> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.
# API changelog
> Changes to the public DarknetSearch API — breaking changes, new capabilities, and fixes. Tracks the API reference.
What changed in the [public API](https://client-api.leak.center/scalar-docs/), newest first. Each entry links to the guide (or the API reference) for the endpoint it touches.
**Breaking changes ship with at least 60 days' notice** — each one names what breaks, the migration, and its sunset date. Use the tag filter to show only **Breaking**. Subscribe via the [RSS feed](/changelog/rss.xml).
Entries before July 2026 were reconstructed from the API history and grouped by month. Going forward, each entry tracks a single release.
**Breaking**
* **Live search create body simplified to a single query field.** The live\_search\_create body is now just `{ "query": ... }`. The platform, priority, requested\_by, and chat\_id fields are no longer accepted — the engine sets them server-side. [Guide →](/api/guides/live-search)
* **Alert-rule `sender` is now optional.** Alert-rule responses may now return a null `sender`, and `sender` is optional on create and update. Update any integration that assumes a rule always has a sender. [Guide →](/api/guides/monitoring-rules)
**New**
* **Live Search result filters and platform health endpoints.** [Guide →](/api/guides/live-search)
* **Domain Search endpoints for the newly registered domains feed.** [Reference →](https://client-api.leak.center/scalar-docs/)
* **Usage Limits endpoint for API rate-limit usage stats.** [Reference →](https://client-api.leak.center/scalar-docs/)
* **mask\_passwords option for report schedules and report generation.** [Guide →](/api/guides/reports-credential-comparison)
* **SpoofGuard analysis endpoints accept and forward filter query params.** [Reference →](https://client-api.leak.center/scalar-docs/)
* **Usage limits endpoint gains service\_slug and feature filters.** [Reference →](https://client-api.leak.center/scalar-docs/)
* **needs\_attention field on alert rule responses.** [Guide →](/api/guides/monitoring-rules)
* **Add seven boolean filters to certificate database search.** [Guide →](/api/guides/expert-ssl-logs)
* **New Stealer Logs Search API.** Search the credential corpus by infected machine — an async create → poll → read flow that returns each stealer-log capture with a bot record and screenshots you pull on demand. [Guide →](/api/guides/credentials-stealer-logs)
* **Add stealer\_pics\_urls field to stealer log search results.** Stealer-log records now include the screenshot URLs captured at infection time. [Guide →](/api/guides/credentials-stealer-logs)
* **Add source and date filtering params to phishing search.** [Guide →](/api/guides/expert-phishing)
**Fixed**
* **Report schedule endpoints return detailed validation errors.** [Guide →](/api/guides/reports-credential-comparison)
* **Fix Telegram channel suggestion create response contract.** [Guide →](/api/guides/expert-telegram)
* **Fix stealer log search timeout handling — timed-out requests now return 504.** [Reference →](https://client-api.leak.center/scalar-docs/)
**Breaking**
* **Report schedule endpoints renamed to unique action-style URLs.** Report schedule endpoints moved to unique URLs: `create_report_schedule`, `list_report_schedules`, `update_report_schedule/{schedule_id}`, and `list_scheduled_reports/{schedule_id}` replace the report-schedules/ paths. Validation failures now return the specific error message in the 400 response, and list\_scheduled\_reports accepts an optional org\_id query parameter for system-level users. [Guide →](/api/guides/reports-credential-comparison)
* **Empty domains list rejected on report and schedule endpoints.** Report generation and report schedule endpoints now reject an empty domains list with a 400 error ('Empty domains list is not allowed.'). [Guide →](/api/guides/reports-credential-comparison)
* **Legacy quick-report endpoints deprecated.** generate\_extended\_report, generate\_simple\_report, and generate\_spr\_simple\_report will be removed on 2026-07-13. Migrate to the premium and credential-comparison report endpoints. **Sunset: 2026-07-13.** [Guide →](/api/guides/reports)
