Export result sets

The export service turns a result set into a file. You create an export job, poll it until it is COMPLETE, then download the file. One flow covers Raw Data, stealer logs, Data Brokers listings, saved Telegram and Discord searches, monitor matches and more. Exports belong to your organization. Every export your organization creates, from the API or the dashboard, appears in list_exports. An export and its file stay until you delete them. Some sources have a file endpoint of their own, and original leak files have a separate flow. Downloads and exports compares the routes.

Availability and cost

Availability: every plan with a license in force. No plan feature is checked. Cost: no metered allowance. With an API key, every call counts once toward your monthly API Calls allowance: the create, each poll, the download and the delete. Only 2xx responses count. See Rate limits. When your organization’s license is not active, every endpoint on this page returns 403:

{
  "detail": "Your license is not active."
}

They never return the plan-feature 403, an allowance 429 or a capacity 409. See Plans and quotas.

How an export runs

create_export checks the catalog entry, the file type and the arguments, then records the export and returns 201. What happens next depends on the entry.

Built during the create call. Some entries, such as monitor matches and ransomware victims, build the file before create_export answers. The response then already reads COMPLETE or FAILED.
Built in the background. The other entries usually answer IN_PROGRESS and build the file afterwards. If the job cannot start, the response already reads FAILED. The service checks running exports every 30 seconds, so the status changes in 30-second steps.

`status`	Meaning	What to do
`IN_PROGRESS`	The file is being built.	Poll again in 30 seconds.
`COMPLETE`	The file is ready.	Download it.
`FAILED`	The export stopped. This is final, and the export carries no reason.	Check the source and the arguments, then create a new export.

Export a result set

Find the catalog entry

list_export_services returns the active catalog entries.

curl https://client-api.leak.center/api/service/list_export_services/ \
  -H "X-API-Key: YOUR_API_KEY"

Each entry describes one exportable result set:

{
  "id": 12,
  "name": "StealerLogs",
  "alias": "stealer_logs",
  "slug": "stealer-logs",
  "is_active": true,
  "allowed_types": ["json", "csv", "xlsx"],
  "args": {
    "params": [
      {
        "name": "search_id",
        "type": "Int",
        "required": true,
        "description": "Stealer log search id to enrich and export"
      }
    ]
  }
}

id is what you send to create_export. It differs between environments, so look it up every time.
name is stable. Match the entry by name. Catalog entries lists the common ones.
allowed_types lists the file formats the entry accepts. Formats differ per entry.
args.params lists the arguments. Each has a name, a type and required. A valid_values string, when present, lists the accepted values, comma-separated.

Create the export

create_export takes three fields:

service: the entry’s id.
type: one of the entry’s allowed_types.
args: an object with the entry’s arguments. Always send it, even as {}.

curl https://client-api.leak.center/api/service/create_export/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"service": 12, "type": "csv", "args": {"search_id": 4471}}'

{
  "id": 9876,
  "service": 12,
  "status": "IN_PROGRESS",
  "created_at": "2026-10-08T09:14:03.512345Z",
  "type": "csv",
  "args": {"search_id": 4471},
  "user": null,
  "organization": 345
}

Arguments are type-checked exactly:

`type` in the catalog	Send
`Int`	A JSON integer: `4471`, not `"4471"`
`String`	A JSON string
`Float`	A JSON number
`Boolean`	`true` or `false`, not the strings `"true"` or `"false"`
`JSON`	A JSON object
`Array[...]`	A JSON array whose items match the inner type. A required array cannot be empty.

No argument can be null. Leave an optional argument out instead.user is null for exports created with an API key.

Poll until it ends

get_export reads the export by its id in the query string. It returns the same object as create_export.

curl "https://client-api.leak.center/api/service/get_export/?id=9876" \
  -H "X-API-Key: YOUR_API_KEY"

Stop polling on COMPLETE or FAILED. Poll every 30 seconds. Faster polling does not speed up the export, and each poll is an API call.

Download the file

download_export returns the file of a COMPLETE export. The file is named after the export id, such as 9876.csv, and -OJ saves it under that name.

curl -OJ "https://client-api.leak.center/api/service/download_export/?id=9876" \
  -H "X-API-Key: YOUR_API_KEY"

Catalog entries

These entries cover the most common result sets. Match them by name. The catalog can hold more, so read list_export_services for the full list and for each entry’s optional arguments.

