The compromised machines of a client, one page at a time
One row per machine of the client looked at: its stealer logs grouped by hardware id when a log has one, else by the credential they share. The default order puts the internal machines first (at least one of the client's credentials on it is an employee credential, scope), then the most recently first collected. Use it to inventory the machines once, then page through total_pages.
routed machines are computed every night from the client's routed credentials (refreshed_at says when); a client that is not routed yet, or a read narrowed by domain, is listed from the logs of its domains (source: domains, the figures are then those of that perimeter). redacted is true when every identity is masked: q and sort=computer_name then answer 400.
machine_hash is a representative log and can change when a more recent copy arrives: to deduplicate on your side use hwid and physical_identity. credentials_total is the figure of the log that holds the most; the sheet of the machine merges all its copies and can differ. Open a machine with GET /machines/{machine_hash}.
Stable pages: two calls that answer the same generated_at answer the same page; the order always ends on machine_hash, so a rebuild of identical data cuts identical pages.
Never returns a secret (a cookie value, a Windows password, a card number), never the source of a log for an API key, and never a password of a third party. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.
Authorization
ApiKeyAuth API key for authentication
In: header
Query Parameters
Page number, from 1. Past the last page items is empty.
11 <= value <= 1000000Rows per page, 200 at most.
501 <= value <= 200Only the internal, or only the external, machines.
True: machines with a session still valid (a cookie expiry to come). False: machines with none. Absent: all.
ISO date. Machines first collected on or after it; a machine whose first collection is unknown is excluded.
A root domain of the client (422 if it is not one): only the machines holding a credential on it, counted over that domain alone (source: domains).
Stealer family, e.g. redline.
Country code of the machine, e.g. FR.
At least 2 characters: machines whose computer name or machine user starts with it, case-insensitive. Refused (400) in a masked view.
scope (default): internal machines first, then the most recently first collected. log_date: the infection day the log declares, machines without one last. computer_name is refused (400) in a masked view.
"scope""scope" | "first_collected" | "last_collected" | "credentials_total" | "credentials_on_domains" | "cookies" | "computer_name" | "log_date"Default: descending for dates and counters (and scope), ascending for names. Ties are broken on machine_hash.
Response Body
application/json
curl -X GET "https://api.stealed.io/api/v1/machines"{
"computed": true,
"generated_at": "2026-10-05T18:02:11Z",
"items": [
{
"city": "Lyon",
"computer_name": "LT-ACME-0412",
"cookies": 4208,
"country": "FR",
"credentials_external": 7,
"credentials_internal": 5,
"credentials_on_domains": 12,
"credentials_total": 380,
"domain_joined": true,
"first_collected": "2026-08-19",
"has_live_cookies": true,
"has_stealer_path": true,
"hwid": "4C4C4544-0052-3510-8048-B4C04F4D3732",
"last_collected": "2026-09-06",
"log_date": "2026-09-04",
"logs": 2,
"machine_hash": "25fce7533a0b41d9e8c26f04b71a9d52",
"machine_user": "cbernard",
"origin_hash": "a3f9c2e17b4d08f6c29e51a07d3b6e84",
"physical_identity": "hw",
"processes": 61,
"scope": "internal",
"software": 84,
"stealer_family": "redline"
}
],
"page": 1,
"page_size": 50,
"redacted": false,
"refreshed_at": "2026-10-05T04:31:12Z",
"source": "routed",
"total": 37,
"total_pages": 1
}Verify Api Key POST
This endpoint only requires the X-Api-Keys header configured to check the validity of an API key and retrieve organization information including monitored domains
The stealer logs a leaked credential was found in GET
From a leaked credential already in your tooling (its `hash`, as the leak list gives it): the logs (one per `machine_hash`) it was collected in, most recent first (`log_date` descending, unknown last, then `collected_on`), at most 50. Then open the machine with `GET /machines/{machine_hash}?hash=...`. Answers 404 when the credential is not in the perimeter of the client looked at (same source and domains as the leak list of that view). A credential in the perimeter with no log is not an error: `machines` is empty. `computer_name` is masked like every identity of the leak list when that list masks them. `source` (the archive name, and the Telegram channel when known) is null unless the organisation has the `source_reveal` feature, and never for an API key. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.