* **Alert rule list: is\_deleted filter replaced by include\_deleted; soft-delete fields exposed on rule responses.** The alert-rule list filter is\_deleted is replaced by include\_deleted: set include\_deleted=true to also return soft-deleted rules; by default only active rules return. Rule responses now include deleted\_at, deleted\_by, and deletion\_snapshot, and sender and email\_template can be null on soft-deleted rules. [Guide →](/api/guides/monitoring-rules)
**New**
* **Add ordering param and updated\_at field to report listing.** [Guide →](/api/guides/reports)
**Fixed**
* **Fix a 500 error on app store search results.** [Guide →](/api/guides/expert-app-store)
* **Fix 500s on SpoofGuard export and monitors endpoints.** [Reference →](https://client-api.leak.center/scalar-docs/)
* **Fix 502 errors on SpoofGuard analysis endpoints (analysis\_stats, analysis\_detail).** [Reference →](https://client-api.leak.center/scalar-docs/)
* **System-level users: report requests now target the managed organization via org\_id.** [Guide →](/api/guides/reports)
**Breaking**
* **2FA enrollment now requires OTP verification.** 2FA enrollment is now a two-step flow. Calling setup\_2fa returns a QR code and seed but no longer enables 2FA; you must confirm by posting a 6-digit code to the new /service/verify\_2fa\_enrollment/ endpoint, which activates 2FA and returns one-time backup codes. At login you can supply a backup code instead of an OTP, and the OTP time window is slightly more forgiving. [Guide →](/api/guides/authentication)
* **Organization competitors endpoint paginated.** The organization competitors endpoint now returns a paginated response with count, next, previous, and results instead of a plain list, and accepts page, size, and ordering parameters. The weeks parameter on the leak-count history endpoints is documented with a maximum of 260. [Guide →](/api/guides/risk-score)
* **Alert exclusions now use a nested AND/OR condition model.** Alert rule exclusions take an array of condition groups shaped `{ "match": "all"|"any", "rules": [{"field","value"}] }`, where rules can nest. Exclusion records return a condition object. The CSV upload endpoint takes a match (all|any) parameter. Update any integration built on the old flat field/value exclusion body. [Guide →](/api/guides/monitoring-exclusions)
* **Enforce 2048-char limit on webhook URL.** Webhook `url` values are now capped at 2048 characters when creating or updating a webhook; longer URLs are rejected with a validation error. [Guide →](/api/guides/monitoring-delivery)
* **Deprecated legacy endpoints removed and hidden from the API.** Removed the deprecated Paste, Botnet, Pastebin, legacy Ransomware, favourites, and old export/stats endpoints; calls to these paths now return 404. The GitHub search and legacy live-search endpoints are also no longer listed in the API reference. [Reference →](https://client-api.leak.center/scalar-docs/)
* **Alert rules accept multiple recipients.** Alert rules now support multiple recipients. The single 'recipient' field on create, update, and list responses is replaced by a 'recipients' list of recipient IDs. [Guide →](/api/guides/monitoring-rules)
* **Filtered-credentials exports are now asynchronous.** Filtered-credentials results export via async jobs: create an export, poll `leak_filter_export_retrieve/{id}/`, then download from `leak_filter_export_download/{id}/` (link expires after 24h). The old leak\_filter\_search\_download/ and leak\_filter\_domain\_search\_download/ endpoints are removed. [Guide →](/api/guides/credentials-filtered)
* **Deprecated report types removed from report generation.** The sprsimple, simple, and extended report types are removed. The generate\_spr\_simple\_report/, generate\_simple\_report/, and generate\_extended\_report/ endpoints no longer exist; only premium and credential comparison reports can be generated. [Guide →](/api/guides/reports)
**New**
* **org\_id parameter added to Ransomwatch endpoints.** [Guide →](/api/guides/expert-threat-actors)
* **Higher max page size for paste and certificate search.** [Guide →](/api/guides/expert-ssl-logs)
* **Filter and sort alert match detail results and downloads.** [Guide →](/api/guides/monitoring-matches)
* **Filtering and pagination for Filtered credentials result endpoints.** [Guide →](/api/guides/credentials-filtered)
* **Filtering and pagination on the alert list and overview endpoints.** [Guide →](/api/guides/monitoring-metrics)
* **Telegram search service endpoints on the public API.** [Guide →](/api/guides/expert-telegram)
* **New Discord search endpoints.** [Guide →](/api/guides/expert-discord)
