Skip to main content
This page covers two different jobs around a single leak:
Most investigations should start with leak_extended_database_search, not with download_leak_file. The download endpoint retrieves the original source file. It does not filter that file down to one username, domain, or keyword.
Self-service leak-file downloads are limited to files smaller than 10 MB. Files above that threshold belong in the indexed search flow: search by leakId, page through the results you need, or contact support for exceptional manual access.

​
Does a full download make sense?

Usually, no. The leak is already searchable because the platform indexes the contents of the leak files. Downloading the source file does not give you a broader search surface; it gives you a local copy of sensitive raw material that you still have to process yourself. Searching the indexed leak is the better path when you want to:
  • browse all indexed records from one leak with leakId:<id>
  • search for one username, domain, email, keyword, or file type inside that leak
  • keep the output paginated and controlled instead of handling a large source file
  • increase the surrounding context only for matching records
  • export the result set you actually need, instead of storing unrelated leaked data
Download the original file only when the original file itself matters: for example, a small CSV, text file, or document where the exact file format is part of the evidence.

​
Find data inside one leak

If you already have a leakId from a Raw Data result, use it directly. If not, find the leak first with leak_simple_database_search or leaks_list. To browse the indexed contents of one leak, search only by its ID:
To investigate a specific username, email, domain, or keyword inside that leak, combine the term with the leak ID:
You can keep narrowing with the same Raw Data fields: Page through the results with page and size; increase length when you need more surrounding context from each matching record. If you need a local file of only those matching rows, export or page that filtered result set. That is the API equivalent of the old dashboard workflow where you queried a leakId, selected the matching results, and exported them. It is different from downloading the original leak source file.

​
Download a small original file

Use this flow only when the file is under 10 MB and you need the original source file itself.
1

Find the leak

If you do not already have the leak ID, search or browse for it.
You can fetch the leak metadata with leak_detail:
2

List the files in the leak

leak_files returns the files attached to that leak. Check size before requesting a download.
The response is paginated. Each file includes an id, name, and size:
Only continue with files below 10 MB. For larger files, use the leakId search flow above.
3

Request the file

request_to_download_leak_file prepares a downloadable copy. The request body calls the file identifier digest; pass the file id returned by leak_files.
The response includes a download request id, name, status, size, and errorText.
4

Poll the download status

leaks_downloads lists your download requests. Wait until the request status is finished before downloading the file.
If the status is still new, the file is not ready yet and download_leak_file will fail. If errorText is set, read it before retrying.
5

Download the prepared file

Once the request status is finished, call download_leak_file with the download request ID:

​
Troubleshooting

Treat downloaded leak files as highly sensitive data. Store them only where you are allowed to hold raw leaked material, and delete local copies when the investigation no longer needs them.