Skip to main content
Live search queries an external source in real time. You submit a term, the platform reaches out to the source while you wait, and results come back fresh — including data that is not yet in the indexed corpus. That is the trade-off. Quick search and individual-source search read an index collected ahead of time: they answer in milliseconds, but only return what has already been ingested. Live search reaches the source at request time: it is slower — seconds to minutes — and the source has to be reachable, but it can surface a marketplace listing, a forum post, or a paste the moment it appears. The platform exposes three live searches: Live Data Broker Search is the deepest of the three — its own queue, capacity limits, result filters, and an acquisition flow — so it has a dedicated guide. Tor & I2P and Email References are covered below. All paths are relative to the base URL https://client-api.leak.center/api. Send your token on every request:

​
The async pattern

Because live search is slow, every live endpoint is asynchronous. You never get results on the first call. You submit, you get an identifier back, you poll until the search finishes, then you read the results.
1

Submit

POST your query. The response is immediate and carries a search or job identifier plus an initial status. No results yet.
2

Poll

GET the status (or detail) endpoint with that identifier. Repeat every 1–2 seconds. The status moves through a lifecycle and lands on a terminal value when the source has been fully queried.
3

Read

Once the status is terminal, GET the results. Page through them with limit/offset or page/size, depending on the endpoint.
For system-level (MSSP) accounts, every live endpoint accepts an optional org_id query parameter to act on a managed organization. Regular users operate on their own organization and can omit it.

​
Tor & I2P Network

Searches 10+ darknet and clearnet search engines live, forwarding your query directly through proxy servers and the Tor and I2P networks. Because every query fans out to external engines over slow anonymity networks, results can take several minutes — keep the query to a simple phrase such as a company, person, or domain name. Follow the async pattern with three endpoints:
  1. Submit — external_sources_search. The body takes query (3–1024 characters) and validate (default false — when true, each hit is re-checked for the exact phrase; useful only for single-word queries). The response carries id, status, resultCount, and a per-engine states map.
  2. Poll — external_sources_search_status with that id. Watch resultCount climb and each engine in states finish.
  3. Read — external_sources_search_results. Returns hasContent and a content list; each row carries engine, url, description, and cvssScore.
Tor & I2P latency is measured in minutes, not seconds. Poll on a longer interval than you would for a paste or credential search, and expect partial results to accumulate across engines as each one returns.

​
Email References

Measures where an organization’s email addresses turn up across the web, deep web, and dark net — the more sources an address appears in, the larger that person’s exposure.
  1. Submit — mails_external_search with a domain or company_name.
  2. Poll — mails_external_search_status by the returned id until it reports Finished.
  3. Read — mails_external_search_results. A GET that returns a count / next / previous / results page.
The demographic filters live on the results call, not on submit: narrow with type (generic / personal), seniority and department (comma-separated, e.g. junior,senior and it,sales), position, source_domain, a full-text search, and ordering. Each result row carries business_mail, personal_mail, first_name, last_name, phone_number, position, seniority, department, still_at_least_on_one_page, max_extracted_on, and max_last_seen_on.

​
Live versus indexed: which to reach for

Reach for live search when freshness matters or the source is not in the index. Reach for quick or individual-source search when you need a fast answer from data already collected. The API reference is the complete, field-by-field list of every endpoint and parameter for all three searches.