Find an organization's files in open cloud storage

Open Cloud Storage searches an index of publicly listable cloud storage buckets on Amazon S3, Google Cloud Storage and Azure. You give it a term such as acme. It returns the files whose name matches, with a direct link, the bucket that holds each file, its size and when it was last modified. In the API reference these endpoints sit under the Bucket Monitoring tag. In the dashboard the source is Search by Source → Open Cloud Storage. The flow is asynchronous: start a search, poll it until it finishes, then read the files.

Availability and cost

Availability: the Cloud Storage Exposure plan feature. Not every plan includes it. Manage → Buy more in the dashboard lists the features your plan includes. Plans and quotas explains how plan features work. Cost: no metered allowance. Calls count toward your organization’s per-second rate limit, and every 2xx response to an API-key request uses one unit of your monthly API Calls allowance. A non-2xx response is refunded. Without the feature, or when your license is not active, the four search endpoints (create_, get_, list_ and delete_bucket_search_request) return 403:

{
  "detail": "This feature is not included in your plan."
}

Cloud Storage Exposure has no allowance and no capacity slots, so these endpoints never return the allowance 429 or the capacity 409. A 429 with "message": "Rate limit exceeded" comes from the rate limit or the API Calls allowance. Rate limits explains both.

What a search matches

The term is matched against file names. Bare words must all appear. A word with a - prefix excludes files that contain it: acme invoice -draft finds files whose name contains acme and invoice but not draft. Set fullpath to match the whole file path instead of the name. Set regexp to treat the term as a regular expression.
Domain terms are shortened first. The search drops the top-level domain and the www., http://, https://, ftp:// and mailto: prefixes, so acme.com is searched as acme. If the shortened term reaches a fifth page of results, the search runs again with the term you sent and keeps those files instead. search_term in the search response shows the term the search used.
A search collects at most 5,000 files. It reads up to 5 pages of 1,000 files from the index. When the search reaches a fifth page, has_more_result_than_limit is true and more files may match than the search kept.
Submit filters decide what fills the cap. extensions, stopextensions, size_from, size_to, last_modified_from, last_modified_to, bucket and excluded_buckets narrow the files before they are collected. order and direction decide which files come first. The read filters on list_bucket_search_result only slice the files a search already kept.
A search runs once. It does not refresh. Start a new search to pick up files indexed since, or create a monitor.

Run a search

Start the search

create_bucket_search_request takes a JSON body. Only search_term is required.

curl https://client-api.leak.center/api/service/create_bucket_search_request/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "search_term": "acme -draft",
    "extensions": "pdf,docx,xlsx,csv",
    "order": "last_modified",
    "direction": "desc"
  }'

Parameter	Type	Notes
`search_term`	string	Required. 1 to 255 characters. Words are ANDed; a `-` prefix excludes.
`regexp`	boolean	Treat `search_term` as a regular expression, for example `.acme.config.*`.
`noautocorrect`	boolean	Do not auto-correct the regular expression. Applies only with `regexp`.
`fullpath`	boolean	Match the full file path, not just the file name.
`extensions`	string	Comma-separated extensions to include, for example `pdf,docx,xlsx`. Up to 255 characters.
`stopextensions`	string	Comma-separated extensions to exclude, for example `jpg,png,gif`. Up to 255 characters.
`size_from` / `size_to`	integer	File size range in bytes, 1 to 4999999999999.
`last_modified_from` / `last_modified_to`	integer	Last-modified range as Unix timestamps in seconds.
`bucket`	string	Search one bucket, by URL (`acme-backups.s3.amazonaws.com`) or index ID. Index IDs can change, so prefer the URL.
`excluded_buckets`	string	Comma-separated bucket URLs or IDs to leave out.
`order`	string	`size` or `last_modified`. Decides which files fill the 5,000-file cap.
`direction`	string	`asc` or `desc`.

The call returns 201 with the search:

{
  "id": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "search_term": "acme -draft",
  "create_date": "2026-10-08T09:14:02.481203Z",
  "update_date": "2026-10-08T09:14:02.481203Z",
  "created_at": "2026-10-08T09:14:02.481203Z",
  "is_monitoring": false,
  "alert_cycle": "month",
  "is_email": false,
  "is_reporting": false,
  "status": "in_progress",
  "report_id": null,
  "has_more_result_than_limit": false
}

Keep the id. is_monitoring, alert_cycle, is_email, is_reporting and report_id are scheduling fields that a search you start here leaves at their defaults.

Poll until it finishes

Fetch the search with get_bucket_search_request until status is finished.

curl https://client-api.leak.center/api/service/get_bucket_search_request/a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d/ \
  -H "X-API-Key: YOUR_API_KEY"

status takes two values:

in_progress: still running.
finished: done. Read the files.

There is no failed state. If the index cannot be reached, the search still ends finished, with no files. Poll every 10 seconds or slower: each successful poll uses an API call.When the search finishes, check has_more_result_than_limit and search_term. true means the search stopped at 5,000 files. A search_term that differs from what you sent means the shortened domain term was used.

