Paginated keyword search results
Retrieve paginated leak details matching the organization's active keywords.
Returns the same format as /leaks/details (paginated response), with an
additional matched_keyword field indicating which keyword matched each row.
Searches leaks_history for rows where hasToken(host, keyword) is true for
any active keyword, excluding the org's own monitored root domains.
If the organization has no active keywords, returns an empty paginated response.
Parameters:
| Parameter | Default | Description |
|---|---|---|
page | 1 | Page number |
page_size | 50 | Items per page (max 200) |
search | - | Full-text search across username, host, domain, root_domain |
sort_by | last_seen | Sort order: last_seen (most recent first) |
start_date / end_date | last 14 days | Date range filter |
Plus all standard DynamicFilters.
Response Format:
{
"data": [
{
"username": "user@example.com",
"password": "p****d",
"type": "Stealer",
"last_seen": "2026-03-15T10:30:00",
"host": "acme-corp-recrute.talent-soft.com",
"domain": "acme-corp-recrute.talent-soft.com",
"local_part": "user",
"protocol": "https",
"email_domain": "example.com",
"root_domain": "talent-soft.com",
"log_date": "2026-03-10T08:00:00",
"country": "FR",
"software": "chrome, profile: 0",
"stealer_name": "RedLine",
"hash": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
"machine_id": "DESKTOP-ABC1234",
"computer_name": "LAPTOP-XYZ",
"hardware_id": "hwid-1234-5678",
"machine_user": "john.doe",
"ip_address": "192.168.1.10",
"upload_date": "2026-03-14T12:00:00",
"source_count": 1,
"matched_keyword": "acme-corp"
}
],
"total": 12345,
"page": 1,
"page_size": 50,
"total_pages": 247
}Examples:
# Basic paginated request
GET /leaks/keyword/search?page=1&page_size=50
# With search filter
GET /leaks/keyword/search?search=admin&page=1&page_size=50
# With date range
GET /leaks/keyword/search?start_date=2026-03-01&end_date=2026-03-28Authorization
ApiKeyAuth API key for authentication
In: header
Query Parameters
Page number
11 <= valueItems per page (max 200)
501 <= value <= 200Search term for full-text filtering
length <= 200Sort order: source_count (default) or last_seen
"source_count""source_count" | "last_seen"Username of the leaked user (can be phone, email, ID, ...)
Type of leak (combo, stealer)
Uniq identifier for the concatenation of : username, password and domain
Upload date on stealed, ISO 8601, pattern YYYY-MM-DD
Upload date on the plateform the credential was found, ISO 8601, pattern YYYY-mm-dd
Log date of the device at compromized moment (if applicable, stealer only)
Start date to search from leaks, format: YYYY-mm-dd (default: today - 14days at 0:00am)
End date to search leaks from, format YYYY-mm-dd (default: today)
URL of the leaked data
FQDN of the leaked data
Local part of the username section (if applicable, email only)
Protocol identified (if applicable)
Email domain to filter on (if multiple email domains declared)
Root domain to filter on (if multiple root domains declared)
Machine ID (if applicable, stealer only)
Computer name (if applicable, stealer only)
Hardware ID (if applicable, stealer only)
Machine user (if applicable, stealer only)
IP address (if applicable, stealer only)
Country (if applicable, stealer only)
Software (if applicable, stealer only)
Stealer name (if applicable)
Keyword to filter on (only active keywords for tenant)
Match type for leaks_matched table (root_domain or email_domain)
Root domains to exclude (NOT IN filter)
Email domains to exclude (NOT IN filter)
Domains to exclude (NOT IN filter)
Types to exclude
Software to exclude
Stealer names to exclude
Protocols to exclude
Countries to exclude
Show only hashes whose first appearance (min upload_stealed) falls on this exact date. Format: YYYY-MM-DD.
Show only hashes whose first appearance (min upload_stealed) is on or after this date. Format: YYYY-MM-DD.
Limit result length
Minimum number of sources (source_count >= N)
Response Body
application/json
application/json
curl -X GET "https://api.stealed.io/leaks/keyword/search"null{
"detail": [
{
"loc": [
"string"
],
"msg": "string",
"type": "string"
}
]
}Retrieve keyword-based leak statistics GET
Retrieve all leak statistics for the current organization's active keywords. Returns the **same format** as `/leaks/stats` (StatsResponse), computed from keyword search results on `leaks_history`. The rows matching active keywords (excluding the org's own monitored root domains) are fed through the same `calculate_all_statistics()` pipeline. If the organization has no active keywords, returns an empty stats response. **Parameters:** | Parameter | Default | Description | |-----------|---------|-------------| | `granularity` | `day` | Time granularity (unused in keyword stats, kept for API consistency) | | `start_date` / `end_date` | last 14 days | Date range filter | Plus all standard DynamicFilters. **Example:** ```bash GET /leaks/keyword/stats?start_date=2026-03-01&end_date=2026-03-28 ```
Retrieve sources for a keyword leak by hash GET
Get all occurrences of a keyword leak from leaks_history by hash. Scoped to the tenant's active keywords for security.