> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Download leak files

> How to extract data from one leak, and when the original leak-file download flow applies.

This page covers two different jobs around a single leak:

| Goal                                                                                     | Use                                                                                                         |
| ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| Find a username, domain, email, keyword, file type, or other specific data inside a leak | [Raw Data search](/api/guides/credentials-raw-sweep) with `leak_extended_database_search` and `leakId:<id>` |
| Download a file containing only the filtered results you found                           | Export or page the filtered result set; see [Downloads and exports](/api/guides/downloads-exports)          |
| Download the original source file attached to the leak                                   | The leak-file download flow on this page, only for files under 10 MB                                        |

<Info>
  Most investigations should start with `leak_extended_database_search`, not with `download_leak_file`. The download endpoint retrieves the original source file. It does not filter that file down to one username, domain, or keyword.
</Info>

<Warning>
  Self-service leak-file downloads are limited to files smaller than **10 MB**. Files above that threshold belong in the indexed search flow: search by `leakId`, page through the results you need, or contact support for exceptional manual access.
</Warning>

### Does a full download make sense?

Usually, no. The leak is already searchable because the platform indexes the contents of the leak files. Downloading the source file does not give you a broader search surface; it gives you a local copy of sensitive raw material that you still have to process yourself.

Searching the indexed leak is the better path when you want to:

* browse all indexed records from one leak with `leakId:<id>`
* search for one username, domain, email, keyword, or file type inside that leak
* keep the output paginated and controlled instead of handling a large source file
* increase the surrounding context only for matching records
* export the result set you actually need, instead of storing unrelated leaked data

Download the original file only when the original file itself matters: for example, a small CSV, text file, or document where the exact file format is part of the evidence.

### Find data inside one leak

If you already have a `leakId` from a Raw Data result, use it directly. If not, find the leak first with [`leak_simple_database_search`](https://client-api.leak.center/scalar-docs/#tag/leaks/GET/service/leak_simple_database_search/) or [`leaks_list`](https://client-api.leak.center/scalar-docs/#tag/leaks/GET/service/leaks_list/).

To browse the indexed contents of one leak, search only by its ID:

```bash theme={"dark"}
curl -G https://client-api.leak.center/api/service/leak_extended_database_search/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --data-urlencode 'query=leakId:423a5128-a40b-3050-88be-79b5e07ffaa6' \
  --data-urlencode 'size=100' \
  --data-urlencode 'page=0'
```

To investigate a specific username, email, domain, or keyword inside that leak, combine the term with the leak ID:

```bash theme={"dark"}
curl -G https://client-api.leak.center/api/service/leak_extended_database_search/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --data-urlencode 'query=jane.doe@acme.com AND leakId:423a5128-a40b-3050-88be-79b5e07ffaa6' \
  --data-urlencode 'size=100' \
  --data-urlencode 'page=0' \
  --data-urlencode 'highlight=true'
```

You can keep narrowing with the same Raw Data fields:

| Goal                                       | Query example                                                                    |
| ------------------------------------------ | -------------------------------------------------------------------------------- |
| Browse one leak                            | `leakId:423a5128-a40b-3050-88be-79b5e07ffaa6`                                    |
| Find one username or email inside one leak | `jane.doe@acme.com AND leakId:423a5128-a40b-3050-88be-79b5e07ffaa6`              |
| Find one domain inside one leak            | `acme.com AND leakId:423a5128-a40b-3050-88be-79b5e07ffaa6`                       |
| Search only SQL files inside one leak      | `acme.com AND leakId:423a5128-a40b-3050-88be-79b5e07ffaa6 AND fileExtension:sql` |
| Search one file name pattern               | `leakId:423a5128-a40b-3050-88be-79b5e07ffaa6 AND fileName:users`                 |

Page through the results with `page` and `size`; increase `length` when you need more surrounding context from each matching record.

If you need a local file of only those matching rows, export or page that filtered result set. That is the API equivalent of the old dashboard workflow where you queried a `leakId`, selected the matching results, and exported them. It is different from downloading the original leak source file.

