Retrieve all leak statistics in a single request

Retrieve all leak statistics for the current organization in a single request.

This endpoint fetches all leak data once and calculates multiple statistics server-side, reducing the number of queries needed. If start_date and end_date are not provided, defaults to the last 14 days.

Includes trend data comparing the current period to the previous period of the same length (e.g. if querying 30 days, trends compare to the 30 days before that).

Returns a dictionary with the following statistics:

total_leaks: Total number of leaks
unique_usernames: Number of unique usernames
unique_domains: Number of unique domains
unique_passwords: Number of unique passwords
unique_leaks: Number of unique leak hashes
leaks_by_type: Number of leaks grouped by type (combo/stealer)
leaks_by_day: Number of leaks grouped by day and identifier (limited globally to 10 top identifiers + other)
leaks_by_domain: Number of leaks grouped by domain (limited globally to 10 top domains + other)
leaks_by_domain_all: Number of leaks grouped by domain (all domains, no limit)
leaks_by_inverse_identifier: Number of leaks grouped by the inverse identifier (email_domain if root_domain, or vice-versa) (limited globally to 10 top + other)
top_domains: Top domains with most leaks (limited globally to 10)
top_users: Top users with most leaks (all users, no limit)
password_strength: Average password length
password_reuse: Number of reused passwords
password_length_distribution: Distribution of passwords by length
external_accounts: Detailed list of external accounts (username, masked password, type, domain, upload_stealed; capped at 50, most recent first)
external_accounts_count: Total count of external accounts
admin_accounts: Detailed list of admin/privileged accounts (same shape as external_accounts; capped at 50, most recent first)
admin_accounts_count: Total count of admin accounts
unique_sources: Total number of unique sources (opaque count, channel identity not exposed)
sources: List of sources with leak counts (all sources, no limit)
latest_leak_date: Date of the latest leak
leak_details: All leak details (same as org_leaks_detail_per_identifier, limited to 20000)
leaks_by_country: Top 50 countries by leak count (non-empty only)
leaks_by_stealer_name: Top 50 stealer families by leak count (non-empty only)
leaks_by_software: Top 50 software/browsers by leak count (non-empty only)
leaks_by_computer_name: Top 30 computer names by leak count (non-empty only)

Trend Fields (percentage change vs previous period of same length):

total_leaks_trend, unique_usernames_trend, unique_domains_trend
unique_sources_trend, admin_accounts_count_trend, external_accounts_count_trend

Examples:

# All stats for the last 14 days (default)
GET /leaks/stats?identifier_column=root_domain

# With custom date range
GET /leaks/stats?identifier_column=root_domain&start_date=2024-01-01&end_date=2024-12-31

# With filters
GET /leaks/stats?identifier_column=root_domain&type=Stealer&country=FR

Authorization

ApiKeyAuth

X-API-Key<token>

API key for authentication

In: header

Query Parameters

identifier_column*Identifier Column

Column to use for identifying the domain. Use 'all' for the cockpit cross-scope view (External + Internal union).

Value in"root_domain" | "email_domain" | "username" | "all"

granularity?Granularity

Time granularity for the timeline: 'hour' for hourly buckets (recommended for ranges <= 7 days), 'day' for daily buckets

Default"day"

Value in"hour" | "day"

leak_mode?Leak Mode

Leak counting mode: 'new' counts only credentials first discovered in the period, 'all' counts any credential with at least one occurrence in the period.

Default"new"

Value in"new" | "all"

include_all_time?Include All Time

When true, include all-time aggregates (all_time_total_leaks, all_time_unique_users, all_time_unique_hosts, all_time_unique_passwords) computed without date filtering. Used by the cockpit landing page to render '% of total' lines.

Defaultfalse

facets?Facets

When false, skip the metadata facet aggregations (country, stealer_name, software, computer_name, protocol, root_domain, email_domain). Only leaks_by_type is still computed (cockpit needs the Stealer count). Cuts the internal CH fan-out from ~12 sub-queries down to ~5. The Insight pages keep the default and receive the full payload.

Defaulttrue

timeline?Timeline

When false, skip the per-bucket timeline query that powers the TimeRangeBrush. The cockpit doesn't render a brush, saves one extra CH scan per call.

Defaulttrue

username?|array<string>|

Username of the leaked user (can be phone, email, ID, ...)

type?|array<string>|

Type of leak (combo, stealer)

hash?|array<string>|

Uniq identifier for the concatenation of : username, password and domain

upload_stealed?||array<|string>|

Upload date on stealed, ISO 8601, pattern YYYY-MM-DD

upload_date?||array<|string>|

Upload date on the plateform the credential was found, ISO 8601, pattern YYYY-mm-dd

log_date?||array<|string>|

Log date of the device at compromized moment (if applicable, stealer only)

start_date?||

Start date to search from leaks, format: YYYY-mm-dd (default: today - 14days at 0:00am)

end_date?||

End date to search leaks from, format YYYY-mm-dd (default: today)

host?|array<string>|

URL of the leaked data

domain?|array<string>|

FQDN of the leaked data

local_part?|array<string>|

Local part of the username section (if applicable, email only)

protocol?|array<string>|

Protocol identified (if applicable)

email_domain?|array<string>|

Email domain to filter on (if multiple email domains declared)

root_domain?|array<string>|

Root domain to filter on (if multiple root domains declared)

machine_id?|array<string>|

Machine ID (if applicable, stealer only)

computer_name?|array<string>|

Computer name (if applicable, stealer only)

hardware_id?|array<string>|

Hardware ID (if applicable, stealer only)

machine_user?|array<string>|

Machine user (if applicable, stealer only)

ip_address?|array<string>|

IP address (if applicable, stealer only)

country?|array<string>|

Country (if applicable, stealer only)

software?|array<string>|

Software (if applicable, stealer only)

stealer_name?|array<string>|

Stealer name (if applicable)

source?|array<string>|

Opaque source label(s) to filter on, of the form Source-<6 hex> (as returned by the sources breakdown). The raw telegram_channel is never exposed: the label is matched back against the same MD5-prefix expression server-side.

keyword?|array<string>|

Keyword to filter on (only active keywords for tenant)

match_type?|array<string>|

Match type for leaks_matched table (root_domain or email_domain)

not_root_domain?|array<string>|

Root domains to exclude (NOT IN filter)

not_email_domain?|array<string>|

Email domains to exclude (NOT IN filter)

not_domain?|array<string>|

Domains to exclude (NOT IN filter)

not_type?|array<string>|

Types to exclude

not_software?|array<string>|

Software to exclude

not_stealer_name?|array<string>|

Stealer names to exclude

not_protocol?|array<string>|

Protocols to exclude

not_country?|array<string>|

Countries to exclude

first_seen_date?|

Show only hashes whose first appearance (min upload_stealed) falls on this exact date. Format: YYYY-MM-DD.

first_seen_since?|

Show only hashes whose first appearance (min upload_stealed) is on or after this date. Format: YYYY-MM-DD.

limit?|

Limit result length

min_occurrences?|

Minimum number of sources (source_count >= N)

Response Body

`application/json`

curl -X GET "https://api.stealed.io/leaks/stats?identifier_column=root_domain&granularity=day"

null

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string"
    }
  ]
}

Retrieve all leak statistics in a single request

Authorization

Query Parameters

Response Body

200application/json

422application/json

`application/json`

`application/json`