Skip to main content
Raw Data is the widest net into the leak corpus. leak_extended_database_search runs a full-text Lucene query across every indexed leak file and returns one row per matching record. The same person or credential can appear many times, across many leaks. Nothing is parsed or deduplicated. In the dashboard, this is the Raw Leaks tile in Search by Source and the Raw Data tab in Unified Search. Availability: every plan with a license in force. No plan feature is checked. Cost: no metered allowance. With an API key, each call counts once toward your monthly API Calls allowance, every page you walk included, and only 2xx responses count. See Rate limits. When your organization’s license is not active, both Raw Data endpoints return 403 with {"detail": "Your license is not active."}. They never return the plan-feature 403, an allowance 429 or a capacity 409. See Plans and quotas.
Why you see duplicates. Free leaks get repackaged: the same breach resurfaces under new names, rebundled into new combolists and reposted across forums and channels. One credential showing up many times is expected. Heavy duplication of a single leak tells you it is widely recirculated. Deduplicate when you need a clean count. Keep the duplicates when you want to gauge how far something has spread.

​
What a search returns

The leaked content comes back in the form a threat actor packaged it. One search can surface any of these:
  • SQL dumps
  • JSON exports
  • CSV and Excel spreadsheets
  • Plain-text files and documents
  • Configuration files and logs
  • Combolists (email and password pairs)
  • Stealer-log captures
Each row carries the leaked text in content. fileName and fileExtension tell you the format. leakId, leakName, leakSource, leakSize, leakTags, leakPublishDate, leakDiscoverDate and cvssScore describe the leak it came from. id and createdAt identify the record and when it was indexed.

​
Write a query

Pass a Lucene query in query, 3 to 1024 characters. The default field is content, so a bare term searches the leaked text itself. Scope a term to a field, and combine terms with AND, OR and NOT. A bare term matches the word, or any token it is part of. acme.com matches jdoe@acme.com and hr.acme.com alike, and also a longer name that ends in -acme.com. Queries contain spaces and characters such as : and [, so let curl -G --data-urlencode encode them:
That resolves to one URL:
Results return in the same response. There is nothing to poll.

​
Read a raw record

A response is one page of records. Here is the first of 8,421 matches for acme.com:
Check partial on every page. It is true when the results are incomplete: the search hit its time limit, or part of the leak index did not answer in time. The page and its counts then cover only the parts that answered. partialReason says why, such as timeout or shard_failures, and is null when the results are complete. Two kinds of tags appear in that record, and they mean different things:
  • <kaduu:h>…</kaduu:h> inside content marks where your search term matched. Send highlight=true and every hit on your term is wrapped in these markers, so you can find it in a wall of raw text. The default is false.
  • leakTags lists the kinds of data in the whole parent leak (password,email,ip,name,hash,sql here). It describes the leak, not this one row.
Read past the highlight. The <kaduu:h> markers show where your term landed, not the whole finding. The useful data usually sits next to the match. Above, the search hit the email address, and the password, IP address and name sit beside it, outside the tags. Read the surrounding content, and raise length when you need more of it.

​
Page and sort

Increase page until the response says "last": true. To get a whole result set as a file, export it instead of paging.

​
See which leaks expose you

leak_simple_database_search runs the same query but rolls the matches up by leak. You get one row per leak your term appears in, each with resultCount, the number of matching records inside it. Instead of tens of thousands of raw rows, you see which leaks expose you and how big each hit is. It takes the same query, page and size. Its sort defaults to resultCount,desc, so the leak with the most matches comes first. It has no length or highlight, because it returns no content.
partial and partialReason work as in Read a raw record. Each row is leak metadata plus resultCount. Its id is the leak’s ID. To read the records inside one leak, run a Raw Data search with leakId:<id>, alone or combined with your term.

​
Export a full result set

To get every matching record as a file, use the export service instead of walking pages:
  1. Call list_export_services and find the entry whose name is ControlLeak. It exports Raw Data records. ControlLeakDistinct exports the by-leak roll-up.
  2. Call create_export with the entry’s id as service, one of its allowed_types as type, and args set to {"query": "<your Lucene query>"}. Read the entry’s args for the other fields it accepts.
  3. Poll the export and download the file, as Export result sets describes.
Need the original leak file? Direct leak-file downloads are for small source files. For anything else, keep the work in Raw Data: search leakId:<id> to browse the indexed leak, or add a keyword to search inside it. Downloads and exports helps you choose between a result-set export and an original-file download.

​
Errors

Errors lists every error the API returns.

​
Other credential searches

Use Raw Data when you want everything and will triage it yourself. Find leaked credentials compares all five approaches.

​
Endpoints