> ## Documentation Index > Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt > Use this file to discover all available pages before exploring further. # Open Cloud Storage > Search misconfigured S3 buckets and Azure containers for files exposing your data Search misconfigured S3 buckets and Azure containers that expose files publicly. Use it to find documents, exports, source code, and config secrets sitting in open cloud storage that mention your brand, domains, or hostnames. This source is **asynchronous**. You submit a search, poll until it finishes, then read the matched files. Submit the search with [`create_bucket_search_request`](https://client-api.leak.center/scalar-docs/#tag/bucket-monitoring/POST/service/create_bucket_search_request/). Only `search_term` is required; everything else narrows the result set. The response returns the request `id` you poll on. ```bash theme={"dark"} curl -X POST 'https://client-api.leak.center/api/service/create_bucket_search_request/' \ -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \ -H 'Content-Type: application/json' \ -d '{ "search_term": "acme confidential -draft", "extensions": "pdf,docx,xlsx", "order": "last_modified", "direction": "desc" }' ``` Poll [`get_bucket_search_request`](https://client-api.leak.center/scalar-docs/#tag/bucket-monitoring/GET/service/get_bucket_search_request/\{id}/) with the `id` from the submit step. Check `status` until the search is finished. `has_more_result_than_limit` tells you whether the result set was capped. ```bash theme={"dark"} curl 'https://client-api.leak.center/api/service/get_bucket_search_request/a1b2c3d4-0000-0000-0000-000000000000/' \ -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' ``` Read the matched files with [`list_bucket_search_result`](https://client-api.leak.center/scalar-docs/#tag/bucket-monitoring/GET/service/list_bucket_search_result/). Pass the request `id` as `searchrequest`. Page with `page`/`page_size`, and narrow with `file_category`, `size_range`, or a free-text `search` over the bucket hostname and link. ```bash theme={"dark"} curl 'https://client-api.leak.center/api/service/list_bucket_search_result/?searchrequest=a1b2c3d4-0000-0000-0000-000000000000&file_category=documents&page=1&page_size=100' \ -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' ``` ### Request parameters Submit parameters (`create_bucket_search_request`): | Parameter | Type | Required | Notes | | -------------------- | ------- | -------- | ------------------------------------------------------------------------------------------------------------------------------ | | `search_term` | string | Yes | Terms using AND/NOT logic. Bare terms are ANDed; a `-` prefix excludes. Example: `confidential invoice -draft`. Max 255 chars. | | `regexp` | boolean | No | Treat `search_term` as a regular expression, e.g. `.*config.*`. | | `fullpath` | boolean | No | Match against the full file path, not just the filename. | | `noautocorrect` | boolean | No | Disable auto-correction of regex patterns. Only applies when `regexp` is true. | | `bucket` | string | No | Restrict to one bucket by ID or URL, e.g. `acme.s3.amazonaws.com` or `1021`. | | `excluded_buckets` | string | No | Comma-separated bucket URLs or IDs to exclude. | | `extensions` | string | No | Comma-separated extensions to include, e.g. `pdf,docx,txt`. | | `stopextensions` | string | No | Comma-separated extensions to exclude, e.g. `jpg,png,gif`. | | `size_from` | integer | No | Minimum file size in bytes (1 to 4999999999999). | | `size_to` | integer | No | Maximum file size in bytes (1 to 4999999999999). | | `last_modified_from` | integer | No | Start date as a Unix epoch timestamp. | | `last_modified_to` | integer | No | End date as a Unix epoch timestamp. | | `order` | enum | No | Sort by `size` or `last_modified`. | | `direction` | enum | No | `asc` or `desc`. | | `org_id` | string | No | Target a subsidiary organization (system-level users only). | Read parameters (`list_bucket_search_result`): | Parameter | Type | Required | Notes | | --------------- | ------- | -------- | -------------------------------------------------------------------------------------------------------------- | | `searchrequest` | string | Yes | The request `id` returned by submit. | | `page` | integer | No | 1-based page number. Default `1`. | | `page_size` | integer | No | Results per page. Default `100`. | | `search` | string | No | Case-insensitive text match across bucket hostname and link URL. | | `file_category` | enum | No | One of `documents`, `images`, `data-exports`, `source-code`, `config-secrets`, `database`, `archives`, `logs`. | | `size_range` | enum | No | `tiny` (under 1KB), `small` (1KB–100KB), `medium` (100KB–1MB), `large` (1MB–10MB), `xlarge` (over 10MB). | | `order` | enum | No | `last_modified`, `bucket`, `link`, or `size`. Default `last_modified`. | | `direction` | enum | No | `asc` or `desc`. Default `desc`. | **Credits and rate limits:** all three endpoints cost 0 credits. Submit is throttled to 100 requests/day; poll and read are each throttled to 500 requests/day. ### What comes back The poll response (`get_bucket_search_request`) describes the request itself — `id`, `search_term`, `status`, `create_date`, `update_date`, `created_at`, and `has_more_result_than_limit`. The read response (`list_bucket_search_result`) is a paginated envelope: * `count` — number of results in this page. * `total_count` — total matches across all pages. * `next` / `previous` — page cursors, `null` at the ends. * `available_categories` — file categories present in this result set, so you know which `file_category` filters will return data. * `results` — the matched files. Each item in `results` carries: * `id` — result identifier. * `link` — direct URL to the exposed file. * `bucket` — the bucket hostname or ID holding the file. * `size` — file size in bytes. * `file_extension` — the file's extension. * `last_modified` — when the file was last changed in the bucket. * `appeared_date` — when the file was first observed. * `found_sensitive` — flag for sensitive content detected in the file. * `searchrequest` — the originating request `id`. ```json theme={"dark"} { "count": 1, "total_count": 1, "next": null, "previous": null, "available_categories": ["documents"], "results": [ { "id": "f7a1c0e2-0000-0000-0000-000000000000", "link": "https://acme-backups.s3.amazonaws.com/finance/q4-payroll.xlsx", "bucket": "acme-backups.s3.amazonaws.com", "size": 248192, "file_extension": "xlsx", "last_modified": "2026-05-14T09:21:00Z", "appeared_date": "2026-05-15", "found_sensitive": "true", "searchrequest": "a1b2c3d4-0000-0000-0000-000000000000" } ] } ``` Pull every `link`, confirm whether each file is still publicly reachable, and route any `found_sensitive` hits to the bucket owner for takedown. If `has_more_result_than_limit` is true, tighten `extensions`, `size_range`, or the date window and re-run to surface the rest.