data: true`, only the user with `organization.role: "owner"` can call this endpoint. Other members receive `403 Forbidden`. - [Add Company Assets](https://docs.hudsonrock.com/reference/addcompanyassets.md): Add primary `domains`, `apks`, and/or `external_domains` to a company. Values are deduplicated against the existing arrays via `$addToSet`. At least one of the three asset arrays must be provided and non-empty. If the authenticated user belongs to an organization with `synced_data: true`, only the user with `organization.role: "owner"` can call this endpoint. Other members receive `403 Forbidden`. - [Remove Company Assets](https://docs.hudsonrock.com/reference/removecompanyassets.md): Remove primary `domains`, `apks`, and/or `external_domains` from a company. At least one of the three asset arrays must be provided and non-empty. Clients must send a JSON body on this DELETE request. If the authenticated user belongs to an organization with `synced_data: true`, only the user with `organization.role: "owner"` can call this endpoint. Other members receive `403 Forbidden`. - [Set Company Webhook](https://docs.hudsonrock.com/reference/setcompanywebhook.md): Set or clear the webhook configuration for an existing company. Send `webhook: null` to clear it; otherwise `webhook.url` and `webhook.token` are both required. If the authenticated user belongs to an organization with `synced_data: true`, only the user with `organization.role: "owner"` can call this endpoint. Other members receive `403 Forbidden`. - [Search by Emails](https://docs.hudsonrock.com/reference/search-by-login-emails.md): Search for compromised credentials by email addresses - [Search by Usernames](https://docs.hudsonrock.com/reference/search-by-login-usernames.md): Search for compromised credentials by usernames - [Search by IP/CIDR](https://docs.hudsonrock.com/reference/search-by-ip.md): Search for compromises by IP address or CIDR range - [Search by Stealer](https://docs.hudsonrock.com/reference/search-by-stealer.md): Search for compromises by stealer ID - [Search by PC Name](https://docs.hudsonrock.com/reference/searchbypc.md): Search for compromises by computer name - [Search by Domains](https://docs.hudsonrock.com/reference/search-by-domains.md): Search for domain-wide compromises and intelligence - [Search by Company](https://docs.hudsonrock.com/reference/searchbycompany.md): Search for compromises within a specific company's digital assets (domains, APKs, and external domains) - [Domains Overview](https://docs.hudsonrock.com/reference/domains-overview.md): Get overview about domain-wide compromises and intelligence - [Assets Discovery](https://docs.hudsonrock.com/reference/assets-discovery.md): Perform a discovery search to identify potential compromises. - [Inbound Supply Chain Risks](https://docs.hudsonrock.com/reference/post_search-by-domain-supply-chain-risks.md): Returns the paginated inbound Supply Chain Risks view for a single domain: ranked third-party partner cards discovered from compromised credentials, enriched with company information. Requires the `supply_chain_monitoring` api permission. - [Third Party Risk Assessment](https://docs.hudsonrock.com/reference/third-party-risk-assessment.md): Perform an assessment search to evaluate potential risks. - [FortiBleed Feed](https://docs.hudsonrock.com/reference/getfortinetfeed.md): Paginated FortiBleed (Fortinet) compromise feed. Returns Fortinet domain records, each with fully UNCENSORED credential data (`url`, `login`, `password`, `FortiGuardID`, `country`) - no masking, no truncation. Because it exposes uncensored credentials, this endpoint requires the `fortibleed` api permission. A missing or invalid `api-key` returns `401`; a valid key that lacks `fortibleed` returns `403`. Results are returned in a stable, deterministic order (most compromised users first, then domain ascending) identical to the public website feed, so pagination is consistent across pages. Example request: ```bash curl -X POST 'https://api.hudsonrock.com/json/v3/fortinet?page=1&limit=20' \ -H 'api-key: YOUR_API_KEY' ``` Example response: ```json { "data": [ { "domain": "example.com", "industry": "Financial Services", "size": "1001-5000 Employees", "revenue": "$500 Million", "credentials": [ { "url": "https://vpn.example.com:443/login", "login": "david", "password": "david", "FortiGuardID": "FGT60F-XXXXXXXX", "country": "US" } ] } ], "total": 21632, "page": 