Retrieve sources for a keyword leak by hash
Get all occurrences of a keyword leak from leaks_history by hash. Scoped to the tenant's active keywords for security.
Authorization
ApiKeyAuth API key for authentication
In: header
Query Parameters
Leak hash
Response Body
application/json
application/json
curl -X GET "https://api.stealed.io/leaks/keyword/by-hash?hash=string"null{
"detail": [
{
"loc": [
"string"
],
"msg": "string",
"type": "string"
}
]
}Paginated, count-sorted distinct-value breakdown for the keyword insight KPI tiles GET
Drill into a keyword-insight KPI tile (Total Users / Total Domains) with a server-paginated, count-sorted list of distinct values, computed from the organization's active keywords over `leaks_history` (same dedup-by-hash rows as `GET /leaks/keyword/search`). `field=source` is rejected (returns an empty page): keyword leaks have no reliable per-credential source attribution (see the keyword teaser-tier rule) -- classic leaks use `GET /leaks/breakdown?field=source` instead. **Parameters:** | Parameter | Default | Description | |-----------|---------|-------------| | `field` | *required* | `username`, `domain`, or `source` (rejected, empty page) | | `page` | 1 | Page number | | `page_size` | 50 | Items per page (max 200) | | `search` | - | Substring filter on the returned `value` | Plus all standard `DynamicFilters`, exactly like `GET /leaks/keyword/search`. **Response:** ```json { "data": [{"value": "acme-corp-recrute.talent-soft.com", "count": 12}], "total": 34, "page": 1, "page_size": 50, "total_pages": 1 } ``` `total` is the number of distinct `field` values matching the filters -- the same figure as `unique_usernames` / `unique_domains` from `GET /leaks/keyword/stats`. **Example:** ```bash GET /leaks/keyword/breakdown?field=domain&page=1&page_size=50 ```
Distinct values for a leak column (autocomplete) GET
Generic autocomplete back-end for any leak-table filter UI. Resolves the target tenant in this order: 1. `?tenant_id_override=<UUID>` query param — workspace MSSP path, validated by `resolve_workspace_override` (403 if caller is not a workspace partner, 404 if the child isn't in their scope). 2. The caller's own tenant — pulled from the auth context. Returns ``{field, values: [{value, count}, …]}`` sorted by count DESC.