* **first\_discovered date filters on leak filter searches.** [Guide →](/api/guides/credentials-filtered)
* **Alert frequency options.** [Guide →](/api/guides/monitoring-rules)
* **exact\_match parameter on leak filter searches.** [Guide →](/api/guides/credentials-filtered)
* **Filter parameters for account breaches and stealer-log analysis.** [Guide →](/api/guides/credentials-ulp-feed)
* **Credential comparison report type.** [Guide →](/api/guides/reports-credential-comparison)
* **Report schedule endpoints.** [Guide →](/api/guides/reports-credential-comparison)
* **Ransomware victim export filters.** [Guide →](/api/guides/expert-threat-actors)
* **Filtering and pagination added to export listing endpoints.** [Guide →](/api/guides/credentials-filtered)
**Breaking**
* **Paginate alert rule list and rename alert filter params.** The alert rule list (alert\_system\_alert\_get\_alert\_rule\_list) now returns a paginated response with count, next, previous, and results, and each rule includes is\_deleted, total\_alerts\_count, and total\_matches\_count. Filter parameters were renamed to recipient\_id, sender\_id, email\_template\_id, and webhook\_id, with a new is\_deleted filter. The service listing now reports frequency as a number and includes excludable\_fields. [Guide →](/api/guides/monitoring-rules)
* **Mails external search migrated to new API spec.** The mails external search API moved to a new spec. On the create call, company is now company\_name, and the type/seniority/department fields moved to the results call. Fetching results is now a GET with query-string filters (type, seniority, department, position, source\_domain, search, ordering, page, size) and returns a count/next/previous paginated response. [Guide →](/api/guides/live-search)
* **Pagination, filtering, and premium type on list report requests.** The report list endpoint GET /service/list\_report\_requests/ now supports pagination and filtering via page, page\_size, report\_type, status, and domain query parameters. The response is now a paginated envelope (data, page, page\_size, total\_items, total\_pages), each item carries a type field, and status values are now slugs (started, in\_progress, ready, error) instead of display strings. The premium report type is now accepted. [Guide →](/api/guides/reports)
* **Report list created\_at now includes time.** The created\_at field in report list responses now includes the time (format dd-mm-yyyy HH:MM:SS) instead of date only. [Guide →](/api/guides/reports)
**New**
* **Add alert rule exclusion endpoints.** [Guide →](/api/guides/monitoring-exclusions)
* **New paste search endpoints.** [Guide →](/api/guides/expert-pastes)
* **Search history gains ordering param and datetime timestamps.** [Reference →](https://client-api.leak.center/scalar-docs/)
* **Add filtering, sorting, and pagination to bucket and shortener search result endpoints.** [Guide →](/api/guides/expert-url-shorteners)
* **Add main\_org\_id to organization info response.** [Guide →](/api/guides/setup)
* **Add excluded-item support to alert match endpoints.** [Guide →](/api/guides/monitoring-matches)
* **Add excluded\_count to alert statistics responses.** [Guide →](/api/guides/monitoring-metrics)
**Fixed**
* **Fix missing id field in alert match list responses.** [Guide →](/api/guides/monitoring-matches)
**Breaking**
* **Rework risk score APIs (renamed endpoints and response fields, new endpoints).** The risk score API endpoints have been renamed under /api/service/ (get\_risk\_score becomes get\_organization\_risk\_score, list\_competitors becomes list\_organization\_competitors, and similar). The score history endpoint now returns leak\_risk\_score and infra\_risk\_score instead of score, and takes a weeks parameter instead of year. New endpoints return benchmark and global weekly leak-count history. Update integrations to the new paths and fields. [Guide →](/api/guides/risk-score)
**New**
* **Add retrieve all domain hostnames endpoint.** [Reference →](https://client-api.leak.center/scalar-docs/)
**Breaking**
* **Search history moved to a service-scoped endpoint.** The search history endpoint now requires a service slug: `GET /api/service/get_search_history/{category}/{service_slug}/`. Results are scoped to that service, and the old category-only path no longer works. Use page and page\_size to paginate. [Reference →](https://client-api.leak.center/scalar-docs/)