Find an organization's data in data-broker listings

Data Brokers searches an index of listings that data brokers advertise for sale on marketplace sites. Each listing is one offer: a record set, an account or a batch of personal or corporate data, with its site, seller, price and listing date. Search for acme and you get every indexed listing that names Acme. The search is one synchronous GET. There is no job to start and nothing to poll. Results come back a page at a time, and you fetch the next page with a cursor. DarknetSearch crawls each broker site on its own schedule and stores every listing it finds. Marketplaces that only answer a per-query search, such as Russian Market, cannot be crawled in bulk and are not in this index. Search them live with Live Data Broker Search. Availability: every plan with a license in force. Cost: no metered allowance. Each successful call counts as one call toward your API Calls allowance. When your organization’s license is not active, the three listing endpoints return 403:

{
  "detail": "Your license is not active."
}

How it differs from other searches

You want to…	Use
Find listings for sale that name your organization, across every indexed broker site	Data Brokers (this page)
Check Russian Market right now for stealer logs that name your domain	Live Data Broker Search
Search stealer-log captures already in the credential corpus	Stealer logs
Search one term across every data source at once	Quick search

Search the listings

Call data_broker_search with your term in q.

curl -G https://client-api.leak.center/api/service/data_broker_search/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "q=acme" \
  --data-urlencode "limit=50"

{
  "items": [
    {
      "id": "6f1c2b9e-4d3a-4e5f-9a1b-2c3d4e5f6a7b",
      "site_id": "0b5e7c1d-2a3f-4b6c-8d9e-1f2a3b4c5d6e",
      "site_name": "examplebroker",
      "site_url": "https://broker.example",
      "external_id": "418230",
      "listing_url": "https://broker.example/item/418230",
      "data_type": "loan_applicant",
      "country": "US",
      "state": "IL",
      "city": "Springfield",
      "zip_code": null,
      "name": null,
      "seller": "vendor_x",
      "price": 12.0,
      "currency": "USD",
      "listing_date": "2026-09-28",
      "details": {
        "employer": "Acme Corp",
        "website": "acme.com"
      },
      "scraped_at": "2026-09-29T04:12:55.120000Z",
      "is_available": true
    }
  ],
  "total": 37,
  "limit": 50,
  "next_cursor": null,
  "sort_by": "relevance",
  "sort_dir": "desc",
  "applied_filters": {
    "q": "acme",
    "search_mode": "trigram"
  }
}

items: the listings on this page. What comes back describes each field.
total: the number of listings that match. It is counted on the first page only and is null on every later page.
next_cursor: pass it as cursor to get the next page. null means this is the last page.
sort_by, sort_dir: the order the page was sorted in.
applied_filters: the filters the search applied, including q and how it was matched.

Write the query

q takes up to 500 characters. How a term matches depends on whether the query uses an operator. Plain words. A query with no operators matches each word at the start of a word, case-insensitively. Every word must match. Only the first 10 words are used. The words are looked up in the listing’s name, seller, data type, country, state, city, numeric listing ID and detail fields.

acme matches Acme Corp, acme.com, mail.acme.com and acme-login.com.
acme does not match inside a word, as in MyAcme.
Punctuation is matched as typed. acme.com matches only text that spells out acme.com.

Search the organization’s name, not its domain. acme finds listings that spell out acme.com as well as listings that only say Acme Corp. acme.com finds only the first kind.

Operators. Add any of these and the query switches to whole-word matching:

Operator	Example	Matches listings that…
`AND`	`acme AND payroll`	contain both words. Two words with no operator between them also mean `AND`.
`OR`	`acme OR "acme corp"`	contain either.
`NOT` or `-`	`acme -test`	contain `acme` but not `test`.
`"…"`	`"acme corp"`	contain the words next to each other, in this order.
`*`	`acme*`	contain a word that starts with `acme`.
`( )`	`(acme OR acmecorp) AND payroll`	match the grouped expression.

In this mode a word matches only a whole word, unless you add *. Words are split at ., _, /, :, @ and -, so acme.com matches acme followed by com. A query whose operators do not form a valid expression, such as acme OR, returns 400 with {"detail": "Invalid search syntax: acme OR"}. You can leave out q and search with filters alone. If a search cannot finish within 28 seconds, the API returns 400 and asks you to narrow it. Add a filter or a more specific term.