`name`	Result set	Required `args`	Formats
`ControlLeak`	Raw Data records	`query`: the Lucene query	See `allowed_types`
`ControlLeakDistinct`	Raw Data rolled up by leak	`query`	See `allowed_types`
`ControlCertificate`	SSL Transparency Logs	`query`	See `allowed_types`
`ControlCreditCard`	Credit cards	`query`	See `allowed_types`
`StealerLogs`	A finished stealer log search	`search_id`	`json`, `csv`, `xlsx`
`DataBrokers`	Data Brokers listings	`q`: 3 to 500 characters	`json`, `csv`, `xlsx`
`TelegramSearch`	A saved Telegram search	`history_id`	`csv`, `json`, `xml`, `pdf`
`DiscordSearch`	A saved Discord search	`history_id`	`csv`, `json`, `xml`, `pdf`
`AlertMatch`	The rows of one monitor match	`match_detail_id`: the match `id`	See `allowed_types`
`RansomWatchVictim`	Ransomware victims	None	`json`, `csv`, `xlsx`
`DomainSearch`	New domain registrations	None	See `allowed_types`

What the optional arguments do:

ControlLeak, ControlLeakDistinct, ControlCertificate, ControlCreditCard export the records the query matches, newest first. Change the order with sortField and sortDirection (default createdAt, desc). Export only some records with queryIds and includeIdStrategy; see Export only some records.
ControlCertificate also takes the seven risk filters of the SSL search as booleans: suspiciousKeywords, shortValidity, wildcardCertificates, highRiskTlds, excludeOwnDomain, onlyOwnDomain and sensitiveSubdomains. excludeOwnDomain and onlyOwnDomain cannot both be true.
ControlCreditCard takes saleCategory: free (the default), on_sale or all.
DataBrokers takes the listing filters site_id, data_type, country, state, city, name, seller, currency, min_price, max_price, min_date, max_date (YYYY-MM-DD), scraped_since (ISO 8601) and is_available. The file holds up to 100,000 listings, newest scraped first. CSV and XLSX put each listing on one row and write details as JSON text. A search with no listings gives one row: {"message": "No records found"}.
TelegramSearch and DiscordSearch take the search_history_id that the search returned, sent as history_id.
AlertMatch exports every row of the match. Send page (and page_size) to export one page only. show_excluded, filters and ordering work as on the match results endpoint.
RansomWatchVictim takes company, domain, targetedCountry, targetedRegion, industryType, startDate, endDate (YYYY-MM-DD) and sort_by (DATE, GROUP, REGION, COUNTRY, COMPANY, INDUSTRY or NONE). targetedCountry, targetedRegion, industryType, startDate and endDate are camelCase here, unlike targeted_country, targeted_region, industry_type, start_date and end_date on the search endpoint. company, domain and sort_by keep their names.
DomainSearch takes domain, source, start_date, end_date and ordering, with the same meaning as on domain_search_export.

Export only some records

The Control... entries export the query’s matches. To export a selection, pass the record id values from your search results in queryIds and set includeIdStrategy:

`includeIdStrategy`	The file holds
`INCLUDE`	Only the records listed in `queryIds`
`EXCLUDE` (default)	The query’s matches except the records listed in `queryIds`. With an empty list, nothing is left out.

curl https://client-api.leak.center/api/service/create_export/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "service": 3,
    "type": "csv",
    "args": {
      "query": "acme.com AND leakId:423a5128-a40b-3050-88be-79b5e07ffaa6",
      "queryIds": ["RECORD_ID_1", "RECORD_ID_2"],
      "includeIdStrategy": "INCLUDE"
    }
  }'

Here 3 is the id of the ControlLeak entry in this environment. Look yours up in the catalog.

Find past exports

list_exports returns your organization’s exports, newest first.

curl -G "https://client-api.leak.center/api/service/list_exports/" \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "status=COMPLETE" \
  --data-urlencode "from_date=2026-10-01" \
  --data-urlencode "page_size=50"

Parameter	What it does
`status`	`IN_PROGRESS`, `COMPLETE` or `FAILED`
`type`	One file format, such as `csv` or `pdf`
`services`	Catalog entry `id` values, comma-separated: `12` or `12,47`
`from_date`, `to_date`	Created on or after, on or before this date (`YYYY-MM-DD`)
`page`	The page, starting at `1`
`page_size`	Exports per page, default `10`, at most `100`. A larger value returns 100.

