Skip to main content
What changed in the public API, newest first. Each entry links to the guide (or the API reference) for the endpoint it touches.
Breaking changes ship with at least 60 days’ notice — each one names what breaks, the migration, and its sunset date. Use the tag filter to show only Breaking. Subscribe via the RSS feed.
Entries before July 2026 were reconstructed from the API history and grouped by month. Going forward, each entry tracks a single release.
​
BreakingNewFixed
Breaking
  • Live search create body simplified to a single query field. The live_search_create body is now just { "query": ... }. The platform, priority, requested_by, and chat_id fields are no longer accepted — the engine sets them server-side. Guide →
  • Alert-rule sender is now optional. Alert-rule responses may now return a null sender, and sender is optional on create and update. Update any integration that assumes a rule always has a sender. Guide →
New
  • Live Search result filters and platform health endpoints. Guide →
  • Domain Search endpoints for the newly registered domains feed. Reference →
  • Usage Limits endpoint for API rate-limit usage stats. Reference →
  • mask_passwords option for report schedules and report generation. Guide →
  • SpoofGuard analysis endpoints accept and forward filter query params. Reference →
  • Usage limits endpoint gains service_slug and feature filters. Reference →
  • needs_attention field on alert rule responses. Guide →
  • Add seven boolean filters to certificate database search. Guide →
  • New Stealer Logs Search API. Search the credential corpus by infected machine — an async create → poll → read flow that returns each stealer-log capture with a bot record and screenshots you pull on demand. Guide →
  • Add stealer_pics_urls field to stealer log search results. Stealer-log records now include the screenshot URLs captured at infection time. Guide →
  • Add source and date filtering params to phishing search. Guide →
Fixed
  • Report schedule endpoints return detailed validation errors. Guide →
  • Fix Telegram channel suggestion create response contract. Guide →
  • Fix stealer log search timeout handling — timed-out requests now return 504. Reference →
​
BreakingNewFixed
Breaking
  • Report schedule endpoints renamed to unique action-style URLs. Report schedule endpoints moved to unique URLs: create_report_schedule, list_report_schedules, update_report_schedule/{schedule_id}, and list_scheduled_reports/{schedule_id} replace the report-schedules/ paths. Validation failures now return the specific error message in the 400 response, and list_scheduled_reports accepts an optional org_id query parameter for system-level users. Guide →
  • Empty domains list rejected on report and schedule endpoints. Report generation and report schedule endpoints now reject an empty domains list with a 400 error (‘Empty domains list is not allowed.’). Guide →
  • Legacy quick-report endpoints deprecated. generate_extended_report, generate_simple_report, and generate_spr_simple_report will be removed on 2026-07-13. Migrate to the premium and credential-comparison report endpoints. Sunset: 2026-07-13. Guide →
  • Alert rule list: is_deleted filter replaced by include_deleted; soft-delete fields exposed on rule responses. The alert-rule list filter is_deleted is replaced by include_deleted: set include_deleted=true to also return soft-deleted rules; by default only active rules return. Rule responses now include deleted_at, deleted_by, and deletion_snapshot, and sender and email_template can be null on soft-deleted rules. Guide →
New
  • Add ordering param and updated_at field to report listing. Guide →
Fixed
  • Fix a 500 error on app store search results. Guide →
  • Fix 500s on SpoofGuard export and monitors endpoints. Reference →
  • Fix 502 errors on SpoofGuard analysis endpoints (analysis_stats, analysis_detail). Reference →
  • System-level users: report requests now target the managed organization via org_id. Guide →
​
BreakingNew
Breaking
  • 2FA enrollment now requires OTP verification. 2FA enrollment is now a two-step flow. Calling setup_2fa returns a QR code and seed but no longer enables 2FA; you must confirm by posting a 6-digit code to the new /service/verify_2fa_enrollment/ endpoint, which activates 2FA and returns one-time backup codes. At login you can supply a backup code instead of an OTP, and the OTP time window is slightly more forgiving. Guide →
  • Organization competitors endpoint paginated. The organization competitors endpoint now returns a paginated response with count, next, previous, and results instead of a plain list, and accepts page, size, and ordering parameters. The weeks parameter on the leak-count history endpoints is documented with a maximum of 260. Guide →
  • Alert exclusions now use a nested AND/OR condition model. Alert rule exclusions take an array of condition groups shaped { "match": "all"|"any", "rules": [{"field","value"}] }, where rules can nest. Exclusion records return a condition object. The CSV upload endpoint takes a match (all|any) parameter. Update any integration built on the old flat field/value exclusion body. Guide →