Narrow with filters

Every filter is a query parameter on the same call. Filters combine with q and with each other, so a listing must match all of them.

Parameter	Matches
`site_id`	One broker site. Take the UUID from `data_broker_sites`.
`data_type`	One data type, exactly as the site labels it
`country`, `state`, `city`	The exact value the site stored
`name`	Listing names that contain the text, case-insensitively
`seller`	One seller, exactly
`currency`	One currency code, exactly
`min_price`, `max_price`	Price range, as numbers
`min_date`, `max_date`	Listing date range, as `YYYY-MM-DD`
`scraped_since`	Listings that entered the index at or after this ISO 8601 timestamp
`details_filter`	Values inside the listing’s `details`. See below.

Exact filters compare the stored text, and sites write the same value in different ways. One site stores US, another USA or United States. Take the values from data_broker_filters rather than guessing them.

curl -G https://client-api.leak.center/api/service/data_broker_search/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "q=acme" \
  --data-urlencode "country=US" \
  --data-urlencode "min_date=2026-09-01"

Filter on detail fields

Each site records its own fields in details, such as a website, an employer or a date of birth. details_filter takes a JSON object that maps a field name to a condition:

{
  "employer": { "op": "ilike", "value": "%acme%" },
  "dob": { "op": "exists" }
}

`op`	Condition	Takes
`eq`	Equals the value. The default when `op` is left out.	`value`
`neq`	Does not equal the value	`value`
`in`	Equals one of the values	`values`, a non-empty list
`gt`, `gte`, `lt`, `lte`	Numeric comparison. Text values never match.	`value`, a number
`ilike`	Case-insensitive pattern, with `%` as the wildcard	`value`
`exists`	The field is present	—
`not_exists`	The field is absent	—

Field names may contain only letters, digits, _ and -. A listing must meet every condition. Find the fields and sample values in details_fields from data_broker_filters.

curl -G https://client-api.leak.center/api/service/data_broker_search/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode 'details_filter={"employer": {"op": "ilike", "value": "%acme%"}}'

Sort and page

sort_by takes relevance, scraped_at, listing_date, price, seller, country or name. sort_dir takes asc or desc, and defaults to desc.

With q, the default is relevance. Without q, it is scraped_at, newest first. relevance without q also sorts by scraped_at.
relevance is always descending. For plain words, listings whose subject matches come first: the term is in the name, data type or seller, or in a subject field such as a website, domain, employer, category or bank name. Listings that mention the term elsewhere come next. Listings where the term matches a hosting provider or ISP, but not the subject, come last. Within each group, the most recently indexed listing comes first. For a query with operators, relevance is the full-text match rank.
Empty values sort last when you sort by any other field.

Results come back 50 at a time. Set limit from 1 to 200.

Request the first page

Send q, your filters, sort_by, sort_dir and limit. Read total here: later pages return null.

Request the next page

Send the same parameters again, plus cursor set to the next_cursor you received.

curl -G https://client-api.leak.center/api/service/data_broker_search/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "q=acme" \
  --data-urlencode "limit=50" \
  --data-urlencode "cursor=eyJ2IjogIjEiLCAiaWQiOiAi..."

Stop at the last page

Stop when next_cursor is null.

A cursor belongs to the sort it was issued for. Change sort_by and the old cursor returns 400. Changing sort_dir does the same, except for relevance with q, which is always descending. With relevance, switching q between plain words and operators also returns 400. Start again from the first page. Keep q and the filters the same on every page, or the pages will not line up.

What comes back

Field	What it holds
`id`	The listing’s ID in the index
`site_id`, `site_name`, `site_url`	The broker site that lists it
`external_id`, `listing_url`	The listing’s ID and URL on that site, when the site exposes them
`data_type`	The kind of data on offer, as the site labels it
`country`, `state`, `city`, `zip_code`	The location of the records, as the site stores it
`name`	The listing’s title, when the site gives one
`seller`	The seller’s name on the site
`price`, `currency`	The asking price
`listing_date`	When the site dated the listing, as `YYYY-MM-DD`
`details`	Every other field the site shows. The keys differ from site to site.
`scraped_at`	When DarknetSearch added the listing to the index
`is_available`	Always `true`. See below.

