> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search across all data sources

> Pick one search term and the platform searches it across every relevant data source at once.

<Info>
  A **quick search** casts the widest net: give it one term — a domain, an email, an IP — and it searches every related data source at once, returning one merged result. It's the natural starting point — run it to see what's out there across every source, then dig deeper into the ones that matter.
</Info>

### Pick your search

Each search takes a single `search_term`, matched to its type:

| Your term           | Endpoint                                                                                                                                      |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| Domain              | [`domain_quick_search`](https://client-api.leak.center/scalar-docs/#tag/search/POST/service/domain_quick_search/)                             |
| Email               | [`email_quick_search`](https://client-api.leak.center/scalar-docs/#tag/search/POST/service/email_quick_search/)                               |
| Brand               | [`brand_quick_search`](https://client-api.leak.center/scalar-docs/#tag/search/POST/service/brand_quick_search/)                               |
| IP address or range | [`ip_address_and_range_quick_search`](https://client-api.leak.center/scalar-docs/#tag/search/POST/service/ip_address_and_range_quick_search/) |
| Name                | [`name_quick_search`](https://client-api.leak.center/scalar-docs/#tag/search/POST/service/name_quick_search/)                                 |
| Password            | [`password_quick_search`](https://client-api.leak.center/scalar-docs/#tag/search/POST/service/password_quick_search/)                         |
| Credit card         | [`credit_card_quick_search`](https://client-api.leak.center/scalar-docs/#tag/search/POST/service/credit_card_quick_search/)                   |
| File name           | [`file_name_quick_search`](https://client-api.leak.center/scalar-docs/#tag/search/POST/service/file_name_quick_search/)                       |
| Host name           | [`host_name_quick_search`](https://client-api.leak.center/scalar-docs/#tag/search/POST/service/host_name_quick_search/)                       |

### What each search covers

The term you pick decides which sources run. The platform fans the search out to every source that applies and returns the findings **grouped by source**. Breadth varies with the term — a domain reaches 12 sources, a credit card reaches 3. Source names below are the product names you'll see in the response's `feature_names`.

<Accordion title="See which sources each search covers">
  A ✓ means that search type reaches that source; rows run from broadest coverage to narrowest. (**Host** = host name · **File** = file name · **Card** = credit card.)

  | Source                | What it is                                 | Domain | Email | Name | Brand |  IP | Host | File | Password | Card |
  | --------------------- | ------------------------------------------ | :----: | :---: | :--: | :---: | :-: | :--: | :--: | :------: | :--: |
  | Telegram              | Telegram channels & messages               |    ✓   |   ✓   |   ✓  |   ✓   |  ✓  |   ✓  |   ✓  |     ✓    |   ✓  |
  | Discord               | Discord servers & messages                 |    ✓   |   ✓   |   ✓  |   ✓   |  ✓  |   ✓  |   ✓  |     ✓    |   ✓  |
  | Leaks                 | Raw leak database (breaches, combolists)   |    ✓   |   ✓   |   ✓  |   ✓   |  ✓  |   ✓  |   ✓  |          |      |
  | Data Brokers          | Hacker & underground forums                |    ✓   |   ✓   |   ✓  |   ✓   |  ✓  |   ✓  |      |          |      |
  | Pastes Live Search    | Public paste dumps                         |    ✓   |   ✓   |      |       |  ✓  |   ✓  |   ✓  |     ✓    |      |
  | Open Cloud Storage    | Open cloud-storage buckets                 |    ✓   |       |      |       |  ✓  |   ✓  |   ✓  |          |      |
  | URL Shorteners        | Shortened-link records                     |    ✓   |   ✓   |      |       |  ✓  |   ✓  |      |          |      |
  | Accounts              | Indexed account leaks (plaintext + hashed) |        |       |   ✓  |   ✓   |     |      |      |     ✓    |      |
  | Credentials           | Filtered, deduplicated leaked credentials  |    ✓   |   ✓   |      |       |     |      |      |          |      |
  | Credit Cards          | Leaked & deep-web payment cards            |        |       |   ✓  |       |     |      |      |          |   ✓  |
  | SSL Transparency Logs | SSL/TLS certificate logs                   |    ✓   |       |      |   ✓   |     |      |      |          |      |
  | Phishtank Monitoring  | Phishing sites & campaigns                 |    ✓   |       |      |   ✓   |     |      |      |          |      |
  | Fake Apps             | Mobile app-store listings                  |    ✓   |       |      |   ✓   |     |      |      |          |      |
  | Cyber Intel           | Ransomware leak-site victims               |    ✓   |       |      |       |     |      |      |          |      |
</Accordion>

### How it works

These searches run **asynchronously**: you submit a search, get back a record with an `id`, then poll that record until every source has reported.

<Steps>
  <Step title="Submit the search">
    `POST` your term to the matching endpoint. It returns a search record (`201`) carrying an `id`.

    ```bash theme={"dark"}
    curl https://client-api.leak.center/api/service/domain_quick_search/ \
      -X POST \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{"search_term": "acme.com"}'
    ```
  </Step>

  <Step title="Poll for results">
    Fetch the record by its `id`. Its `result` fills in per source as each one reports back.

