[Deprecated] Retrieve leaks for the current user/organization for a given query

Deprecated: For leak details, use GET /leaks/details which provides pagination, deduplication, search, and sorting. For keyword search, use GET /leaks/keyword/search.

Retrieve leak statistics for the current organization.

Each call returns a single statistic based on the query parameter. Both query and identifier_column are required.

If start_date and end_date are not provided, defaults to the last 14 days.

Required Parameters:

query: The statistic to retrieve (see query types below)
identifier_column: root_domain, email_domain, or username

Available Query Types:

Generic Queries (counts and aggregates):

generic_total_leaks_count: Total leaks count
generic_uniq_username_count: Unique usernames detected
generic_uniq_source_count: Unique sources with at least one detection
generic_uniq_password_count: Unique passwords detected
generic_uniq_domain_count: Unique domains detected
generic_uniq_leaks_count: Unique leaks (by hash)
generic_latest_leak_date: Date of the latest leak
generic_reused_password_count: Passwords reused across multiple domains
generic_password_strength: Average password length

Generic Queries (detailed data):

generic_leaks_type_by_identifier: Leaks grouped by type (combo/stealer)
generic_leaks_by_day: Leaks per day
generic_password_per_length_per_identifier: Password distribution by length
generic_most_recent_leaks_by_identifier: Most recent leaks

Organization Queries:

org_uniq_priv_account_count: Privileged accounts leaked (admin, root, etc.)
org_detailed_uniq_admin_account_count: Detailed list of admin accounts
org_uniq_ext_account_count: External accounts count
org_detailed_uniq_ext_account_count: Detailed list of external accounts
org_detailed_uniq_username_count: Detailed list of all usernames
org_total_leaks_count_group_by_identifier: Leaks grouped by identifier
org_total_leaks_count_group_by_domain: Leaks grouped by domain
org_total_leaks_count_group_by_email_domain: Leaks grouped by email domain
org_total_leaks_count_group_by_root_domain: Leaks grouped by root domain
org_top_domain_leaks_by_identifier: Top domains by leak count
org_top_user_leaks_by_identifier: Top users by leak count
org_leaks_detail_per_identifier: Full leak details per identifier

Examples:

# Total leaks count
GET /leaks/me?query=generic_total_leaks_count&identifier_column=root_domain

# Unique usernames
GET /leaks/me?query=generic_uniq_username_count&identifier_column=root_domain

# Stealer leaks only
GET /leaks/me?query=generic_total_leaks_count&identifier_column=root_domain&type=Stealer

# Leaks per day with date range
GET /leaks/me?query=generic_leaks_by_day&identifier_column=root_domain&start_date=2025-01-01&end_date=2025-01-31

# Leaks grouped by domain, limited to 100
GET /leaks/me?query=org_total_leaks_count_group_by_domain&identifier_column=root_domain&limit=100

# Multiple domain filter
GET /leaks/me?query=org_total_leaks_count_group_by_domain&identifier_column=root_domain&domain=test.example.com&domain=monitoring.example.com

Authorization

ApiKeyAuth

X-API-Key<token>

API key for authentication

In: header

Query Parameters

query*QueryType

Type of leak information query to execute

Value in

"generic_total_leaks_count" | "generic_uniq_username_count" | "generic_uniq_source_count" | "generic_leaks_type_by_identifier" | "generic_leaks_by_day" | "generic_uniq_password_count" | "generic_uniq_domain_count" | "generic_uniq_leaks_count" | "generic_latest_leak_date" | "generic_reused_password_count" | "generic_password_strength" | "generic_password_per_length_per_identifier" | "generic_most_recent_leaks_by_identifier" | "org_uniq_priv_account_count" | "org_detailed_uniq_admin_account_count" | "org_uniq_ext_account_count" | "org_detailed_uniq_ext_account_count" | "org_detailed_uniq_username_count" | "org_total_leaks_count_group_by_identifier" | "org_total_leaks_count_group_by_domain" | "org_top_domain_leaks_by_identifier" | "org_top_user_leaks_by_identifier" | "org_total_leaks_count_group_by_email_domain" | "org_total_leaks_count_group_by_root_domain" | "org_leaks_detail_per_identifier"

identifier_column*Identifier Column

Column to use for identifying the domain

Value in"root_domain" | "email_domain" | "username"

username?|array<string>|

Username of the leaked user (can be phone, email, ID, ...)

type?|array<string>|

Type of leak (combo, stealer)

hash?|array<string>|

Uniq identifier for the concatenation of : username, password and domain

upload_stealed?||array<|string>|

Upload date on stealed, ISO 8601, pattern YYYY-MM-DD

upload_date?||array<|string>|

Upload date on the plateform the credential was found, ISO 8601, pattern YYYY-mm-dd

log_date?||array<|string>|

Log date of the device at compromized moment (if applicable, stealer only)

start_date?||

Start date to search from leaks, format: YYYY-mm-dd (default: today - 14days at 0:00am)

end_date?||

End date to search leaks from, format YYYY-mm-dd (default: today)

host?|array<string>|

URL of the leaked data

domain?|array<string>|

FQDN of the leaked data

local_part?|array<string>|

Local part of the username section (if applicable, email only)

protocol?|array<string>|

Protocol identified (if applicable)

email_domain?|array<string>|

Email domain to filter on (if multiple email domains declared)

root_domain?|array<string>|

Root domain to filter on (if multiple root domains declared)

machine_id?|array<string>|

Machine ID (if applicable, stealer only)

computer_name?|array<string>|

Computer name (if applicable, stealer only)

hardware_id?|array<string>|

Hardware ID (if applicable, stealer only)

machine_user?|array<string>|

Machine user (if applicable, stealer only)

ip_address?|array<string>|

IP address (if applicable, stealer only)

country?|array<string>|

Country (if applicable, stealer only)

software?|array<string>|

Software (if applicable, stealer only)

stealer_name?|array<string>|

Stealer name (if applicable)

keyword?|array<string>|

Keyword to filter on (only active keywords for tenant)

match_type?|array<string>|

Match type for leaks_matched table (root_domain or email_domain)

not_root_domain?|array<string>|

Root domains to exclude (NOT IN filter)

not_email_domain?|array<string>|

Email domains to exclude (NOT IN filter)

not_domain?|array<string>|

Domains to exclude (NOT IN filter)

not_type?|array<string>|

Types to exclude

not_software?|array<string>|

Software to exclude

not_stealer_name?|array<string>|

Stealer names to exclude

not_protocol?|array<string>|

Protocols to exclude

not_country?|array<string>|

Countries to exclude

first_seen_date?|

Show only hashes whose first appearance (min upload_stealed) falls on this exact date. Format: YYYY-MM-DD.

first_seen_since?|

Show only hashes whose first appearance (min upload_stealed) is on or after this date. Format: YYYY-MM-DD.

limit?|

Limit result length

min_occurrences?|

Minimum number of sources (source_count >= N)

Response Body

`application/json`

curl -X GET "https://api.stealed.io/leaks/me?query=generic_total_leaks_count&identifier_column=root_domain"

null

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string"
    }
  ]
}

[Deprecated] Retrieve leaks for the current user/organization for a given query

Authorization

Query Parameters

Response Body

200application/json

422application/json

`application/json`

`application/json`