Compare leaked credentials across an organization's domains

The credential comparison report puts a set of domains side by side, such as acme.com, its country domains and its subsidiaries. It compares the leaked credentials found for each domain over a period you choose. It covers employees who use work addresses on personal accounts, outside access to internal systems, weak passwords, and leaked passwords that still meet current password policies. The download is a ZIP file with the report as a Word document and CSV files of the detailed findings. In the dashboard this is Exposure → Credential Reports, where the report is called the Leaked Credential Comparison Report. Run it once for a period you choose, or schedule it every month. Reports covers polling, downloading, listing and deleting.

Availability and cost

Availability: Credential Report, included in every plan. Report schedules are also in every plan and need only a license in force. Each active schedule holds one Scheduled reports slot. Your plan sets the number of slots, and it can be zero. Cost: 1 unit of your monthly Credential Report allowance for each report you generate on demand, refunded if the call does not return 2xx. A schedule uses no units: its slot covers the reports it produces. Listing and updating schedules uses no units or slots, except that activating a paused schedule takes a slot.

	On demand	Monthly schedule
Call	`generate_credential_comparison_report`	`create_report_schedule`
Uses	1 Credential Report unit per report	1 Scheduled reports slot while the schedule is active
`403`	Your plan lacks Credential Report, or your license is not active	Your license is not active. Every plan includes report schedules.
`429` with `resource`	The month’s Credential Report allowance is spent	Does not apply
`409`	Does not apply	No Scheduled reports slot is free

Both 403s read:

{
  "detail": "This feature is not included in your plan."
}

When the month’s Credential Report allowance is spent, generation returns 429 and no report is created. Reports shows the body. When every slot is taken, creating or activating a schedule returns 409 and nothing changes:

{
  "detail": "You have reached your Automated Reports limit of 3.",
  "resource": "automated_reports",
  "limit": 3
}

limit is your slot count, packs included. Pause a schedule to free its slot. Plans and quotas explains slots.

Generate a report

generate_credential_comparison_report takes the domains to compare and a period.

Field	Required	Rules
`domains`	Yes	A list of at least one domain. Each entry is trimmed and lowercased. A blank entry, or the same domain twice after lowercasing, is refused.
`started_at`	Yes	The first day of the period, as `dd-mm-yyyy`
`ended_at`	Yes	The last day of the period, as `dd-mm-yyyy`
`mask_passwords`	No	`true` masks the leaked passwords in the report. Default `false`.

curl https://client-api.leak.center/api/service/generate_credential_comparison_report/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "domains": ["acme.com", "shop.acme.com", "acme-login.com"],
        "started_at": "01-01-2026",
        "ended_at": "30-06-2026",
        "mask_passwords": true
      }'

The call returns 201 with the report_id:

{
  "message": "Report generation has been successfully started: credential_comparison",
  "report_id": "6f2b9c1e-4d7a-4e3b-9a51-2c8d0f7e6b13"
}

Then poll the status and download the file. A request that breaks a rule returns 400 with the field and its error. Nothing is generated and no unit is used:

Request	Body
`domains` is missing	`{"domains": ["This field is required."]}`
`domains` is an empty list	`{"domains": ["Empty domains list is not allowed."]}`
`["ACME.com", "acme.com"]`	`{"domains": ["Duplicate domain: acme.com."]}`
`["acme.com", ""]`	`{"domains": {"1": ["This field may not be blank."]}}`. The key is the position of the blank entry, counting from 0.
`started_at` is `2026-01-01`	`{"started_at": ["Invalid date format for started_at field. Expected dd-mm-yyyy."]}`
`ended_at` is missing	`{"ended_at": ["This field is required."]}`

Schedule a monthly report

create_report_schedule produces a credential comparison report for the same domains every month.

Field	Required	Rules
`domains`	Yes	The same rules as for an on-demand report
`is_active`	No	Default `true`. An active schedule holds a Scheduled reports slot. Send `false` to create it paused.
`end_date`	No	`dd-mm-yyyy`. The schedule stops after this date. Leave it out, or send `null`, to keep it running.
`mask_passwords`	No	`true` masks the leaked passwords in every report it produces. Default `false`.

curl https://client-api.leak.center/api/service/create_report_schedule/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "domains": ["acme.com", "acme-login.com"],
        "end_date": "31-12-2026",
        "mask_passwords": true
      }'

The response carries the schedule’s ID:

{
  "message": "Report schedule created successfully",
  "schedule_id": "b7e41c2a-9d3f-4a6b-8c1e-5f2a7d9b0e34"
}

When the schedule runs:

Right away, if it is active. Creating an active schedule starts a report for the previous calendar month.
On the 1st of each month. Each run covers the previous calendar month.
Until end_date. The schedule stops after that date.

A paused schedule produces no reports. If your plan has no Scheduled reports slots, you can only create paused schedules.

