Skip to main content
The DarknetSearch API puts our dark-web and breach intelligence in your own tools. Search leaked credentials and dark-web sources, monitor your assets and look-alike domains, and assess an organization’s risk and attack surface. Every call is a REST request that carries your API key. These guides are organized by goal, in seven sections. Each section opens with an overview that points you to the right guide. Each guide explains what to call and why, then links into the API reference, where you can see every parameter and run it live. New here? Start with Get started, then go to the job you came to do.

​
Start here

Authentication

Create an API key in the dashboard under Manage → API tokens and send it in the X-API-Key header on every call. A key acts as one organization. Do this once. Every other guide assumes it.

Plans and limits

What your plan includes, what each call uses, the per-second rate limit, and the monthly API Calls allowance. Read the X-RateLimit headers to pace your calls.

Errors

Read the status code and body of a failed call. Tell a request you can fix from a plan refusal, a limit or an outage, and decide whether to retry.

Migrate to the editions release

Built an integration before the editions release? What changes for it: API keys, one key per organization, plan refusals, removed routes and changed fields.

​
Then, by goal

Search

Find what is out there. Send one term to every source that covers it, go deep into one of 15 indexed sources, or run one of 3 live searches against external sources in real time.

Leaked credentials

Find your organization’s exposed passwords. Five approaches — Credential Check, Raw Data, the ULP feed, Filtered credentials and Stealer logs — plus organization analytics.

Assess & report

Measure one organization: a 0 to 100 risk score with benchmarks, its internet-facing hosts, a full Attack Surface assessment, its exposed code, and credential comparison reports.

Monitors

Put a domain, brand or search term under watch on one data source. A monitor re-runs on a schedule, records what is new as a match, and sends it to email or a webhook.

Domain monitoring

Find registered look-alikes of a domain your organization owns, check them for spoofed content and phishing, watch them for changes and request takedowns. The API tag is SpoofGuard.

Downloads & exports

Move results into files. Use the export service for result sets, and reserve original leak-file downloads for small source files.

​
Go straight to a guide

Credential check

Check one password, email address, or email and password pair against known leaks from your sign-up, login and password-change flows. One synchronous call, nothing to poll.

Attack Surface

Run a full or targeted assessment of a domain and follow its progress. Then generate, brand and download the report, or read its data as JSON.

Code exposure

Search GitHub, GitLab, Gists, Postman and Google for code and API collections that mention an organization, and list the developers behind its repositories.

Infra search

Passively list the hosts, IP addresses, open ports and known CVEs under a domain. The dashboard calls it Attack Surface Discovery.

​
The endpoint reference

Every guide links into the API reference: the complete, try-it-live catalog of endpoints, parameters and response shapes. Use the guides to learn a workflow. Use the reference to look up the exact call. The changelog lists what changed and when.