Find payment cards exposed in leaks and on card shops

Credit Cards searches one index of exposed payment cards. It holds cards recovered from leaks and cards listed for sale on dark-web card shops. You query it by BIN, last four digits, cardholder, bank or location, and one synchronous call returns a page of matching cards. The search is cc_leaks_search, under the CC Leaks tag in the API reference. saleCategory picks which cards it returns. In the dashboard the same search is Search by Source → Credit Cards, and its Cards on Sale tab sends saleCategory=on_sale.

Availability and cost

Availability: the Credit Card Exposure plan feature. Not every plan includes it. Manage → Buy more in the dashboard lists the features your plan includes. Plans and quotas explains how plan features work. Cost: no metered allowance. Calls count toward your organization’s per-second rate limit, and every 2xx response to an API-key request uses one unit of your monthly API Calls allowance. A non-2xx response is refunded. Without the feature, or when your license is not active, cc_leaks_search returns 403:

{
  "detail": "This feature is not included in your plan."
}

leaked_cc_detail checks only the license, not the plan feature. When your license is not active it returns 403:

{
  "detail": "Your license is not active."
}

Credit Card Exposure has no allowance and no capacity slots, so these endpoints never return the allowance 429 or the capacity 409. A 429 with "message": "Rate limit exceeded" comes from the rate limit or the API Calls allowance. Rate limits explains both.

Search cards

curl -G https://client-api.leak.center/api/service/cc_leaks_search/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "query=543210*" \
  --data-urlencode "saleCategory=all" \
  --data-urlencode "size=50"

Parameter	Type	Notes
`query`	string	Required. 3 to 1,024 characters. See Write the query.
`saleCategory`	string	`free` (default), `on_sale` or `all`.
`page`	integer	Zero-based. Default `0`.
`size`	integer	Cards per page, `10` to `100`. Default `10`.
`sort`	string	Default `createdAt,desc`, newest record first.

saleCategory picks the cards:

Value	Returns
`free`	Cards recovered from leaks. This is the default when you leave `saleCategory` out.
`on_sale`	Cards offered for sale on dark-web card shops.
`all`	Both. Each card’s `saleCategory` field tells you which it is.

Write the query

The query uses field:value terms joined by AND, OR and NOT. A term without a field searches number. Fields: number, bin, lastDigits, owner, bank, cvv, expireDate, createdAt, Hash, type, subType, country, state, city, zip, source, seller, balance.

Query	Finds
`543210*`	Cards whose number starts with BIN 543210
`543210XXXXXX1234`	16-digit cards with BIN 543210 that end in 1234
`543210*1234`	Cards with BIN 543210 that end in 1234, any length
`543210* AND bank:"Acme Bank"`	Cards with BIN 543210 issued by Acme Bank
`owner:"Jane Doe"`	Cards held by Jane Doe
`543210* AND expireDate:[2026-11-01 TO *]`	Cards with BIN 543210 that expire on or after 1 November 2026

Two rules for cards on sale:

Search them by BIN. Shops list cards by BIN and do not list the last four digits, so 543210XXXXXX1234 finds only cards from leaks. Use 543210*.
Write shop values in lowercase. The card store keeps country, card network and shop name in lowercase: country:"united states" AND type:mastercard.

Quote any value that contains a space.

What comes back

The response is one page of cards:

{
  "number": 0,
  "size": 50,
  "totalElements": 2,
  "totalPages": 1,
  "numberOfElements": 2,
  "first": true,
  "last": true,
  "hasContent": true,
  "content": [
    {
      "id": "cc-7f3a9b21",
      "createdAt": "2026-09-14 08:02:11",
      "saleCategory": "free",
      "number": null,
      "bin": "543210",
      "lastDigits": "1234",
      "owner": "Jane Doe",
      "bank": "Acme Bank",
      "cvv": null,
      "expireDate": "2027-03-31",
      "type": "mastercard",
      "subType": "credit",
      "country": "united states",
      "state": null,
      "city": null,
      "zip": null,
      "source": null,
      "seller": null,
      "balance": null,
      "cvssScore": 7.5,
      "leakId": "0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d",
      "leakName": "acme-pos-2026",
      "leakPublishDate": "2026-09-10",
      "leakDiscoverDate": "2026-09-12",
      "leakSize": 48211,
      "leakTags": "pos",
      "metadata": null
    },
    {
      "id": "cc-2c8d4e10",
      "createdAt": "2026-10-07 21:45:03",
      "saleCategory": "on_sale",
      "number": null,
      "bin": "543210",
      "lastDigits": null,
      "owner": "Jane",
      "bank": "Acme Bank",
      "cvv": null,
      "expireDate": "2028-01-31",
      "type": "mastercard",
      "subType": "debit",
      "country": "united states",
      "state": "ny",
      "city": "new york",
      "zip": "10001",
      "source": "acme-shop",
      "seller": "acme-seller",
      "balance": null,
      "cvssScore": null,
      "leakId": null,
      "leakName": null,
      "leakPublishDate": null,
      "leakDiscoverDate": null,
      "leakSize": null,
      "leakTags": null,
      "metadata": {
        "level": "platinum",
        "section": "us-fresh",
        "stock": "1",
        "offer_has_cvv": "Yes",
        "offer_has_dob": "No"
      }
    }
  ]
}

