Read an organization's risk score and benchmarks

The risk score endpoints describe one organization’s exposure in numbers. DarknetSearch calculates them in the background from leak data and passive infrastructure data. You read them. The only thing you write is the list of competitor domains you compare against. Every score runs from 0 to 100, and a higher score means more risk. Availability: Risk Score, included in every plan. The endpoints need a license in force and no other plan feature. Cost: no metered allowance. Each request made with an API key uses one unit of your monthly API Calls allowance, refunded when the response is not 2xx. See Rate limits. Without a license in force, every endpoint on this page returns 403:

{
  "detail": "Your license is not active."
}

No allowance or capacity slot applies, so these endpoints never return the allowance 429 or the capacity 409.

What you can read

You want…	Call
The current score and its nine factors	`get_organization_risk_score`
Your leak count next to a peer average and median	`get_organization_stats`
The leak and infrastructure scores, week by week	`get_organization_risk_score_history`
Leak records added each week, or the running total	`get_organization_weekly_leak_count_history`, `get_organization_total_leak_count_history`
The weekly leak count of similar organizations	`get_organization_benchmark_weekly_leak_count_history`
The weekly leak count across all DarknetSearch data	`get_global_weekly_leak_count_history`
Competitor domains and their leak counts	Competitors

Read the risk score

get_organization_risk_score returns nine factor scores, score_a to score_i, and three averages of them.

curl https://client-api.leak.center/api/service/get_organization_risk_score/ \
  -H "X-API-Key: YOUR_API_KEY"

The example shows two of the nine factors. The response carries score_*, score_*_message and score_*_last_update for every factor from a to i, and a factor_descriptions entry for each.

{
  "id": 88,
  "organization": 412,
  "score_a": 99.89,
  "score_a_message": "1840 leak records detected vs avg 920 for organizations with 1001-5000 employees.",
  "score_a_last_update": "2026-10-07T04:12:00Z",
  "score_h": 13.53,
  "score_h_message": "3 systems with known vulnerabilities detected out of 41.",
  "score_h_last_update": "2026-10-06T22:40:00Z",
  "factor_descriptions": {
    "score-a": {
      "title": "Number of leaks vs Organization size",
      "description": "Benchmarks the absolute number of leaked records found for an organization against the expected average for similarly sized organizations in the same industry and country.",
      "data_sources": ["leak corpora", "organization metadata", "industry/country benchmarks"],
      "risk_logic": "Leak count significantly above industry-country-size average implies elevated exposure risk."
    }
  },
  "total_score": 38.42,
  "leak_risk_score": 47.15,
  "infra_risk_score": 20.96,
  "creation_date": "2026-03-14T09:30:00Z"
}

score_a to score_i — one score per factor, from 0 to 100, rounded to two decimals. Higher means more risk.
score_*_message — the count behind the factor, in plain text.
score_*_last_update — when the factor was last calculated. null means it has not been calculated yet, and its score reads 0 until it is.
factor_descriptions — fixed text on what each factor measures: title, description, data_sources and risk_logic. It is the same for every organization, and the example shortens it. Where it differs from How each factor is scored, the table describes the actual calculation. Its keys use a hyphen (score-a), the score fields an underscore (score_a).
leak_risk_score — the plain average of the six leak factors, a to f.
infra_risk_score — the plain average of the three infrastructure factors, g to i.
total_score — the plain average of all nine factors. No factor is weighted.
id, organization and creation_date — the score record, your organization’s ID, and when the record was created.

To see where exposure concentrates, sort the factors by score, highest first, and read each one’s message.