Each site is crawled again on its own schedule, typically every 1 to 72 hours. A listing stays in the index after it leaves the site, and is_available is never set to false. Treat scraped_at as the freshness signal. To collect only listings added since your last run, pass the time of that run as scraped_since and sort by scraped_at:

curl -G https://client-api.leak.center/api/service/data_broker_search/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "q=acme" \
  --data-urlencode "scraped_since=2026-10-01T00:00:00Z" \
  --data-urlencode "sort_by=scraped_at"

Discover filter values

data_broker_filters returns the values you can filter on. Pass site_id or data_type to scope the counts to one site or one data type.

curl -G https://client-api.leak.center/api/service/data_broker_filters/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "site_id=0b5e7c1d-2a3f-4b6c-8d9e-1f2a3b4c5d6e"

Field	What it holds
`total_listings`	Listings in scope
`available_sites`	Every indexed site, with `id`, `name`, `display_name` and `listing_count`. This list is never scoped.
`available_data_types`	`data_type` values, each with a `count`
`available_countries`	The 50 most common `country` values, each with a `count`
`available_sellers`	The 50 most common `seller` values, each with a `count`
`price_range`	`min` and `max` price
`date_range`	`min_date` and `max_date` listing date
`details_fields`	The fields found in `details`: `field_name`, `field_type`, `distinct_count`, `sample_values`, and `min_value` and `max_value`

The counts describe the index, not the results of a search. They are precomputed, so they can lag new listings. Counts for details_fields come from a sample and are approximate.

List the indexed sites

data_broker_sites returns the broker sites in the index. It takes no parameters.

curl https://client-api.leak.center/api/service/data_broker_sites/ \
  -H "X-API-Key: YOUR_API_KEY"

Each site has:

id: pass it as site_id to search or count one site.
name, display_name, url: the site’s identity.
data_types: the kinds of data the site sells.
status: the crawler’s state for the site: active, paused, onboarding, healing, failed or disabled.
last_healthy_at: the last time the crawler reached the site.
ai_description: a short description of the site.

Listings stay searchable whatever the site’s status.

Errors

Status	When	Body
`400`	A parameter is invalid: `q` over 500 characters, `limit` outside 1 to 200, an unknown `sort_by` or `sort_dir`, a `site_id` that is not a UUID, or a malformed date	Field errors, such as `{"limit": ["Ensure this value is less than or equal to 200."]}`
`400`	`details_filter` is not a JSON object	`{"details_filter": ["Must be valid JSON."]}` or `{"details_filter": ["Must be a JSON object."]}`
`400`	`details_filter` uses an unknown operator, a bad field name or a missing value	`{"detail": "Invalid operator: like"}` and similar
`400`	`q` has invalid operator syntax	`{"detail": "Invalid search syntax: acme OR"}`
`400`	`cursor` is malformed, or was issued for a different sort	`{"detail": "Invalid cursor"}`, or a `detail` that starts with `Cursor was issued for a different sort order`
`400`	The search could not finish within 28 seconds	A `detail` that starts with `Search was too broad to complete within 28s`
`403`	Your organization’s license is not active	`{"detail": "Your license is not active."}`
`429`	The request rate limit or the API Calls allowance is used up	See Rate limits
`502`	The listings service is unavailable	`{"detail": "The requested service is temporarily unavailable."}`
`504`	The listings service timed out	`{"detail": "The requested service timed out."}`

Handle API errors explains how to branch on each status.

Endpoints

Action	Endpoint
Search listings	`GET /api/service/data_broker_search/`
Get filter values	`GET /api/service/data_broker_filters/`
List indexed sites	`GET /api/service/data_broker_sites/`

Get started

Search

Leaked credentials

Assess & report

Monitors

Domain monitoring

Downloads & exports

Changelog

Find an organization's data in data-broker listings

How it differs from other searches

Search the listings

Write the query

Narrow with filters

Filter on detail fields

Sort and page

What comes back

Discover filter values

List the indexed sites

Errors

Endpoints

​How it differs from other searches

​Search the listings

​Write the query

​Narrow with filters

​Filter on detail fields

​Sort and page

​What comes back

​Discover filter values

​List the indexed sites

​Errors

​Endpoints

How it differs from other searches

Search the listings

Write the query

Narrow with filters

Filter on detail fields

Sort and page

What comes back

Discover filter values

List the indexed sites

Errors

Endpoints