The page fields:

number: the page index, zero-based. Not a card number.
size, numberOfElements: the page size you asked for, and the cards on this page.
totalElements, totalPages: matches and pages across the whole result.
first, last, hasContent: page position, and whether content holds any cards.

Each card:

Field	Meaning
`id`	The card record’s ID. Use it with `leaked_cc_detail`.
`createdAt`	When the record entered the card index, `YYYY-MM-DD HH:MM:SS`.
`saleCategory`	`free` for a card from a leak, `on_sale` for a card from a shop.
`number`	The full card number when the source holds it. Often `null`.
`bin`, `lastDigits`	The first digits and the last four digits. Read these when `number` is `null`. Cards on sale carry `bin` only.
`owner`, `bank`	Cardholder name and issuing bank. Shops often list the first name only.
`cvv`, `expireDate`	Verification code when the source holds it, and expiry date (`YYYY-MM-DD`).
`type`, `subType`	Card network and card subtype.
`country`, `state`, `city`, `zip`	Cardholder location.
`source`, `seller`, `balance`	For a card on sale: the shop, the seller and the listed balance.
`cvssScore`	Severity score of the record.
`leakId`, `leakName`, `leakPublishDate`, `leakDiscoverDate`, `leakSize`, `leakTags`	For a card from a leak: the source leak, when it was published and discovered, its record count and tags. Empty for cards on sale.
`metadata`	For a card on sale: the shop listing’s extra fields, such as `level`, `section`, `stock` and `offer_has_*` flags. Flag values are strings such as `Yes` or `true`.

The response carries no price.

Page through the results

Start at page=0 and raise it until last is true. With size=100, each call returns up to 100 cards. To fetch one card again, pass its id to leaked_cc_detail. The path has no trailing slash. It returns the card object without the page envelope.

curl https://client-api.leak.center/api/service/leaked_cc_detail/cc-7f3a9b21 \
  -H "X-API-Key: YOUR_API_KEY"

Watch for new cards

To re-run a query on a schedule and receive only new cards, create a monitor on the credit_card source with your query. The dashboard’s Credit Cards for Sale monitor is the same source with saleCategory set to on_sale. The source’s args_schema lists the arguments it accepts. See Create a monitoring rule. A monitor on this source needs the same Credit Card Exposure plan feature. Quick search also runs cc_leaks_search for credit card and name searches. It sends only query, so it returns cards from leaks, not cards on sale. On a plan without the feature, quick search reports this source as not_entitled.

Errors

Status	When	Body
`400`	`query` is missing, shorter than 3 or longer than 1,024 characters	`{"query": [...]}` with `This field is required.`, `Ensure this field has at least 3 characters.` or `Ensure this field has no more than 1024 characters.`
`400`	`size` is outside 10 to 100, or `saleCategory` is not `free`, `on_sale` or `all`	Field errors, for example `{"size": ["Ensure this value is greater than or equal to 10."]}`
`403`	Your plan lacks Credit Card Exposure, or your license is not active, on `cc_leaks_search`	`{"detail": "This feature is not included in your plan."}`
`403`	Your license is not active, on `leaked_cc_detail`	`{"detail": "Your license is not active."}`
`404`	No card with that `id` on `leaked_cc_detail`	—
`429`	The per-second rate limit or the monthly API Calls allowance is reached	See Rate limits
`502`	The card service failed	`{"detail": "The requested service is temporarily unavailable."}`
`504`	The card service timed out	`{"detail": "The requested service timed out."}`

Errors lists every error the API returns.

Endpoints

Action	Endpoint
Search cards from leaks and card shops	`GET /api/service/cc_leaks_search/`
Get one card	`GET /api/service/leaked_cc_detail/{leaked_cc_id}`

Get started

Search

Leaked credentials

Assess & report

Monitors

Domain monitoring

Downloads & exports

Changelog

Find payment cards exposed in leaks and on card shops

Availability and cost

Search cards

Write the query

What comes back

Page through the results

Watch for new cards

Errors

Endpoints

​Availability and cost

​Search cards

​Write the query

​What comes back

​Page through the results

​Watch for new cards

​Errors

​Endpoints

Availability and cost

Search cards

Write the query

What comes back

Page through the results

Watch for new cards

Errors

Endpoints