StealedStealed Documentation
Open Stealed
API ReferenceLeaks

Preview keyword search results (stats only)

GET
/leaks/keyword/preview

Preview the number of leaked credentials matching a keyword, along with the top root domains where the keyword appears. Returns aggregated stats only, no credential data. Available to all plans including Free.

The keyword is matched as a token in the host/URL column using the ClickHouse text index. For example, keyword acme-corp matches acme-corp-recrute.talent-soft.com and tekkit.io/offre/acme-corp/cdd.

Example:

GET /leaks/keyword/preview?keyword=acme-corp

Authorization

ApiKeyAuth
X-API-Key<token>

API key for authentication

In: header

Query Parameters

keyword*Keyword

Keyword to search for in host/URL

Length3 <= length <= 100

Response Body

application/json

application/json

curl -X GET "https://api.stealed.io/leaks/keyword/preview?keyword=acme-corp"
null
{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string"
    }
  ]
}

Retrieve leak statistics for a given domain and query GET

Endpoint to retrieve leak statistics for the provided domain and query. Gated on the ``public_exposure`` tenant feature flag. Only analytics queries are allowed via this endpoint.

Retrieve keyword-based leak statistics GET

Retrieve all leak statistics for the current organization's active keywords. Returns the **same format** as `/leaks/stats` (StatsResponse), computed from keyword search results on `leaks_history`. The rows matching active keywords (excluding the org's own monitored root domains) are fed through the same `calculate_all_statistics()` pipeline. If the organization has no active keywords, returns an empty stats response. **Parameters:** | Parameter | Default | Description | |-----------|---------|-------------| | `granularity` | `day` | Time granularity (unused in keyword stats, kept for API consistency) | | `start_date` / `end_date` | last 14 days | Date range filter | Plus all standard DynamicFilters. **Example:** ```bash GET /leaks/keyword/stats?start_date=2026-03-01&end_date=2026-03-28 ```