1, "limit": 20, "totalPages": 1082 } ``` - [C2 Host Feed](https://docs.hudsonrock.com/reference/getc2feed.md): Cursor-paginated feed of infostealer C2 host rows (one row per host per UTC day). Requires the `c2_threat_feed` api permission. Pass `pageInfo.nextCursor` back as `cursor` for the next page. Filters are optional and AND-combined; `dateFrom`/`dateTo` take precedence over `date`. - [C2 Host Network Detail](https://docs.hudsonrock.com/reference/getc2hostnetwork.md): Resolved IP detail and DNS records for a C2 host (most recent sighting). Requires `c2_threat_feed`. - [ClickFix Site Feed](https://docs.hudsonrock.com/reference/getclickfixfeed.md): Cursor-paginated, filterable, multi-sortable feed of ClickFix sites. Requires the `clickfix` api permission. Uses keyset (cursor) pagination: pass `pageInfo.nextCursor` back as `cursor` for the next page. Each row is a full record including the base64 screenshot blobs, so `limit` is capped at 20 (default 20). Boolean filters are opt-in (only `true` filters); `query` is a case-insensitive match over `domain`/`url`/`pageTitle`. - [ClickFix Domain Lookup](https://docs.hudsonrock.com/reference/getclickfixdomain.md): Returns a single domain's most-recent full ClickFix record, including the base64 screenshot blobs. Requires the `clickfix` api permission. If the exact domain misses and it has more than two labels (and isn't a bare IPv4), the lookup retries once with the registrable root domain (eTLD+1); returns `404` if nothing matches. - [PhaaS Host Feed](https://docs.hudsonrock.com/reference/getphaasfeed.md): Cursor-paginated feed of Phishing-as-a-Service host rows. Requires `phaas_threat_feed`. - [PhaaS Host Network Detail](https://docs.hudsonrock.com/reference/getphaashostnetwork.md): Resolved IP detail and DNS records for a PhaaS host (most recent sighting). Requires `phaas_threat_feed`. - [Search by File](https://docs.hudsonrock.com/reference/search-by-file.md): Search for credentials based on file names. - [Search by Term](https://docs.hudsonrock.com/reference/searchbyterm.md): Search for terms found in browsing history search engine results from infected devices. - [Infection Analysis (NEW)](https://docs.hudsonrock.com/reference/getinfectionanalysis.md): Get infection analysis for a stealer. This endpoint analyzes browser history to identify the likely infection source and infection flow. Currently only supported for stealers where we collect and store browsing history (mainly Lumma). - [Categorize Stealer Domains](https://docs.hudsonrock.com/reference/categorizestealerdomains.md): Categorize the domains associated with a stealer (from employeeAt and clientAt fields) by their purpose using AI. Results are cached on the stealer document. - [Advanced Search](https://docs.hudsonrock.com/reference/advancedsearch.md): Perform an advanced search to identify potential compromises with multiple filters (domains, employees, users, last compromised, last uploaded, company size, industry, country). - [Search by Password](https://docs.hudsonrock.com/reference/search-by-password.md): Search for credentials based on passwords. - [Search by Keyword](https://docs.hudsonrock.com/reference/search-by-keyword.md): Search for domains based on keywords. - [URLs by Keyword](https://docs.hudsonrock.com/reference/searchbykeywordurls.md): Search for URLs based on keywords. ## Changelog - [{ New } - Supply Chain Risks](https://docs.hudsonrock.com/changelog/new-supply-chain-risks.md) - [{ New } - Company Management](https://docs.hudsonrock.com/changelog/new-company-management.md) - [{ New } - Company Search Endpoint](https://docs.hudsonrock.com/changelog/new-company-search-endpoint.md) - [{ New } - Account Management Endpoint](https://docs.hudsonrock.com/changelog/new-account-management-endpoint.md) - [{ New } - Search by Term Endpoint](https://docs.hudsonrock.com/changelog/new-search-by-term-endpoint.md) - [{ New } - Search Data Field](https://docs.hudsonrock.com/changelog/new-search-data-field.md) - [{ New } - Search by PC Name Endpoint](https://docs.hudsonrock.com/changelog/new-search-by-pc-name-endpoint.md) - [{ New } - Subdomain Filtering Feature](https://docs.hudsonrock.com/changelog/new-subdomain-filtering-feature.md) - [{ New } - Advanced Search Endpoint](https://docs.hudsonrock.com/changelog/new-advanced-search-endpoint.md) - [{ New} - Directory Tree Field](https://docs.hudsonrock.com/changelog/new-directory-tree-field.md)