---
updatedAt: 2026-06-03T09:35:37.000Z
agentTools:
  projectIndex: https://docs.hudsonrock.com/llms.txt
---

# Categorize Stealer Domains

Categorize the domains associated with a stealer (from employeeAt and clientAt fields) by their purpose using AI. Results are cached on the stealer document.

<HTMLBlock>{`
<div class="endpoint-container">
  <div class="endpoint-permissions">
    <h3 class="endpoint-section-title">Required Permissions</h3>
    <code class="endpoint-permission-code">categorize-domains</code>
  </div>
  
  <div class="endpoint-limits">
    <h3 class="endpoint-section-title">Response Limits</h3>
    <ul class="endpoint-limits-list">
      <li class="endpoint-limit">Rate limit: 5 requests per 10 seconds</li>
      <li class="endpoint-limit">Maximum response size: 1 stealer</li>
      <li class="endpoint-limit">Maximum response time: 90 seconds</li>
    </ul>
  </div>
</div>

<style>


.endpoint-path {
  display: flex;
  align-items: center;
  gap: 12px;
  padding: 12px 16px;
  border-radius: 6px;
  margin: 0 0 24px 0;
  font-size: 1.25rem;
}

.endpoint-method {
  background: #FEBB10;
  color: #333;
  padding: 4px 12px;
  border-radius: 20px;
  font-size: 0.9rem;
  font-weight: 600;
  text-transform: uppercase;
}

.endpoint-url {
  color: #FEBB10;
  background: #FDCD4E;
  padding: 6px 12px;
  border-radius: 4px;
  font-family: monospace;
  font-size: 1.1rem;
}

.endpoint-parameters,
.endpoint-permissions,
.endpoint-limits {
  margin: 24px 0;
}

.endpoint-section-title {
  color: #333;
  margin-bottom: 16px;
  padding-bottom: 8px;
  border-bottom: 2px solid #FDCD4E;
}

.endpoint-params-table {
  width: 100%;
  border-collapse: collapse;
  border-radius: 6px;
  overflow: hidden;
  border: 1px solid #FDCD4E;
}


.endpoint-table-cell {
  padding: 12px;
  border: 1px solid #FDCD4E;
}

.endpoint-permission-code {
  color: #FD971E !important;
  padding: 6px 12px;
  border-radius: 4px;
  font-family: monospace;
  font-size: 0.9rem;
  display: inline-block;
}

.endpoint-constraints-list,
.endpoint-limits-list {
  margin: 0;
  padding-left: 20px;
  list-style: none !important;
}

.endpoint-constraint,
.endpoint-limit {
  margin: 4px 0;
  position: relative;
}

.endpoint-constraint::before,
.endpoint-limit::before {
  content: "•";
  color: #FEBB10;
  font-weight: bold;
  position: absolute;
  left: -15px;
}

.endpoint-table-cell:first-child {
  font-weight: 500;
}
  .model-code {
background-color: #5032c08a !important;
}
</style>
`}</HTMLBlock>

# OpenAPI definition

```json
{
  "openapi": "3.0.0",
  "info": {
    "title": "Cavalier API",
    "version": "3.0.0",
    "description": "API for searching stealer data with various filters and parameters.\n\n## Categories:\n- End User Protection: Search for individual compromises by email, username, IP, or stealer\n- Domain Intelligence: Search for domain-wide compromises and intelligence\n- Threat Feeds: Infostealer C2, malware, PhaaS, and ClickFix threat intelligence feeds\n",
    "contact": {
      "email": "support@hudsonrock.com"
    }
  },
  "servers": [
    {
      "url": "https://api.hudsonrock.com/json/v3",
      "description": "Production server"
    }
  ],
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "api-key"
      }
    },
    "responses": {
      "ValidationError": {
        "description": "Validation error - the request or request body was invalid",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            }
          }
        }
      },
      "Unauthorized": {
        "description": "Unauthorized - the server could not authenticate the request",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            }
          }
        }
      },
      "Forbidden": {
        "description": "Forbidden - the server authenticated the request but refuses to process it because of insufficient permissions",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            }
          }
        }
      },
      "NotFound": {
        "description": "Not found - the server could not find the requested resource",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            }
          }
        }
      },
      "RequestTimeout": {
        "description": "Timeout - the server timed out while waiting for a response (90 seconds)",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            }
          }
        }
      },
      "RateLimit": {
        "description": "Rate limit exceeded - the server has received too many requests in a short period of time",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            }
          }
        }
      },
      "InternalServerError": {
        "description": "Internal server error - the server encountered an unexpected condition that prevented it from fulfilling the request",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/Error"
            }
          }
        }
      }
    },
    "schemas": {
      "Error": {
        "type": "object",
        "properties": {
          "error": {
            "type": "string",
            "example": "Request error",
            "description": "Indicates the type of error"
          },
          "message": {
            "type": "string",
            "example": "Insufficient permissions, please contact support at support@hudsonrock.com",
            "description": "Error message"
          }
        }
      }
    }
  },
  "security": [
    {
      "ApiKeyAuth": []
    }
  ],
  "tags": [
    {
      "name": "Investigations",
      "description": "Endpoints for investigating compromised computers",
      "x-displayName": "Investigations"
    }
  ],
  "x-tagGroups": [
    {
      "name": "Account Management",
      "tags": [
        "Account Management",
        "Company Management"
      ]
    },
    {
      "name": "End User Protection",
      "tags": [
        "End User Protection"
      ]
    },
    {
      "name": "Domain Intelligence",
      "tags": [
        "Domain Intelligence"
      ]
    },
    {
      "name": "Investigations",
      "tags": [
        "Investigations"
      ]
    },
    {
      "name": "Threat Feeds",
      "tags": [
        "Threat Feeds"
      ]
    }
  ],
  "paths": {
    "/search-by-stealer/categorize-domains": {
      "post": {
        "tags": [
          "Investigations"
        ],
        "summary": "Categorize Stealer Domains",
        "description": "Categorize the domains associated with a stealer (from employeeAt and clientAt fields) by their purpose using AI. Results are cached on the stealer document.",
        "operationId": "categorizeStealerDomains",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "stealerId"
                ],
                "properties": {
                  "stealerId": {
                    "type": "string",
                    "description": "Stealer ID to categorize domains for",
                    "example": "[IN]175.101.37.65"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Successful operation",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "success": {
                      "type": "boolean",
                      "example": true
                    },
                    "data": {
                      "type": "array",
                      "description": "Array of domain categories",
                      "items": {
                        "type": "object",
                        "properties": {
                          "name": {
                            "type": "string",
                            "description": "Category name",
                            "example": "Hacking Forums"
                          },
                          "domains": {
                            "type": "array",
                            "items": {
                              "type": "string"
                            },
                            "description": "Domains belonging to this category",
                            "example": [
                              "exploit.in",
                              "xss.is"
                            ]
                          }
                        }
                      }
                    },
                    "cached": {
                      "type": "boolean",
                      "description": "Whether the result was returned from cache",
                      "example": false
                    }
                  }
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/ValidationError"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "404": {
            "$ref": "#/components/responses/NotFound"
          },
          "408": {
            "$ref": "#/components/responses/RequestTimeout"
          },
          "429": {
            "$ref": "#/components/responses/RateLimit"
          },
          "500": {
            "$ref": "#/components/responses/InternalServerError"
          }
        }
      }
    }
  }
}
```