The response holds count, next, previous and results, a list of export objects. Move through pages with page. next is null on the last page; do not call the next URL itself.

Delete exports

delete_exports deletes exports and their files. Pass the export id values in ids, comma-separated.

curl -X DELETE "https://client-api.leak.center/api/service/delete_exports/?ids=9876,9877" \
  -H "X-API-Key: YOUR_API_KEY"

{
  "message": "Successfully deleted exports with IDs: 9876, 9877"
}

The message lists the exports that were deleted. An id that is not one of your organization’s exports is skipped.
If any listed export is IN_PROGRESS, nothing is deleted and the call returns 400. Wait for it to end, then delete.
A delete cannot be undone.

Errors

Status	When	Body
`400`	`service` is not an active catalog entry	`{"service": ["Invalid pk \"99\" - object does not exist."]}`
`400`	`args` is missing	`{"args": ["This field is required."]}`
`400`	`type` is not in the entry’s `allowed_types`	`["Export type \"pdf\" is not allowed for service \"StealerLogs\". Allowed types are: json, csv, xlsx"]`
`400`	A required argument is missing	`["Required parameter 'search_id' is missing"]`
`400`	An argument has the wrong type or is `null`	`["Parameter 'search_id' must be an integer"]` or `["Value for key 'search_id' cannot be null"]`
`400`	An argument is not one of its `valid_values`	`["Value 'NEWEST' for parameter 'sort_by' must be one of: DATE,GROUP,REGION,COUNTRY,COMPANY,INDUSTRY,NONE"]`
`400`	`DataBrokers`: `q` is shorter than 3 or longer than 500 characters	`["Parameter 'q' must be 3 to 500 characters"]`
`400`	`ControlCertificate`: `excludeOwnDomain` and `onlyOwnDomain` are both `true`	`["excludeOwnDomain and onlyOwnDomain are mutually exclusive."]`
`400`	`download_export` on an export that is `IN_PROGRESS` or `FAILED`	`{"error": "Export validation failed"}`
`400`	`delete_exports` lists an export that is `IN_PROGRESS`	`{"error": "Cannot delete exports that are in progress"}`
`400`	`ids` is missing or not a comma-separated list of integers	`{"error": "Invalid export ids format"}`
`403`	Your organization’s license is not active	`{"detail": "Your license is not active."}`
`404`	No export with that `id` in your organization	`{"detail": "No Export matches the given query."}` or `{"error": "Export does not exist"}`
`404`	`download_export`: the export is `COMPLETE` but its file is no longer on the server	`{"error": "Export file not found"}`
`404`	`delete_exports` matched none of your exports	`{"error": "No exports found"}`
`429`	The per-second rate limit or the API Calls allowance is used up	See Rate limits
`502`	The export service failed	`{"detail": "The requested service is temporarily unavailable."}`
`502`	`download_export`: the export service sent a file without a content type or file name	`{"error": "Invalid response from export service."}`
`504`	The export service did not answer within 60 seconds	`{"detail": "The requested service timed out."}`

A 504 on create_export does not prove the export was not created. The export is recorded before its file is built. Check list_exports before you create it again. Every error body the API returns is listed in Handle API errors.

Endpoints

Action	Endpoint
List the export catalog	`GET /api/service/list_export_services/`
Create an export	`POST /api/service/create_export/`
Read an export’s status	`GET /api/service/get_export/`
Download a finished export	`GET /api/service/download_export/`
List your organization’s exports	`GET /api/service/list_exports/`
Delete exports	`DELETE /api/service/delete_exports/`

Get started

Search

Leaked credentials

Assess & report

Monitors

Domain monitoring

Downloads & exports

Changelog

Availability and cost

How an export runs

Export a result set

Catalog entries

Export only some records

Find past exports

Delete exports

Errors

Endpoints

​Availability and cost

​How an export runs

​Export a result set

​Catalog entries

​Export only some records

​Find past exports

​Delete exports

​Errors

​Endpoints

Availability and cost

How an export runs

Export a result set

Catalog entries

Export only some records

Find past exports

Delete exports

Errors

Endpoints