Verify Api Key
This endpoint only requires the X-Api-Keys header configured to check the validity of an API key and retrieve organization information including monitored domains
Authorization
ApiKeyAuth API key for authentication
In: header
Response Body
application/json
curl -X POST "https://api.stealed.io/api-keys/verify"{
"valid": true,
"organization": {},
"api_key_info": {}
}Paginated keyword search results GET
Retrieve paginated leak details matching the organization's active keywords. Returns the same paginated envelope as `/leaks/details`. The row shape differs slightly: keyword rows are folded per hash from `hash_registry`, so they carry `local_part` (derived) and no per-credential value sets (`softwares`, `ip_addresses`, ...). This endpoint has an additional `matched_keyword` field indicating which keyword matched each row. Searches `hash_registry` (full ingestion history) for rows where the keyword's tokens appear in `domain`/`host` (same predicate as the `idx_kw_text` index), for any active keyword, excluding the org's own monitored root domains. If the organization has no active keywords, returns an empty paginated response. **Parameters:** | Parameter | Default | Description | |-----------|---------|-------------| | `page` | 1 | Page number | | `page_size` | 50 | Items per page (max 200) | | `search` | - | Full-text search across username, host, domain, root_domain | | `sort_by` | `last_seen` | Sort order: `last_seen` (most recent first) | | `start_date` / `end_date` | all-time | Date range filter; an explicit value narrows the window | Plus all standard DynamicFilters. Accepts `?tenant_id_override=<child_tenant_id>` for an MSSP workspace: the active keywords, excluded roots and paid-plan check then resolve from the CHILD tenant instead of the caller's own org (`tenant_id_override=all` is rejected with 400). A Référencé child's rows render with `username` masked (`x***@domain`, same redaction as `/leaks/details`); an Activé child's `username` renders in clear, `password` stays masked either way. **Response Format:** ```json { "data": [ { "username": "user@example.com", "password": "a91f3c8b2d47", "password_masked": true, "type": "Stealer", "first_seen": "2026-01-20", "last_seen": "2026-03-15", "host": "acme-corp-recrute.talent-soft.com", "domain": "acme-corp-recrute.talent-soft.com", "local_part": "user", "protocol": "https", "email_domain": "example.com", "root_domain": "talent-soft.com", "country": "FR", "software": "chrome, profile: 0", "stealer_name": "RedLine", "hash": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4", "machine_id": "DESKTOP-ABC1234", "computer_name": "LAPTOP-XYZ", "hardware_id": "hwid-1234-5678", "machine_user": "john.doe", "ip_address": "192.168.1.10", "source_count": 3, "matched_keyword": "acme-corp" } ], "total": 12345, "page": 1, "page_size": 50, "total_pages": 247 } ``` **Examples:** ```bash # Basic paginated request GET /leaks/keyword/search?page=1&page_size=50 # With search filter GET /leaks/keyword/search?search=admin&page=1&page_size=50 # With date range GET /leaks/keyword/search?start_date=2026-03-01&end_date=2026-03-28 ```
The compromised machines of a client, one page at a time GET
One row per machine of the client looked at: its stealer logs grouped by hardware id when a log has one, else by the credential they share. The default order puts the internal machines first (at least one of the client's credentials on it is an employee credential, `scope`), then the most recently first collected. Use it to inventory the machines once, then page through `total_pages`. `routed` machines are computed every night from the client's routed credentials (`refreshed_at` says when); a client that is not routed yet, or a read narrowed by `domain`, is listed from the logs of its domains (`source: domains`, the figures are then those of that perimeter). `redacted` is true when every identity is masked: `q` and `sort=computer_name` then answer 400. `machine_hash` is a representative log and can change when a more recent copy arrives: to deduplicate on your side use `hwid` and `physical_identity`. `credentials_total` is the figure of the log that holds the most; the sheet of the machine merges all its copies and can differ. Open a machine with `GET /machines/{machine_hash}`. Stable pages: two calls that answer the same `generated_at` answer the same page; the order always ends on `machine_hash`, so a rebuild of identical data cuts identical pages. Never returns a secret (a cookie value, a Windows password, a card number), never the source of a log for an API key, and never a password of a third party. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.