API Reference

REST API authentication, base URL, pagination, and the full OpenAPI reference for the Stealed leak search and verification endpoints.

The Stealed public API exposes read-only leak search and verification endpoints. Management operations (monitors, channels, domains, keywords, team members) stay scoped to the dashboard with an authenticated user session.

Base URL

https://api.stealed.io

All endpoints are HTTPS only. HTTP is rejected.

Authentication

Every request carries an API key in the X-Api-Key header.

curl -H "X-Api-Key: $STEALED_API_KEY" \
  https://api.stealed.io/leaks/me

Creating an API key

API keys are organization-scoped. To create one:

Open the dashboard at app.stealed.io.
Go to Settings → API Integration.
Click New API key, give it a descriptive name (e.g. "splunk ingestion") and click Create.
Copy the key immediately. The full secret is shown only once. After that you can see the prefix in the dashboard but not the full value.

Settings → API Integration page with the API keys list and the create key flow

Permissions

A key grants access to:

GET /leaks/*: leak search, statistics, keyword search.
POST /api-keys/verify: validate a key and read the organization metadata.

Management endpoints (monitors, channels, domains, keywords, team, API keys CRUD) are NOT in the public API surface. They require a user session in the dashboard.

Rotating a key

To rotate, create a new key, deploy it to your integration, then delete the old one from the dashboard. Keys take effect immediately on creation and are invalidated immediately on deletion.

Revoking a leaked key

Suspect a key has been leaked? Delete it from Settings → API Integration. The deletion is effective immediately for new requests. Already-in-flight requests with that key complete normally.

Pagination

The /leaks/details endpoint returns paginated results:

{
  "data": [...],
  "total": 12345,
  "page": 1,
  "page_size": 50,
  "total_pages": 247
}

Default page_size: 50
Maximum page_size: 200
Pagination is offset-based, not cursor-based; for very large exports, bound your queries with start_date and end_date rather than paging through millions of rows.

Time window

The /leaks/* endpoints default to the last 14 days when neither start_date nor end_date is provided. Format: YYYY-MM-DD. Both parameters can be specified independently.

Rate limits

Per API key:

60 requests / minute (burst tolerated up to 100)
5,000 requests / hour
100,000 requests / day

When you hit a limit, the API returns 429 Too Many Requests with a Retry-After header (in seconds). Back off and retry.

Errors

Errors follow RFC 9457 Problem Details:

{
  "type": "https://api.stealed.io/errors/invalid-domain",
  "title": "Invalid domain",
  "status": 400,
  "detail": "The domain 'acme' is not in your watchlist.",
  "instance": "/leaks/details"
}

Common HTTP statuses:

Status	Meaning
200	Success
400	Validation error (see `detail`)
401	Missing or invalid API key
403	Key valid but doesn't authorize this operation
404	Resource not found
429	Rate limit exceeded
500	Internal error: retry with exponential backoff

Endpoint reference

The full OpenAPI reference (with schemas, parameters and try-it-now) is generated below from the live spec. Each operation has its own page.

Leaks: search, detail, statistics, keyword search.
API Keys: verification endpoint.

The OpenAPI spec is also available at api.stealed.io/openapi.json for codegen and SDK generation.

On this page