Open Cloud Storage

Search misconfigured S3 buckets and Azure containers that expose files publicly. Use it to find documents, exports, source code, and config secrets sitting in open cloud storage that mention your brand, domains, or hostnames. This source is asynchronous. You submit a search, poll until it finishes, then read the matched files.

Submit

Submit the search with create_bucket_search_request. Only search_term is required; everything else narrows the result set. The response returns the request id you poll on.

curl -X POST 'https://client-api.leak.center/api/service/create_bucket_search_request/' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "search_term": "acme confidential -draft",
    "extensions": "pdf,docx,xlsx",
    "order": "last_modified",
    "direction": "desc"
  }'

Poll

Poll get_bucket_search_request with the id from the submit step. Check status until the search is finished. has_more_result_than_limit tells you whether the result set was capped.

curl 'https://client-api.leak.center/api/service/get_bucket_search_request/a1b2c3d4-0000-0000-0000-000000000000/' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Read

Read the matched files with list_bucket_search_result. Pass the request id as searchrequest. Page with page/page_size, and narrow with file_category, size_range, or a free-text search over the bucket hostname and link.

curl 'https://client-api.leak.center/api/service/list_bucket_search_result/?searchrequest=a1b2c3d4-0000-0000-0000-000000000000&file_category=documents&page=1&page_size=100' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Request parameters

Submit parameters (create_bucket_search_request):

Parameter	Type	Required	Notes
`search_term`	string	Yes	Terms using AND/NOT logic. Bare terms are ANDed; a `-` prefix excludes. Example: `confidential invoice -draft`. Max 255 chars.
`regexp`	boolean	No	Treat `search_term` as a regular expression, e.g. `.config.`.
`fullpath`	boolean	No	Match against the full file path, not just the filename.
`noautocorrect`	boolean	No	Disable auto-correction of regex patterns. Only applies when `regexp` is true.
`bucket`	string	No	Restrict to one bucket by ID or URL, e.g. `acme.s3.amazonaws.com` or `1021`.
`excluded_buckets`	string	No	Comma-separated bucket URLs or IDs to exclude.
`extensions`	string	No	Comma-separated extensions to include, e.g. `pdf,docx,txt`.
`stopextensions`	string	No	Comma-separated extensions to exclude, e.g. `jpg,png,gif`.
`size_from`	integer	No	Minimum file size in bytes (1 to 4999999999999).
`size_to`	integer	No	Maximum file size in bytes (1 to 4999999999999).
`last_modified_from`	integer	No	Start date as a Unix epoch timestamp.
`last_modified_to`	integer	No	End date as a Unix epoch timestamp.
`order`	enum	No	Sort by `size` or `last_modified`.
`direction`	enum	No	`asc` or `desc`.
`org_id`	string	No	Target a subsidiary organization (system-level users only).

Read parameters (list_bucket_search_result):

Parameter	Type	Required	Notes
`searchrequest`	string	Yes	The request `id` returned by submit.
`page`	integer	No	1-based page number. Default `1`.
`page_size`	integer	No	Results per page. Default `100`.
`search`	string	No	Case-insensitive text match across bucket hostname and link URL.
`file_category`	enum	No	One of `documents`, `images`, `data-exports`, `source-code`, `config-secrets`, `database`, `archives`, `logs`.
`size_range`	enum	No	`tiny` (under 1KB), `small` (1KB–100KB), `medium` (100KB–1MB), `large` (1MB–10MB), `xlarge` (over 10MB).
`order`	enum	No	`last_modified`, `bucket`, `link`, or `size`. Default `last_modified`.
`direction`	enum	No	`asc` or `desc`. Default `desc`.

Credits and rate limits: all three endpoints cost 0 credits. Submit is throttled to 100 requests/day; poll and read are each throttled to 500 requests/day.

What comes back

The poll response (get_bucket_search_request) describes the request itself — id, search_term, status, create_date, update_date, created_at, and has_more_result_than_limit. The read response (list_bucket_search_result) is a paginated envelope:

count — number of results in this page.
total_count — total matches across all pages.
next / previous — page cursors, null at the ends.
available_categories — file categories present in this result set, so you know which file_category filters will return data.
results — the matched files.

Each item in results carries:

id — result identifier.
link — direct URL to the exposed file.
bucket — the bucket hostname or ID holding the file.
size — file size in bytes.
file_extension — the file’s extension.
last_modified — when the file was last changed in the bucket.
appeared_date — when the file was first observed.
found_sensitive — flag for sensitive content detected in the file.
searchrequest — the originating request id.

{
  "count": 1,
  "total_count": 1,
  "next": null,
  "previous": null,
  "available_categories": ["documents"],
  "results": [
    {
      "id": "f7a1c0e2-0000-0000-0000-000000000000",
      "link": "https://acme-backups.s3.amazonaws.com/finance/q4-payroll.xlsx",
      "bucket": "acme-backups.s3.amazonaws.com",
      "size": 248192,
      "file_extension": "xlsx",
      "last_modified": "2026-05-14T09:21:00Z",
      "appeared_date": "2026-05-15",
      "found_sensitive": "true",
      "searchrequest": "a1b2c3d4-0000-0000-0000-000000000000"
    }
  ]
}

Pull every link, confirm whether each file is still publicly reachable, and route any found_sensitive hits to the bucket owner for takedown. If has_more_result_than_limit is true, tighten extensions, size_range, or the date window and re-run to surface the rest.

Get started

Search

Leaked credentials

Assess & report

Monitor

Downloads & exports

Changelog

Request parameters

What comes back

​Request parameters

​What comes back

Request parameters

What comes back