Download leak files

Three jobs come up around a single leak. Each has its own path.

Goal	Use
Find a username, email, domain or keyword inside one leak	A Raw Data search with `leakId:<id>`
Get only the matching records as a file	An export of that search
Get an original source file attached to the leak	The leak-file download flow

Start with search, not with a download. The download flow returns one original source file as it was found. It does not filter that file down to your username, domain or keyword.

Availability and cost

Availability: every plan with a license in force. No plan feature is checked. Cost: no metered allowance. With an API key, every call counts once toward your monthly API Calls allowance, each search page and each status poll included. Only 2xx responses count. See Rate limits. When your organization’s license is not active, every endpoint on this page returns 403:

{
  "detail": "Your license is not active."
}

They never return the plan-feature 403, an allowance 429 or a capacity 409. See Plans and quotas.

Does a full download make sense?

Usually not. DarknetSearch indexes the contents of leak files, not only their names. A download gives you a local copy of raw leaked material that you still have to search yourself. Search the indexed leak when you want to:

browse every indexed record of one leak with leakId:<id>
find one username, email, domain, keyword or file type inside that leak
get more of each record’s content with length
hand over a file of the matching records, not the whole leak

Download the original file when the file itself matters, for example a small CSV or document whose exact format is part of the evidence.

Find data inside one leak

If a Raw Data result gave you a leakId, use it. Otherwise find the leak first:

leak_simple_database_search returns one row per leak that matches your query, with resultCount. The row’s id is the leak’s ID.
leaks_list browses the leak index. Filter by name (3 to 100 characters).

To browse one leak, search for its ID alone:

curl -G https://client-api.leak.center/api/service/leak_extended_database_search/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode 'query=leakId:423a5128-a40b-3050-88be-79b5e07ffaa6' \
  --data-urlencode 'size=100'

To find one person, domain or keyword inside it, add the term:

curl -G https://client-api.leak.center/api/service/leak_extended_database_search/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode 'query=jane.doe@acme.com AND leakId:423a5128-a40b-3050-88be-79b5e07ffaa6' \
  --data-urlencode 'size=100' \
  --data-urlencode 'highlight=true'

query is one Lucene string of 3 to 1,024 characters. Narrow it with these fields:

Goal	Query
Browse one leak	`leakId:423a5128-a40b-3050-88be-79b5e07ffaa6`
Find one email address inside it	`jane.doe@acme.com AND leakId:423a5128-a40b-3050-88be-79b5e07ffaa6`
Find one domain inside it	`acme.com AND leakId:423a5128-a40b-3050-88be-79b5e07ffaa6`
Search only its SQL files	`acme.com AND leakId:423a5128-a40b-3050-88be-79b5e07ffaa6 AND fileExtension:sql`
Search files by name	`leakId:423a5128-a40b-3050-88be-79b5e07ffaa6 AND fileName:users`
Search records indexed since a date	`acme.com AND leakId:423a5128-a40b-3050-88be-79b5e07ffaa6 AND createdAt:[2026-01-01 TO *]`

leakId, fileName, fileExtension and createdAt are fields inside query, not separate parameters. A term without a field searches content. Page and size the results with these parameters:

Parameter	Values
`page`	`0` or more, default `0`. Counting starts at `0`.
`size`	`10` to `100`, default `10`
`length`	`1` to `1000`, default `500`. How much of each record’s `content` comes back.
`highlight`	`true` or `false`, default `false`. Marks each match in `content`.

Increase page until the response reads "last": true. Raw Data explains the query syntax and the record fields.

Export the matching records

To get the records of your search as one file, export them with the ControlLeak catalog entry instead of paging.

Find the catalog entry

Call list_export_services and take the id of the entry whose name is ControlLeak. Pick a format from its allowed_types.

Create the export

Send your Lucene query as query in args:

curl https://client-api.leak.center/api/service/create_export/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "service": 3,
    "type": "csv",
    "args": {"query": "acme.com AND leakId:423a5128-a40b-3050-88be-79b5e07ffaa6"}
  }'

Here 3 is the ControlLeak entry’s id in this environment. To export only records you picked, add their id values in queryIds with includeIdStrategy set to INCLUDE. See Export only some records.

Poll and download

Poll get_export every 30 seconds until status is COMPLETE or FAILED. Then fetch the file with download_export. Export result sets covers the full flow and its errors.

Download an original file

Use this flow when you need one source file exactly as it was found. Download requests belong to your organization: leaks_downloads lists every request your organization has made.

