> ## Documentation Index > Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt > Use this file to discover all available pages before exploring further. # Downloads and exports > How to move API results into files, and when to use the export service instead of downloading original leak files. Most DarknetSearch endpoints return paginated JSON because that is the safest way to investigate raw exposure: read a page, filter, sort, and keep only what you need. When you need to hand a result set to another team, archive evidence, or process it outside the API, use an export or download flow. There are two separate file workflows: * **Exporting a result set** means turning API results into a file. This is the normal path for search results, monitoring matches, filtered credentials, stealer logs, and other result sets. * **Downloading an original leak file** means retrieving a specific source file attached to a leak. This is the exception: it is only for small files under 10 MB, and it is not built for inspecting a large leak. ### Why search usually beats downloading Directly downloading a full leak sounds useful, but it rarely adds investigative value. DarknetSearch indexes the contents of the leak files themselves, not only their metadata. A Raw Data search scoped to `leakId:` is therefore a way to browse the leak content through the API: page through the records, increase the returned context with `length`, filter by `fileName`, `fileExtension`, or `createdAt`, and combine the leak ID with the term you actually care about. That is usually better than moving a full raw leak file into local storage. Large leak files can be hundreds of megabytes or more, may contain passwords and personal data unrelated to your investigation, and still need to be searched after download. The indexed search path keeps the investigation targeted and reproducible: the query shows exactly why a row was returned, and the result can be exported when you need a handoff file. Original leak-file download still has a place. Use it when you need the exact small source file attached to a leak, for example to preserve original formatting, inspect a small attachment, or keep controlled evidence outside the search result format. Original leak-file downloads are not the bulk export path. Large leaks are already indexed. Search them with `leakId:`, page through the matching records, or use the export flow for the result set you created. ### Pick the right path | You need | Use | Guide | | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- | | A downloadable file for a supported API result set | The general export service: `list_export_services` → `create_export` → `get_export` → `download_export` | [Export result sets](/api/guides/export-service) | | Filtered credential rows for an owned domain | The dedicated leak-filter export endpoints | [Filtered credentials](/api/guides/credentials-filtered#export-the-results) | | Monitoring match hits | The alert match download endpoint | [Read and triage matches](/api/guides/monitoring-matches#export) | | Telegram search history | The Telegram history export endpoint | [Telegram](/api/guides/expert-telegram) | | A generated PDF exposure report | The report status and report download endpoints | [Reports](/api/guides/reports) | | A specific original file inside one leak, under 10 MB | The leak-file download flow | [Download leak files](/api/guides/leak-file-downloads) | | A large leak you want to investigate | Raw Data search with `leakId:` | [Raw Data](/api/guides/credentials-raw-sweep) | ### The default export pattern For result sets registered in the export catalog, use [Export result sets](/api/guides/export-service). The service catalog tells you which result sets can be exported, which file formats are allowed, and which arguments the export needs. The important point: service IDs are environment-specific, so do not hard-code them. Read the catalog, match the service by its stable `name`, `alias`, or `slug`, then create the export with that service's `id`. Call [`list_export_services`](https://client-api.leak.center/scalar-docs/#tag/export/GET/api/service/list_export_services/) and find the service for the result set you want to export. Call [`create_export`](https://client-api.leak.center/scalar-docs/#tag/export/POST/api/service/create_export/) with the service `id`, a file `type`, and the service-specific `args`. Call [`get_export`](https://client-api.leak.center/scalar-docs/#tag/export/GET/api/service/get_export/) with the export `id` until the status is `COMPLETE`. Call [`download_export`](https://client-api.leak.center/scalar-docs/#tag/export/GET/api/service/download_export/) with the same export `id`. ### The leak-file exception Original leak-file download exists for one narrow case: you need a specific source file attached to a leak, and that file is small enough for self-service download. Files larger than **10 MB** should be investigated through the indexed Raw Data search instead. That means a leak with a 500 MB SQL dump should not be downloaded just so you can search it locally. Search: ```text theme={"dark"} leakId:423a5128-a40b-3050-88be-79b5e07ffaa6 ``` or combine the leak ID with the term you actually care about: ```text theme={"dark"} acme.com AND leakId:423a5128-a40b-3050-88be-79b5e07ffaa6 ``` The full endpoint flow for small source files is in [Download leak files](/api/guides/leak-file-downloads). ### Handle exported data carefully Exports and downloaded leak files can contain raw passwords, session material, personal data, and internal records. Keep them in approved storage, share them only with the team that needs them, and delete local copies when the investigation is done.