The stealer logs a leaked credential was found in
From a leaked credential already in your tooling (its hash, as the leak list gives it): the logs (one per machine_hash) it was collected in, most recent first (log_date descending, unknown last, then collected_on), at most 50. Then open the machine with GET /machines/{machine_hash}?hash=....
Answers 404 when the credential is not in the perimeter of the client looked at (same source and domains as the leak list of that view). A credential in the perimeter with no log is not an error: machines is empty.
computer_name is masked like every identity of the leak list when that list masks them. source (the archive name, and the Telegram channel when known) is null unless the organisation has the source_reveal feature, and never for an API key. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.
Authorization
ApiKeyAuth API key for authentication
In: header
Path Parameters
The credential the reveal is judged on (32 hex characters, any case). It must be in the perimeter of the tenant looked at.
^[0-9a-fA-F]{32}$Response Body
application/json
curl -X GET "https://api.stealed.io/api/v1/machines/by-credential/string"{
"hash": "a3f9c2e17b4d08f6c29e51a07d3b6e84",
"machines": [
{
"city": "Lyon",
"collected_on": "2026-09-06",
"computer_name": "LT-ACME-0412",
"country": "FR",
"hwid": "4C4C4544-0052-3510-8048-B4C04F4D3732",
"log_date": "2026-09-04",
"machine_hash": "25fce7533a0b41d9e8c26f04b71a9d52",
"source": {
"channel": "Example Cloud",
"file_name": "Example_Cloud_81.rar"
},
"stealer_family": "redline"
}
]
}The compromised machines of a client, one page at a time GET
One row per machine of the client looked at: its stealer logs grouped by hardware id when a log has one, else by the credential they share. The default order puts the internal machines first (at least one of the client's credentials on it is an employee credential, `scope`), then the most recently first collected. Use it to inventory the machines once, then page through `total_pages`. `routed` machines are computed every night from the client's routed credentials (`refreshed_at` says when); a client that is not routed yet, or a read narrowed by `domain`, is listed from the logs of its domains (`source: domains`, the figures are then those of that perimeter). `redacted` is true when every identity is masked: `q` and `sort=computer_name` then answer 400. `machine_hash` is a representative log and can change when a more recent copy arrives: to deduplicate on your side use `hwid` and `physical_identity`. `credentials_total` is the figure of the log that holds the most; the sheet of the machine merges all its copies and can differ. Open a machine with `GET /machines/{machine_hash}`. Stable pages: two calls that answer the same `generated_at` answer the same page; the order always ends on `machine_hash`, so a rebuild of identical data cuts identical pages. Never returns a secret (a cookie value, a Windows password, a card number), never the source of a log for an API key, and never a password of a third party. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.
The sheet of one stolen machine: a summary, rubrics on demand GET
One machine: the union, deduplicated by natural key, of ALL the copies (logs) of the machine linked to its anchor credential (the 10 most recent, `copies_total` counts them all). By default a summary: the profile (of the most complete copy), the copies with the rows each holds, the figures (`kpis`), and for each rubric its `total`. Ask for rows with `include` (`credentials`, `cookies`, `tokens`, `windows_credentials`, `cards`, `software`, `processes`, `environment`, or `all`) and bound them with `limit`; each rubric is `{included, total, truncated, items}` and `truncated` is `total > limit`. A rubric's own route (`/credentials`, `/cookies`...) pages through all of it. `limit` is 10 by default and 200 at most for an API key (422 above, never a silent cut); a session may ask up to 10 000. Environment variables come with their value for a few benign Windows variables only: every other one is listed by name with `value` null and `masked` true. Without `hash` the server resolves the machine's anchor credential itself; with it, that credential is checked and anchors the machine (another anchor can give another group of copies). Answers 404 when the machine is not in the perimeter of the client looked at, or the credential is not on it. A credential on the client's domains shows its password fingerprint only. `source` of a copy is null unless the organisation has the `source_reveal` feature, and always for an API key. `credentials` also has `undetailed`: the credentials linked to the machine that are not in the registry, which cannot be listed (no site, no user); `total` counts the listed ones only. A credential says `on_your_domains` when its site, its e-mail domain or a routed pair is the client's, and `root_is_yours` when its site's own root domain is. Never returns a secret (a cookie value, a Windows password, a card number), never the source of a log for an API key, and never a password of a third party. Every call is written to the access journal as `machine.read`. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.