List schedules

list_report_schedules returns every schedule as a plain array, without pages.

curl https://client-api.leak.center/api/service/list_report_schedules/ \
  -H "X-API-Key: YOUR_API_KEY"

[
  {
    "id": "b7e41c2a-9d3f-4a6b-8c1e-5f2a7d9b0e34",
    "org_id": 412,
    "org_name": "Acme",
    "domains": ["acme.com", "acme-login.com"],
    "is_active": true,
    "create_date": "08-10-2026 09:20:11",
    "update_date": "08-10-2026 09:20:11",
    "end_date": "31-12-2026",
    "mask_passwords": true
  }
]

id — the schedule_id for the update and list-reports calls.
org_id and org_name — your organization.
domains, is_active, end_date and mask_passwords — the schedule’s settings. end_date is null when none is set.
create_date / update_date — in dd-mm-yyyy HH:MM:SS.

Count the entries with is_active: true to see how many slots your schedules hold.

Change, pause or resume a schedule

update_report_schedule changes a schedule. Pass its id in the path. There is no delete: pause a schedule you no longer need.

curl https://client-api.leak.center/api/service/update_report_schedule/b7e41c2a-9d3f-4a6b-8c1e-5f2a7d9b0e34/ \
  -X PATCH \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "domains": ["acme.com", "acme-login.com"],
        "is_active": false,
        "mask_passwords": true
      }'

{
  "message": "Report schedule updated successfully",
  "schedule_id": "b7e41c2a-9d3f-4a6b-8c1e-5f2a7d9b0e34"
}

Send domains and mask_passwords on every update. domains is required, and a request without it returns 400 with {"domains": ["This field is required."]}. mask_passwords defaults to false, so an update that leaves it out turns masking off. Read the schedule’s current values from list_report_schedules first.

is_active: false pauses the schedule and frees its slot.
is_active: true on a paused schedule resumes it and takes a slot. With no free slot, the call returns 409 and the schedule stays paused.
end_date changes the end date. Leave it out to keep the current one. Send null or "" to remove it.
schedule_id must be a UUID. Any other value returns 404.

List the reports a schedule produced

list_scheduled_reports returns the reports one schedule produced. page defaults to 1. page_size defaults to 10.

curl -G https://client-api.leak.center/api/service/list_scheduled_reports/b7e41c2a-9d3f-4a6b-8c1e-5f2a7d9b0e34/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "page_size=50"

{
  "data": [
    {
      "id": "0c9d8e7f-6a5b-4c3d-9e2f-1a0b9c8d7e6f",
      "domain": "[\"acme.com\",\"acme-login.com\"]",
      "created_at": "08-10-2026 09:20:15",
      "status": "ready",
      "type": "credential_comparison",
      "from_date": "01-09-2026",
      "to_date": "30-09-2026",
      "frequency": "monthly"
    }
  ],
  "page": 1,
  "page_size": 50,
  "total_items": 1,
  "total_pages": 1
}

Each row’s id is a report_id. Pass it to get_report_status and download_report like any other report. status uses the short codes: started, in_progress, ready or error. from_date and to_date can be empty.

Errors

These are the errors of the four schedule endpoints. Reports lists the errors of generation, status, download, list and delete.

Status	When	Body
`400`	The request body fails validation	The field and its errors, such as `{"domains": ["This field is required."]}` or `{"end_date": ["Must be in dd-mm-yyyy format"]}`
`400` or `422`	The report service rejected the request	The report service’s body
`403`	Your license is not active. Every plan includes report schedules, so a license in force is the only requirement.	`{"detail": "This feature is not included in your plan."}`
`404`	`schedule_id` is not a UUID	—
`409`	Creating an active schedule, or resuming one, with no free Scheduled reports slot	`{"detail": ..., "resource": "automated_reports", "limit": ...}`
`429`	The per-second rate limit or the API Calls allowance	See Rate limits
Any other	The report service returned another error status	That status, with `{"message": "Failed to create report schedule"}`. The other calls say `Failed to update report schedule`, `Failed to list report schedules` or `Failed to list reports for schedule`.
`502`	The report service is unreachable	`{"detail": "The requested service is temporarily unavailable."}`
`504`	The report service timed out	`{"detail": "The requested service timed out."}`

Errors explains how to handle each status.

Endpoints

Action	Endpoint
Generate a credential comparison report	`POST /api/service/generate_credential_comparison_report/`
Create a monthly schedule	`POST /api/service/create_report_schedule/`
List schedules	`GET /api/service/list_report_schedules/`
Update, pause or resume a schedule	`PATCH /api/service/update_report_schedule/{schedule_id}/`
List the reports a schedule produced	`GET /api/service/list_scheduled_reports/{schedule_id}/`
Get a report’s status	`GET /api/service/get_report_status/{report_id}/`
Download a report	`GET /api/service/download_report/{report_id}/`

Get started

Search

Leaked credentials

Assess & report

Monitors

Domain monitoring

Downloads & exports

Changelog

Compare leaked credentials across an organization's domains

Availability and cost

Generate a report

Schedule a monthly report

List schedules

Change, pause or resume a schedule

List the reports a schedule produced

Errors

Endpoints

​Availability and cost

​Generate a report

​Schedule a monthly report

​List schedules

​Change, pause or resume a schedule

​List the reports a schedule produced

​Errors

​Endpoints

Availability and cost

Generate a report

Schedule a monthly report

List schedules

Change, pause or resume a schedule

List the reports a schedule produced

Errors

Endpoints