Skip to main content
Search public paste sites — the dumping grounds where stolen data, credential lists, and config files get shared. Run a query for your domain or a known credential and find out what is already public before someone else does. This source is asynchronous. You submit a query and get back a job_id. The search runs in the background while you poll the detail endpoint. The same detail call returns the live status while the job runs and the full result set once it finishes. All paths below are relative to the base URL https://client-api.leak.center/api. Send your token on every request:
1

Submit

paste-search-create submits a query and responds 202 Accepted. The search is queued, not finished. Keep the returned job_id.
2

Poll

paste-search-detail returns the current status. Poll it until status reaches a terminal value (completed). Use this same call to read results — see the next step.
3

Read

Once status is completed, paste-search-detail returns the results array plus paging and filter metadata. Page with page and page_size, and narrow the result set with the filters in the table below.

​
Request parameters

Submit body — paste-search-create: Detail query — paste-search-detail/{job_id}:

​
What comes back

The detail response is a job envelope wrapping a paged results array. Top-level fields:
  • job_id — the search job UUID.
  • status — job state. completed means results are ready.
  • error_message — failure reason, or null on success.
  • query — the query you submitted.
  • created_at, started_at, completed_at — job lifecycle timestamps.
  • results — array of paste matches (shape below).
  • total — total matches across all pages.
  • page, page_size — the current page and page size.
  • sites_matched — number of distinct paste sites with a hit.
  • db_results — count from the indexed database, or null.
  • live_results — count from the live crawl, or null.
  • available_authors — authors present in the result set, for building an author filter.
  • available_sites — site names present in the result set, for building a site_name filter.
Each item in results:
  • id — internal result ID, or null.
  • external_id — the paste’s ID on its source site, or null.
  • title — the paste title, or null.
  • text_preview — matched snippet with surrounding context, sized by context_chars.
  • author — the paste author, or null.
  • date — when the paste was published, or null.
  • site_name — the paste site (e.g. a Pastebin-style host).
  • base_url — the site’s base URL, or null.
  • content_hash — content fingerprint used for dedup, or null.
  • source — database or live.
  • url — direct link to the paste, or null.
  • is_new — true if alerting flagged this as a new finding.
Submitting and reading paste searches costs no credits. Both endpoints are throttled per organization: paste-search-create allows 100 requests per day, and paste-search-detail allows 1000 per day — generous enough to poll a job to completion.

​
What to do with the results

Treat any text_preview that exposes a live credential for your domain as an active exposure: rotate the password, force re-authentication, and check the source paste’s url and date to scope the blast radius. Use is_new to spot fresh leaks since your last sweep and available_sites to see which paste hosts are carrying your data.