Skip to main content
Most DarknetSearch endpoints return paginated JSON because that is the safest way to investigate raw exposure: read a page, filter, sort, and keep only what you need. When you need to hand a result set to another team, archive evidence, or process it outside the API, use an export or download flow. There are two separate file workflows:
  • Exporting a result set means turning API results into a file. This is the normal path for search results, monitoring matches, filtered credentials, stealer logs, and other result sets.
  • Downloading an original leak file means retrieving a specific source file attached to a leak. This is the exception: it is only for small files under 10 MB, and it is not built for inspecting a large leak.

​
Why search usually beats downloading

Directly downloading a full leak sounds useful, but it rarely adds investigative value. DarknetSearch indexes the contents of the leak files themselves, not only their metadata. A Raw Data search scoped to leakId:<id> is therefore a way to browse the leak content through the API: page through the records, increase the returned context with length, filter by fileName, fileExtension, or createdAt, and combine the leak ID with the term you actually care about. That is usually better than moving a full raw leak file into local storage. Large leak files can be hundreds of megabytes or more, may contain passwords and personal data unrelated to your investigation, and still need to be searched after download. The indexed search path keeps the investigation targeted and reproducible: the query shows exactly why a row was returned, and the result can be exported when you need a handoff file. Original leak-file download still has a place. Use it when you need the exact small source file attached to a leak, for example to preserve original formatting, inspect a small attachment, or keep controlled evidence outside the search result format.
Original leak-file downloads are not the bulk export path. Large leaks are already indexed. Search them with leakId:<id>, page through the matching records, or use the export flow for the result set you created.

​
Pick the right path

​
The default export pattern

For result sets registered in the export catalog, use Export result sets. The service catalog tells you which result sets can be exported, which file formats are allowed, and which arguments the export needs. The important point: service IDs are environment-specific, so do not hard-code them. Read the catalog, match the service by its stable name, alias, or slug, then create the export with that service’s id.
1

Find the export service

Call list_export_services and find the service for the result set you want to export.
2

Create the export

Call create_export with the service id, a file type, and the service-specific args.
3

Poll the job

Call get_export with the export id until the status is COMPLETE.
4

Download the file

Call download_export with the same export id.

​
The leak-file exception

Original leak-file download exists for one narrow case: you need a specific source file attached to a leak, and that file is small enough for self-service download. Files larger than 10 MB should be investigated through the indexed Raw Data search instead. That means a leak with a 500 MB SQL dump should not be downloaded just so you can search it locally. Search:
or combine the leak ID with the term you actually care about:
The full endpoint flow for small source files is in Download leak files.

​
Handle exported data carefully

Exports and downloaded leak files can contain raw passwords, session material, personal data, and internal records. Keep them in approved storage, share them only with the team that needs them, and delete local copies when the investigation is done.