Skip to main content
ULP stands for URL, Login, Password: the three columns of a leaked credential record. accounts_database_search searches the account index of those records. Each row is one credential: a login, a password and the website it was used on, tagged with the leak it came from. Some rows hold the password in plain text, others only its hash. In the dashboard this source is Raw Credentials, one of the individual data sources in expert search. The search has no domain restriction. Use it to look up one address on any domain, such as jdoe@acme-login.com, or to find every credential used on a website. Filtered credentials covers only the domains your organization owns. Availability: every plan with a license in force. Cost: no metered allowance. Each call made with an API key uses 1 call from your monthly API Calls allowance. A call that does not return 2xx is refunded. See Rate limits. Without a license in force, the call returns 403:
Plans and quotas explains license status.

​
Search the account index

Send a Lucene query in the query parameter, 3 to 1,024 characters. The index has five fields: Combine clauses with AND, OR and NOT. Bare words separated by a space are joined with OR: jdoe asmith matches either login. Field names, and the values of login and website, are not case-sensitive.

​
Wildcards

The wildcards * and ? work only in these forms: In the website form, the domain after *. needs at least two labels, so website:*.com finds nothing.

​
Special characters

Put a value in double quotes when it contains a space or a Lucene operator character, as in password:"Summer2026!". Quote full URLs too: website:"https://acme.com/login". Queries also contain characters that must be URL-encoded. Let curl -G --data-urlencode handle it:

​
Paging and order

  • page is zero-based. The default is 0.
  • size is 10 to 100 rows. The default is 10.
  • sort defaults to createdAt,desc, so the most recently indexed rows come first.
  • Raise page until last is true. totalElements and totalPages give the size of the whole result set.
Results return in the same response. There is nothing to poll.

​
Read the results

A response is one page of rows. This search for website:acme.com found three:
The envelope describes the page:
  • number: the page returned, zero-based.
  • size: the page size you asked for.
  • numberOfElements: the rows on this page.
  • totalElements and totalPages: the size of the whole result set.
  • first, last and hasContent: where this page sits, and whether it holds rows.
  • partial and partialReason: whether the result set is complete. partial is true when the search hit its time limit or part of the account index did not answer in time, and the page and its counts then cover only the parts that answered. partialReason says why, such as timeout or shard_failures, and is null when the results are complete.
Each row in content:
  • login and password: the credential. The password is plain text or a hash, depending on the leak, and can be empty.
  • website: the URL or host the credential was used on. It can be empty.
  • leakId, leakName, leakSize and leakTags: the source leak. leakTags lists the kinds of data the whole leak holds, not this one row.
  • leakPublishDate and leakDiscoverDate: the leak’s publish date and discovery date.
  • cvssScore: the severity score, or null.
  • createdAt: when this row was indexed, as YYYY-MM-DD HH:MM:SS. It is the default sort key.
  • id: the row ID.
Pivot on any column. Each value in a row is also a field you can query. Search password:"W3lcome#2025" to see which other logins carry the same password. Search leakId: with a row’s leak ID to read every other row from that leak. Search a login on its own to see every website it appears with.
A row from a stealer log has more behind it. The ULP feed shows one credential. When info-stealer malware took it, the same capture also holds the machine’s other saved logins, cookies and often screenshots. Stealer logs searches those captures and hands you the link to the full bot record.
account_breaches and the other Leaks Analysis endpoints do not search this index. They report on your organization’s own domain within its analysis window of 7, 30 or 365 days. Organization analytics covers them.

​
Errors

Any other 4xx from the account index is passed through with its own status and body. Handle API errors lists every error the API returns.

​
Endpoints