  • Enforce 2048-char limit on webhook URL. Webhook url values are now capped at 2048 characters when creating or updating a webhook; longer URLs are rejected with a validation error. Guide →
  • Deprecated legacy endpoints removed and hidden from the API. Removed the deprecated Paste, Botnet, Pastebin, legacy Ransomware, favourites, and old export/stats endpoints; calls to these paths now return 404. The GitHub search and legacy live-search endpoints are also no longer listed in the API reference. Reference →
  • Alert rules accept multiple recipients. Alert rules now support multiple recipients. The single ‘recipient’ field on create, update, and list responses is replaced by a ‘recipients’ list of recipient IDs. Guide →
  • Filtered-credentials exports are now asynchronous. Filtered-credentials results export via async jobs: create an export, poll leak_filter_export_retrieve/{id}/, then download from leak_filter_export_download/{id}/ (link expires after 24h). The old leak_filter_search_download/ and leak_filter_domain_search_download/ endpoints are removed. Guide →
  • Deprecated report types removed from report generation. The sprsimple, simple, and extended report types are removed. The generate_spr_simple_report/, generate_simple_report/, and generate_extended_report/ endpoints no longer exist; only premium and credential comparison reports can be generated. Guide →
New
  • org_id parameter added to Ransomwatch endpoints. Guide →
  • Higher max page size for paste and certificate search. Guide →
  • Filter and sort alert match detail results and downloads. Guide →
  • Filtering and pagination for Filtered credentials result endpoints. Guide →
  • Filtering and pagination on the alert list and overview endpoints. Guide →
  • Telegram search service endpoints on the public API. Guide →
  • New Discord search endpoints. Guide →
  • first_discovered date filters on leak filter searches. Guide →
  • Alert frequency options. Guide →
  • exact_match parameter on leak filter searches. Guide →
  • Filter parameters for account breaches and stealer-log analysis. Guide →
  • Credential comparison report type. Guide →
  • Report schedule endpoints. Guide →
  • Ransomware victim export filters. Guide →
  • Filtering and pagination added to export listing endpoints. Guide →
​
BreakingNewFixed
Breaking
  • Paginate alert rule list and rename alert filter params. The alert rule list (alert_system_alert_get_alert_rule_list) now returns a paginated response with count, next, previous, and results, and each rule includes is_deleted, total_alerts_count, and total_matches_count. Filter parameters were renamed to recipient_id, sender_id, email_template_id, and webhook_id, with a new is_deleted filter. The service listing now reports frequency as a number and includes excludable_fields. Guide →
  • Mails external search migrated to new API spec. The mails external search API moved to a new spec. On the create call, company is now company_name, and the type/seniority/department fields moved to the results call. Fetching results is now a GET with query-string filters (type, seniority, department, position, source_domain, search, ordering, page, size) and returns a count/next/previous paginated response. Guide →
  • Pagination, filtering, and premium type on list report requests. The report list endpoint GET /service/list_report_requests/ now supports pagination and filtering via page, page_size, report_type, status, and domain query parameters. The response is now a paginated envelope (data, page, page_size, total_items, total_pages), each item carries a type field, and status values are now slugs (started, in_progress, ready, error) instead of display strings. The premium report type is now accepted. Guide →
  • Report list created_at now includes time. The created_at field in report list responses now includes the time (format dd-mm-yyyy HH:MM:SS) instead of date only. Guide →
New
  • Add alert rule exclusion endpoints. Guide →
  • New paste search endpoints. Guide →
  • Search history gains ordering param and datetime timestamps. Reference →
  • Add filtering, sorting, and pagination to bucket and shortener search result endpoints. Guide →
  • Add main_org_id to organization info response. Guide →
  • Add excluded-item support to alert match endpoints. Guide →
  • Add excluded_count to alert statistics responses. Guide →
Fixed
  • Fix missing id field in alert match list responses. Guide →
​
BreakingNew
Breaking
  • Rework risk score APIs (renamed endpoints and response fields, new endpoints). The risk score API endpoints have been renamed under /api/service/ (get_risk_score becomes get_organization_risk_score, list_competitors becomes list_organization_competitors, and similar). The score history endpoint now returns leak_risk_score and infra_risk_score instead of score, and takes a weeks parameter instead of year. New endpoints return benchmark and global weekly leak-count history. Update integrations to the new paths and fields. Guide →
New
​
Breaking
Breaking
  • Search history moved to a service-scoped endpoint. The search history endpoint now requires a service slug: GET /api/service/get_search_history/{category}/{service_slug}/. Results are scoped to that service, and the old category-only path no longer works. Use page and page_size to paginate. Reference →