Read the files

list_bucket_search_result returns the files of one search. Pass the search id as searchrequest.

curl -G https://client-api.leak.center/api/service/list_bucket_search_result/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "searchrequest=a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d" \
  --data-urlencode "file_category=documents" \
  --data-urlencode "page_size=1000"

Parameter	Type	Notes
`searchrequest`	string	Required. The search `id`. Must be a UUID.
`page`	integer	1-based. Default `1`.
`page_size`	integer	Default `100`, max `1000`.
`search`	string	Case-insensitive text match on the bucket host name and the file link.
`file_category`	string	One category from the table below.
`size_range`	string	`tiny` (under 1 KB), `small` (1 KB to 100 KB), `medium` (100 KB to 1 MB), `large` (1 MB to 10 MB) or `xlarge` (10 MB and over).
`order`	string	`last_modified` (default), `bucket`, `link` or `size`.
`direction`	string	`desc` (default) or `asc`. Applies only together with `order`. Without `order`, files come newest `last_modified` first.

file_category groups files by extension:

Category	Extensions
`documents`	pdf, doc, docx, xls, xlsx, ppt, pptx, odt, ods, rtf
`images`	jpg, jpeg, png, gif, svg, webp, bmp, ico, tiff, heic
`data-exports`	csv, json, xml, yaml, yml, tsv
`source-code`	js, ts, py, java, c, cpp, php, rb, go, rs, swift, html, css
`config-secrets`	env, ini, conf, cfg, pem, key, crt, cer, p12, pfx
`database`	sql, db, sqlite, mdb, accdb, dump, bak
`archives`	zip, rar, tar, gz, 7z, bz2
`logs`	log, txt

An unknown file_category returns no files rather than an error.

What comes back

{
  "count": 1,
  "total_count": 214,
  "next": null,
  "previous": null,
  "available_categories": ["documents", "images", "data-exports"],
  "results": [
    {
      "id": "f7a1c0e2-3b4d-4e5f-8a9b-1c2d3e4f5a6b",
      "link": "https://acme-backups.s3.amazonaws.com/finance/acme-q4-payroll.xlsx",
      "bucket": "acme-backups.s3.amazonaws.com",
      "size": 248192,
      "file_extension": "xlsx",
      "last_modified": "2026-05-14T09:21:00Z",
      "appeared_date": "2026-10-08",
      "found_sensitive": null,
      "searchrequest": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d"
    }
  ]
}

The envelope:

count: files that match the read filters you sent, across all pages.
total_count: every file the search kept, ignoring search, file_category and size_range.
available_categories: the categories present among all the search’s files. Use it to offer only filters that return data.
next / previous: null at either end. The URLs point at the internal search service, not at client-api.leak.center, so don’t call them. Raise page until next is null.

Each file:

Field	Meaning
`id`	The file record’s ID. Use it with `get_bucket_search_result` and `delete_bucket_search_result`.
`link`	Direct URL of the file in the bucket.
`bucket`	Host name of the bucket that holds the file.
`size`	File size in bytes.
`file_extension`	Lowercase extension taken from the link, or an empty string when the name has none.
`last_modified`	When the file last changed in the bucket, `YYYY-MM-DDTHH:MM:SSZ` in UTC. Can be `null`.
`appeared_date`	The date this search recorded the file, `YYYY-MM-DD`.
`found_sensitive`	Always `null` for cloud storage files.
`searchrequest`	The search `id`.

Manage searches and files

list_bucket_search_request lists your organization’s searches, newest first. page_size defaults to 20, max 100. ordering takes create_date, -create_date, update_date or -update_date.
get_bucket_search_result returns one file by its id.
delete_bucket_search_result removes one file from a search and returns 204. count and total_count drop by one.
delete_bucket_search_request removes a search and all of its files and returns 204.

curl -X DELETE https://client-api.leak.center/api/service/delete_bucket_search_request/a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d/ \
  -H "X-API-Key: YOUR_API_KEY"

Watch the term continuously

A search runs once. To re-run a term on a schedule and receive only new files, create a monitor on the bucket source. See Create a monitoring rule. A monitor on this source needs the same Cloud Storage Exposure plan feature. Quick search also runs this source for domain, IP address, host name and file name searches. On a plan without the feature, quick search reports this source as not_entitled.

Errors

Status	When	Body
`400`	`search_term` is missing, blank or over 255 characters, or another submit field fails validation	Field errors, for example `{"search_term": ["This field is required."]}` or `{"order": ["\"name\" is not a valid choice."]}`
`400`	`searchrequest` is missing or not a UUID on `list_bucket_search_result`	`{"searchrequest": ["This field is required."]}` or `{"searchrequest": ["Must be a valid UUID."]}`
`403`	Your plan lacks Cloud Storage Exposure, or your license is not active	See Availability and cost
`404`	No search or file with that `id`	—
`404`	`page` is past the last page	`{"detail": "Invalid page."}`
`429`	The per-second rate limit or the monthly API Calls allowance is reached	See Rate limits
`502`	The search service failed	`{"detail": "The requested service is temporarily unavailable."}`
`504`	The search service timed out	`{"detail": "The requested service timed out."}`

Errors lists every error the API returns.

Endpoints

Action	Endpoint
Start a search	`POST /api/service/create_bucket_search_request/`
Get a search and its status	`GET /api/service/get_bucket_search_request/{id}/`
List searches	`GET /api/service/list_bucket_search_request/`
Delete a search and its files	`DELETE /api/service/delete_bucket_search_request/{id}/`
List a search’s files	`GET /api/service/list_bucket_search_result/`
Get one file	`GET /api/service/get_bucket_search_result/{id}/`
Delete one file	`DELETE /api/service/delete_bucket_search_result/{id}/`

Get started

Search

Leaked credentials

Assess & report

Monitors

Domain monitoring

Downloads & exports

Changelog

Find an organization's files in open cloud storage

Availability and cost

What a search matches

Run a search

What comes back

Manage searches and files

Watch the term continuously

Errors

Endpoints

​Availability and cost

​What a search matches

​Run a search

​What comes back

​Manage searches and files

​Watch the term continuously

​Errors

​Endpoints

Availability and cost

What a search matches

Run a search

What comes back

Manage searches and files

Watch the term continuously

Errors

Endpoints