Skip to main content
Paste sites are where credential lists, configuration files and database dumps get posted as plain text. Data Pastes searches DarknetSearch’s index of paste-site posts for your term, in each paste’s title and body. It can also ask Google for matching pastes on paste sites, which come back as live results. This is an expert search: one indexed source, searched on its own terms. It runs as a background job: you create it, poll it until it ends, then read and filter the matches. To watch a term continuously instead, create a monitor on the Pastebin source.

​
Availability and cost

Availability: Paste Leaks. Plans and quotas lists what each plan includes. Cost: no metered allowance. As with every call made with an API key, each call that returns 2xx counts once against your monthly API Calls allowance, and that includes every poll. See Rate limits. Without the feature, or when your license is not active, every endpoint on this page returns 403:
No call on this page draws a metered allowance, so a 429 here always comes from the per-second rate limit or the API Calls allowance. Errors explains each body.
1

Create the search

paste-search-create starts the job and returns 202.
Keep the job_id. status is queued, or completed when the job reused a recent identical search. message is for information only and names an internal path: always read the job with paste-search-detail.
2

Poll until it ends

paste-search-detail/{job_id} returns the job and its status.
Poll every 2 to 5 seconds. Each poll that returns 200 counts against your API Calls allowance, and results stays empty with total at 0 until status is completed. include_google_search adds 5 to 30 seconds to a job. A search that runs longer than 180 seconds ends in error:
3

Read the matches

Once status is completed, the same call returns the matches. Page and filter them with the query parameters.

​
Request body

​
Query syntax

The database search reads Boolean queries:
  • Every positive term needs 2 characters or more. A shorter one returns 400 with {"detail": "Search terms must be at least 2 characters. Too short: a"}.
  • A query needs at least one positive term. NOT giveaway alone returns 400 with {"detail": "Query must contain at least one positive search term."}.
  • Google gets the same logic. With include_google_search, each term or phrase is sent to Google in quotes. AND becomes a space, OR stays OR, NOT becomes Google’s - exclusion, and parentheses keep their grouping.

​
Reuse within one hour

When your organization ran an identical search that completed in the last hour, a new job reuses its matches instead of searching again. The create call then returns status: "completed" at once, and every match has is_new: false. Identical means the same query, context_chars, paste_site_ids, unique_only and include_google_search. You cannot force a fresh run of an identical request within that hour. A request that differs in any of those fields runs fresh.

​
Filter and page the matches

paste-search-detail/{job_id} takes these query parameters. Filters combine with AND, and total counts the matches left after filtering. A date the source cannot read is ignored rather than rejected.

​
What comes back

  • status, error_message — the job state and, on error, the reason.
  • created_at, started_at, completed_at — the job’s timestamps.
  • total — matches after your filters.
  • db_results, live_results — matches from the index and from Google, before filters. Both are null until the job completes.
  • sites_matched — distinct paste sites with a match.
  • available_authors, available_sites — every distinct author and site name in the job’s matches. They do not shrink when you filter, so use them to build author and site_name filters.
A job keeps at most 1,000 database matches. Without unique_only, those are the 1,000 newest. Live results come on top. For a broad term, narrow the query with AND or a phrase rather than reading total as a full count.
Each item in results is one paste:
  • id — the paste’s ID in the index, or null for a live result.
  • external_id — the paste’s ID on its site.
  • url — a direct link to the paste.
  • title, author — as posted, or null.
  • date — when the paste was published, or null.
  • text_preview — an excerpt about twice context_chars wide, starting about 60 characters before the match. With several search terms it shows one snippet per matched term, separated by […], and the snippets share that width.
  • site_name, base_url — the paste site.
  • content_hash — a SHA-256 fingerprint of the paste text. The same text posted twice has the same hash.
  • source — database for the index, live for Google.
  • is_new — true when this paste text did not appear in your organization’s most recent earlier completed run of the same query text. On the first run of a query, every match is new. A reused job marks every match false.

​
List past searches

paste-search-history lists your organization’s paste search jobs, newest first.
  • page is 1-based. page_size defaults to 20, max 100. query_filter keeps jobs whose query contains the text, case-insensitive.
  • The response holds items, total, page and page_size.
  • Each item carries job_id, query, status, total_results, db_results, live_results, sites_matched, include_google_search, created_at and completed_at. Read a job’s matches with paste-search-detail.
Matches stay readable after the job ends, so keep the job_id to read them again. paste-search-destroy/{job_id} cancels a job that is still queued and returns {"job_id": "...", "status": "cancelled"}. A job that is running or has ended cannot be cancelled.

​
Errors

​
Endpoints