Skip to main content
Most endpoints return paginated JSON. That suits investigation: read a page, filter it, keep what you need. When you need a whole result set as a file, for another team, an archive or another tool, use one of three routes.
  • The export service turns a supported result set into a file: Raw Data, stealer logs, Data Brokers listings, saved Telegram and Discord searches, monitor matches and more. It is the default route.
  • A source’s own file endpoint or export flow. Some sources have one, such as filtered credentials (create, poll, download), new domain registrations, Code exposure scans and Attack Surface reports.
  • An original leak file is one source file attached to a leak, as it was found. This is the exception, not the bulk route.

​
Availability and cost

Availability: the export service and the leak-file download need only a license in force. No plan feature is checked. Each source-specific file endpoint follows the access rules of its source, which its guide states. Cost: exports and downloads use no metered allowance. With an API key, every call counts once toward your monthly API Calls allowance, each status poll included. Only 2xx responses count. See Rate limits. When your organization’s license is not active, the export service and the leak-file endpoints return 403 with {"detail": "Your license is not active."}. They never return the plan-feature 403, an allowance 429 or a capacity 409. See Plans and quotas.

​
Pick the right route

​
The export pattern

Every catalog export follows the same four calls. Export result sets covers the arguments, formats and errors.
1

Find the catalog entry

Call list_export_services. Match the entry by its name, such as ControlLeak or StealerLogs, and take its id. IDs differ between environments, so never hard-code them.
2

Create the export

Call create_export with the entry’s id as service, one of its allowed_types as type, and its arguments in args. Always send args, even as {}.
3

Poll the export

Call get_export every 30 seconds until status is COMPLETE or FAILED. FAILED is final: create a new export.
4

Download the file

Call download_export with the same export id.

​
Why search usually beats downloading a leak

DarknetSearch indexes the contents of leak files, not only their names. A Raw Data search scoped to leakId:<id> lets you read a leak through the API: page through its records, combine the leak ID with the term you care about, and narrow by fileName, fileExtension or createdAt. That usually beats moving a whole leak into local storage. A leak can run to hundreds of megabytes and hold passwords and personal data unrelated to your question, and you still have to search it once it lands. A search shows exactly why each record came back. When you need a file, export the matching records.
Search pages start at 0 and hold 10 to 100 records. Raise length (1 to 1,000, default 500) to get more of each record’s content. The original-file download still has a place: a small source file whose exact format is part of the evidence. Download leak files covers both the search and the download flow.

​
Clean up

Export-service exports stay on the server until you delete them. delete_exports removes exports and their files; pass the export IDs in ids, comma-separated. An export that is still IN_PROGRESS cannot be deleted. Export result sets has the details. Exported files and leak files can hold raw passwords, session data and personal data. Store them only where your organization allows such data.

​
Endpoints