Find the leak

Find the leak’s ID as described above. leak_detail returns its metadata, including name, numberOfFiles, numberOfRecords, tags and size. The path has no trailing slash.

curl https://client-api.leak.center/api/service/leak_detail/423a5128-a40b-3050-88be-79b5e07ffaa6 \
  -H "X-API-Key: YOUR_API_KEY"

List the files in the leak

leak_files lists the files attached to the leak. It pages with page (from 0) and size (10 to 100). The path has no trailing slash.

curl "https://client-api.leak.center/api/service/leak_files/423a5128-a40b-3050-88be-79b5e07ffaa6?size=100" \
  -H "X-API-Key: YOUR_API_KEY"

Each file in content has an id, a name, a size and a createdAt:

{
  "number": 0,
  "size": 100,
  "totalElements": 2,
  "totalPages": 1,
  "numberOfElements": 2,
  "first": true,
  "last": true,
  "empty": false,
  "content": [
    {
      "id": "FILE_ID",
      "createdAt": "2026-06-05 11:42:10",
      "name": "users.csv",
      "size": 7340021
    },
    {
      "id": "OTHER_FILE_ID",
      "createdAt": "2026-06-05 11:42:10",
      "name": "full_dump.sql",
      "size": 482857014
    }
  ]
}

Check name and size before you request a file. A large dump is better searched than downloaded.

Request the file

request_to_download_leak_file prepares a copy of one file. Send the leak’s ID as leakId and the file’s id from leak_files as digest. Both are required.

curl https://client-api.leak.center/api/service/request_to_download_leak_file/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"leakId": "423a5128-a40b-3050-88be-79b5e07ffaa6", "digest": "FILE_ID"}'

The response is the download request: its id, the file name and size, a status, an errorText, and createdAt and updatedAt. Keep the id.

Wait for the file

leaks_downloads lists your organization’s download requests, newest first. It pages like leak_files.

curl "https://client-api.leak.center/api/service/leaks_downloads/?size=100" \
  -H "X-API-Key: YOUR_API_KEY"

Find your request by id and read its status. status and errorText come from the leak service unchanged. Download once status reports the file as ready. A non-empty errorText is the leak service’s message about the request; read it before you request the file again.

Download the file

download_leak_file streams the prepared file. Pass the download request id. The path has no trailing slash.

curl https://client-api.leak.center/api/service/download_leak_file/DOWNLOAD_ID \
  -H "X-API-Key: YOUR_API_KEY" \
  -o users.csv

The response passes on the content type and file name that the leak service sets. If the leak service refuses the download, you get its 4xx status and body unchanged. Check the request in leaks_downloads again before you retry.

Errors

Status	When	Body
`400`	A parameter is out of range or missing	Field errors, for example `{"size": ["Ensure this value is greater than or equal to 10."]}` or `{"digest": ["This field is required."]}`
`403`	Your organization’s license is not active	`{"detail": "Your license is not active."}`
`4xx`	The leak service refused the call	The leak service’s status code and body, passed through unchanged
`429`	The per-second rate limit or the API Calls allowance is used up	See Rate limits
`502`	The leak service failed or returned data the API could not read	`{"detail": "The requested service is temporarily unavailable."}` or `{"message": "An unexpected error occurred. Please try again later or contact support."}`
`504`	The leak service did not answer in time	`{"detail": "The requested service timed out."}`

Every error body the API returns is listed in Handle API errors.

Endpoints

Action	Endpoint
Search the records inside a leak	`GET /api/service/leak_extended_database_search/`
Find the leaks a term appears in	`GET /api/service/leak_simple_database_search/`
Browse the leak index	`GET /api/service/leaks_list/`
Read a leak’s metadata	`GET /api/service/leak_detail/{leak_id}`
List a leak’s files	`GET /api/service/leak_files/{leak_id}`
Request a file	`POST /api/service/request_to_download_leak_file/`
List your organization’s download requests	`GET /api/service/leaks_downloads/`
Download a prepared file	`GET /api/service/download_leak_file/{download_id}`
Export the matching records	`POST /api/service/create_export/`, then follow Export result sets

Get started

Search

Leaked credentials

Assess & report

Monitors

Domain monitoring

Downloads & exports

Changelog

Availability and cost

Does a full download make sense?

Find data inside one leak

Export the matching records

Download an original file

Errors

Endpoints

​Availability and cost

​Does a full download make sense?

​Find data inside one leak

​Export the matching records

​Download an original file

​Errors

​Endpoints

Availability and cost

Does a full download make sense?

Find data inside one leak

Export the matching records

Download an original file

Errors

Endpoints