> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Live search

> Real-time searches that query external sources at request time. Three live searches: Live Data Broker Search (Russian Market), Tor & I2P, and Email References.

Live search queries an external source in real time. You submit a term, the platform reaches out to the source while you wait, and results come back fresh — including data that is not yet in the indexed corpus.

That is the trade-off. Quick search and individual-source search read an index collected ahead of time: they answer in milliseconds, but only return what has already been ingested. Live search reaches the source at request time: it is slower — seconds to minutes — and the source has to be reachable, but it can surface a marketplace listing, a forum post, or a paste the moment it appears.

The platform exposes three live searches:

| Live search                                                  | What it queries                                                                        | Reference tag        |
| ------------------------------------------------------------ | -------------------------------------------------------------------------------------- | -------------------- |
| [**Live Data Broker Search**](/api/guides/live-data-brokers) | Russian Market, in real time, for stealer-log listings that name your domain           | Live Search          |
| **Tor & I2P Network**                                        | 10+ darknet and clearnet search engines, over Tor and I2P                              | External Sources     |
| **Email References**                                         | Where an organization's email addresses surface across the web, deep web, and dark net | External Search APIs |

Live Data Broker Search is the deepest of the three — its own queue, capacity limits, result filters, and an acquisition flow — so it has a [dedicated guide](/api/guides/live-data-brokers). Tor & I2P and Email References are covered below.

All paths are relative to the base URL `https://client-api.leak.center/api`. Send your token on every request:

```
Authorization: Bearer YOUR_ACCESS_TOKEN
```

### The async pattern

Because live search is slow, every live endpoint is **asynchronous**. You never get results on the first call. You submit, you get an identifier back, you poll until the search finishes, then you read the results.

<Steps>
  <Step title="Submit">
    `POST` your query. The response is immediate and carries a search or job identifier plus an initial status. No results yet.
  </Step>

  <Step title="Poll">
    `GET` the status (or detail) endpoint with that identifier. Repeat every 1–2 seconds. The status moves through a lifecycle and lands on a terminal value when the source has been fully queried.
  </Step>

  <Step title="Read">
    Once the status is terminal, `GET` the results. Page through them with `limit`/`offset` or `page`/`size`, depending on the endpoint.
  </Step>
</Steps>

<Info>
  For system-level (MSSP) accounts, every live endpoint accepts an optional `org_id` query parameter to act on a managed organization. Regular users operate on their own organization and can omit it.
</Info>

### Tor & I2P Network

Searches 10+ darknet and clearnet search engines live, forwarding your query directly through proxy servers and the Tor and I2P networks. Because every query fans out to external engines over slow anonymity networks, results can take several minutes — keep the query to a simple phrase such as a company, person, or domain name.

Follow the async pattern with three endpoints:

1. **Submit** — [`external_sources_search`](https://client-api.leak.center/scalar-docs/#tag/external-sources/POST/service/external_sources_search/). The body takes `query` (3–1024 characters) and `validate` (default `false` — when `true`, each hit is re-checked for the exact phrase; useful only for single-word queries). The response carries `id`, `status`, `resultCount`, and a per-engine `states` map.
2. **Poll** — [`external_sources_search_status`](https://client-api.leak.center/scalar-docs/#tag/external-sources/GET/service/external_sources_search_status/\{search_id}) with that `id`. Watch `resultCount` climb and each engine in `states` finish.
3. **Read** — [`external_sources_search_results`](https://client-api.leak.center/scalar-docs/#tag/external-sources/GET/service/external_sources_search_results/\{search_id}). Returns `hasContent` and a `content` list; each row carries `engine`, `url`, `description`, and `cvssScore`.

```bash theme={"dark"}
curl -X POST 'https://client-api.leak.center/api/service/external_sources_search/' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{ "query": "acme.com", "validate": false }'
```

<Warning>
  Tor & I2P latency is measured in minutes, not seconds. Poll on a longer interval than you would for a paste or credential search, and expect partial results to accumulate across engines as each one returns.
</Warning>

### Email References

Measures where an organization's email addresses turn up across the web, deep web, and dark net — the more sources an address appears in, the larger that person's exposure.

1. **Submit** — [`mails_external_search`](https://client-api.leak.center/scalar-docs/#tag/external-search-apis/POST/service/mails_external_search/) with a `domain` or `company_name`.
2. **Poll** — [`mails_external_search_status`](https://client-api.leak.center/scalar-docs/#tag/external-search-apis/GET/service/mails_external_search_status/\{search_id}/) by the returned `id` until it reports `Finished`.
3. **Read** — [`mails_external_search_results`](https://client-api.leak.center/scalar-docs/#tag/external-search-apis/GET/service/mails_external_search_results/\{search_id}/). A `GET` that returns a `count` / `next` / `previous` / `results` page.

The demographic filters live on the **results** call, not on submit: narrow with `type` (`generic` / `personal`), `seniority` and `department` (comma-separated, e.g. `junior,senior` and `it,sales`), `position`, `source_domain`, a full-text `search`, and `ordering`. Each result row carries `business_mail`, `personal_mail`, `first_name`, `last_name`, `phone_number`, `position`, `seniority`, `department`, `still_at_least_on_one_page`, `max_extracted_on`, and `max_last_seen_on`.

### Live versus indexed: which to reach for

|            | Live search                                               | Quick / individual-source search       |
| ---------- | --------------------------------------------------------- | -------------------------------------- |
| Source     | External, queried at request time                         | Pre-collected index                    |
| Freshness  | Newest possible — may not be indexed yet                  | Only what has been ingested            |
| Speed      | Seconds to minutes                                        | Sub-second                             |
| Call shape | Async: submit → poll → read                               | Single synchronous call                |
| Use when   | You need the latest, or to reach a source not yet indexed | You need a fast answer from known data |

Reach for live search when freshness matters or the source is not in the index. Reach for quick or individual-source search when you need a fast answer from data already collected.

The [API reference](https://client-api.leak.center/scalar-docs/) is the complete, field-by-field list of every endpoint and parameter for all three searches.