    ```bash theme={"dark"}
    curl https://client-api.leak.center/api/service/retrieve_quick_search_record_with_status_update/123/ \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
    ```

    → [`retrieve_quick_search_record_with_status_update`](https://client-api.leak.center/scalar-docs/#tag/search/GET/service/retrieve_quick_search_record_with_status_update/\{id}/)
  </Step>
</Steps>

### Reading the results

A search record carries:

* `feature_names` — the sources searched, by their product name (`Leaks`, `Credentials`, `SSL Transparency Logs`, `Cyber Intel`, …).
* `services_slugs` — the same sources by their internal slug.
* `result` — a map keyed by source slug, one entry per source.
* `follow_up_token` — see below.

Each `result` entry has a `status`, plus either inline `data` (the source answered immediately) or a `task_id` (still working — poll for it). Entries also carry their own scoped `follow_up_token`.

```json theme={"dark"}
{
  "id": 104173,
  "type": "domain_quick_search",
  "search_params": { "query": "acme.com" },
  "feature_names": ["Leaks", "Cyber Intel", "SSL Transparency Logs", "Telegram", "Pastes Live Search"],
  "services_slugs": ["leak_extended_database_search", "ransomware_victims_list", "paste-search-create"],
  "result": {
    "ransomware_victims_list": {
      "status": "ok",
      "data": { "count": 1, "rows": [{ "company": "Acme Corp", "groupname": "examplegroup", "country": "Germany" }] }
    },
    "leak_extended_database_search": {
      "status": "ok",
      "data": { "content": ["...leak records..."], "follow_up_token": "eyJhbGci..." }
    },
    "paste-search-create": {
      "status": "submitted",
      "task_id": "d1f86713-051b-4894-8f3b-c81ea65f6322"
    }
  },
  "follow_up_token": "eyJhbGci..."
}
```

Each source reports its own `status`:

| Status                   | Meaning                                                                                    |
| ------------------------ | ------------------------------------------------------------------------------------------ |
| `ok`                     | Done. A sync source that answered inline reports `ok` and includes its findings in `data`. |
| `submitted`              | Still processing — keep polling.                                                           |
| `submission_failed`      | The search couldn't be sent to that source.                                                |
| `fetching_status_failed` | The status check for that source failed.                                                   |

An async source keeps the status reported by its own status endpoint, so it doesn't land on `ok` — it starts as `submitted` and finishes on a source-specific terminal value such as `finished`, `Completed`, or `Complete`, then exposes a `task_id`.

**Read it per source, not all-or-nothing.** The search fans out in parallel — some sources answer instantly, others take longer, and one failing never fails the rest. Treat `submitted` as "keep polling" and any non-failure value as done; don't wait for `ok` on an async source. Partial results are normal.

### Pulling a source's full findings

What you do next depends on what a source's `result` entry contains.

**It has `data`** → the findings are already there. Read them directly — there's nothing more to fetch. Most sources answer this way (Leaks, SSL Transparency Logs, Cyber Intel, Telegram, Discord, Accounts, …).

**It has a `task_id`** (status `submitted`) → the source runs as a background job. Poll the record until that source reaches its terminal status, then **re-query its result endpoint with the `task_id`** for the full findings:

| Source                  | Result endpoint                                                                                                                                                  |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Credentials             | [`leak_filter_domain_search_results`](https://client-api.leak.center/scalar-docs/#tag/leak-filter/GET/service/leak_filter_domain_search_results/)                |
| Data Brokers            | [`retrieve_hacker_forum_task_results`](https://client-api.leak.center/scalar-docs/#tag/hacker-forums/GET/service/retrieve_hacker_forum_task_results/\{task_id}/) |
| Open Cloud Storage      | [`list_bucket_search_result`](https://client-api.leak.center/scalar-docs/#tag/bucket-monitoring/GET/service/list_bucket_search_result/)                          |
| URL Shorteners          | [`list_shortener_search_result`](https://client-api.leak.center/scalar-docs/#tag/shortener-search/GET/service/list_shortener_search_result/)                     |
| Fake Apps               | [`list_store_search_result`](https://client-api.leak.center/scalar-docs/#tag/app-store-search/GET/service/list_store_search_result/)                             |
| Pastes Live Search      | [`paste-search-detail`](https://client-api.leak.center/scalar-docs/#tag/paste-search/GET/service/paste-search-detail/\{job_id}/)                                 |
| Credit Cards (deep web) | [`retrieve_credit_card_task_results`](https://client-api.leak.center/scalar-docs/#tag/credit-card/GET/service/retrieve_credit_card_task_results/\{task_id}/)     |
| Phishtank Monitoring    | [`list_phishing_search_result`](https://client-api.leak.center/scalar-docs/#tag/phishtank-monitoring/GET/service/list_phishing_search_result/)                   |

**The follow-up token.** The response carries a `follow_up_token` at the top level, and **each source entry carries its own** scoped to that one source. It's a JWT (valid 24 hours) that ties a follow-up call back to your original search — the source, the exact query parameters, and your organization. Send it as a `Follow-Up-Token` header on the call above:

```bash theme={"dark"}
curl "https://client-api.leak.center/api/service/leak_filter_domain_search_results/?domain_url=acme.com&filter_id=5" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Follow-Up-Token: YOUR_FOLLOW_UP_TOKEN"
```

The Credentials follow-up requires a `filter_id`: a domain quick search submits with `filter_id=5`, and an email quick search uses `filter_id=1` plus `filter_parameters` usernames. See [Filtered credentials](/api/guides/credentials-filtered) for the full filter catalog.

An expired or mismatched token returns `401`.

<Info>
  **Need to go narrower?** This hits every source for your term. To search one specific indexed source (a forum, a channel, Telegram, Discord) on its own, **search that individual data source**; for real-time queries against a live source, use a **live search**.
</Info>