### Download a small original file

Use this flow only when the file is under 10 MB and you need the original source file itself.

<Steps>
  <Step title="Find the leak">
    If you do not already have the leak ID, search or browse for it.

    ```bash theme={"dark"}
    curl -G https://client-api.leak.center/api/service/leaks_list/ \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
      --data-urlencode 'name=acme' \
      --data-urlencode 'size=20'
    ```

    You can fetch the leak metadata with [`leak_detail`](https://client-api.leak.center/scalar-docs/#tag/leaks/GET/service/leak_detail/\{leak_id}):

    ```bash theme={"dark"}
    curl https://client-api.leak.center/api/service/leak_detail/LEAK_ID \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
    ```
  </Step>

  <Step title="List the files in the leak">
    [`leak_files`](https://client-api.leak.center/scalar-docs/#tag/leaks/GET/service/leak_files/\{leak_id}) returns the files attached to that leak. Check `size` before requesting a download.

    ```bash theme={"dark"}
    curl "https://client-api.leak.center/api/service/leak_files/LEAK_ID?size=100" \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
    ```

    The response is paginated. Each file includes an `id`, `name`, and `size`:

    ```json theme={"dark"}
    {
      "content": [
        {
          "id": "FILE_DIGEST",
          "name": "users.csv",
          "size": 7340021
        },
        {
          "id": "LARGE_FILE_DIGEST",
          "name": "full_dump.sql",
          "size": 482857014
        }
      ]
    }
    ```

    Only continue with files below 10 MB. For larger files, use the `leakId` search flow above.
  </Step>

  <Step title="Request the file">
    [`request_to_download_leak_file`](https://client-api.leak.center/scalar-docs/#tag/leaks/POST/api/service/request_to_download_leak_file/) prepares a downloadable copy. The request body calls the file identifier `digest`; pass the file `id` returned by `leak_files`.

    ```bash theme={"dark"}
    curl https://client-api.leak.center/api/service/request_to_download_leak_file/ \
      -X POST \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{"leakId": "LEAK_ID", "digest": "FILE_DIGEST"}'
    ```

    The response includes a download request `id`, `name`, `status`, `size`, and `errorText`.
  </Step>

  <Step title="Poll the download status">
    [`leaks_downloads`](https://client-api.leak.center/scalar-docs/#tag/leaks/GET/service/leaks_downloads/) lists your download requests. Wait until the request status is `finished` before downloading the file.

    ```bash theme={"dark"}
    curl "https://client-api.leak.center/api/service/leaks_downloads/?size=100" \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
    ```

    If the status is still `new`, the file is not ready yet and `download_leak_file` will fail. If `errorText` is set, read it before retrying.
  </Step>

  <Step title="Download the prepared file">
    Once the request status is `finished`, call [`download_leak_file`](https://client-api.leak.center/scalar-docs/#tag/leaks/GET/service/download_leak_file/\{download_id}) with the download request ID:

    ```bash theme={"dark"}
    curl -L https://client-api.leak.center/api/service/download_leak_file/DOWNLOAD_ID \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
      -o users.csv
    ```
  </Step>
</Steps>

### Troubleshooting

| Symptom                                                               | What to do                                                                                               |
| --------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| The file is larger than 10 MB                                         | Do not use direct download. Search with `leakId:<id>` and page the indexed results instead.              |
| `download_leak_file` returns an error                                 | Check `leaks_downloads`. The request may still be `new` or may have an `errorText`.                      |
| You need one keyword, domain, file type, or date range                | Use `leak_extended_database_search` with `leakId`, `fileExtension`, `fileName`, and `createdAt` filters. |
| You need the whole large leak for legal or incident-response handling | Contact support for manual handling rather than using the self-service download endpoint.                |

Treat downloaded leak files as highly sensitive data. Store them only where you are allowed to hold raw leaked material, and delete local copies when the investigation no longer needs them.