How each factor is scored

Factor	Title in `factor_descriptions`	How the score is set
`score_a`	Number of leaks vs Organization size	Your all-time leak count divided by the reference average plus 1, times 50, capped at 100. The reference average comes from up to 10 reference organizations with your size range and industry. A score of 50 means you match it. With no reference organization to compare against, the score is 50.
`score_b`	Recent vs Historical leak comparison	Leak records in the 180 days up to the most recent completed Saturday, divided by those in the 185 days before that, times 50, capped at 100. The factor’s message and description speak of 12-month periods, but these are the windows counted. A score of 50 means a steady rate. With no earlier leaks, the score is 100 if there are recent ones and 0 if not.
`score_c`	Leaks targeting organization infrastructure	The number of leaked accounts that log in to services on your domain. 0 scores 0, 1 scores 50, each further account adds 10, and 6 or more score 100.
`score_d`	Employees logging into 3rd party infrastructure with private references	The number of cases where an organization email address is used on a private third-party service. Same steps as `score_c`.
`score_e`	Clients/partners logging into organization infrastructure	The number of third-party email addresses that log in to your infrastructure. Same steps as `score_c`.
`score_f`	Proportion of weak passwords in leaks	The share of leaked plaintext passwords that miss any of these: at least 8 characters, an uppercase letter, a number, a symbol. Hashes are skipped. Fewer than 10 plaintext passwords, or a share under 5%, scores 0. From 5% the score is 50, from 10% 60, from 20% 70, from 30% 80, from 40% 90, and from 50% 100.
`score_g`	Systems with unusual ports	Systems with an open port outside the usual set.
`score_h`	Reports of insecure systems on IT search engines	Systems whose public banners show known CVEs.
`score_i`	Sensitive subdomains with open ports	Systems on sensitive names such as `admin` or `db` that have open ports.

The three infrastructure factors use one scale. 1 flagged system scores 30, each further one adds 10, and 8 or more score 100. That score is then multiplied by the square root of the flagged share of all systems found. 3 flagged systems out of 41 score 50 × √(3/41) = 13.53.

Compare your leak count with peers

get_organization_stats returns your leak count and two numbers that describe a group of similar organizations.

curl https://client-api.leak.center/api/service/get_organization_stats/ \
  -H "X-API-Key: YOUR_API_KEY"

{
  "leak_count": 1840,
  "average_leak_count": 1312.0,
  "median_leak_count": 905.5
}

leak_count — your organization’s all-time count of leak records. It is the same measure as a competitor’s leak_count.
average_leak_count and median_leak_count — the leak counts of the peer group, not your own. The average is rounded to a whole number. The median can end in .5. Both are 0 when no peer matches.

The peer group is every other active DarknetSearch customer with your size range, industry and country, plus up to 30 reference organizations that match the same filters. Size range, industry and country come from your organization profile. When the profile has no industry or country, that filter is dropped. Compare leak_count with median_leak_count first. An average well above the median means a few peers have very large counts. To compare against a different group, pass either override:

industry — an industry name exactly as industry_type_list returns it.
country — an ISO 3166-1 alpha-2 code such as CH, or an English country name. An unknown value returns 400 with {"error": "Invalid country."}.

curl -G https://client-api.leak.center/api/service/get_organization_stats/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "country=DE"

Follow the score over time

get_organization_risk_score_history returns one point per week with the leak and infrastructure scores.

curl -G https://client-api.leak.center/api/service/get_organization_risk_score_history/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "weeks=26"

[
  { "date": "2026-10-03", "leak_risk_score": 47.15, "infra_risk_score": 20.96 },
  { "date": "2026-09-26", "leak_risk_score": 45.80, "infra_risk_score": 20.96 }
]

Every weekly endpoint on this page works the same way:

weeks sets how far back to go: 1 to 260, default 12. A value outside that range returns 400 with {"error": "weeks must be between 1 and 260"}.
Newest first. Each point is dated on the Saturday that ends its week.
Up to one point per week. A week with no recorded value is missing from the list.

On the score history, infra_risk_score can be null for a week in which the infrastructure factors were not calculated. leak_risk_score always has a value. Plot both lines to see which side moves the total.

Leak counts over time

Three series count leak records per week. All three take weeks and return date and leak_count.

[
  { "date": "2026-10-03", "leak_count": 42 },
  { "date": "2026-09-26", "leak_count": 17 }
]

Call	Each point is
`get_organization_weekly_leak_count_history`	Leak records for your organization added that week, Sunday to Saturday
`get_organization_total_leak_count_history`	Your running all-time total at the end of that week
`get_global_weekly_leak_count_history`	Leak records added that week across all DarknetSearch data, not only your organization’s

A spike in your weekly series marks the week a large set of records landed. The global series shows whether the same week was busy everywhere.

Benchmark against similar organizations

get_organization_benchmark_weekly_leak_count_history returns the average weekly leak count of up to 10 reference organizations with your size range and industry. Country is not used. Overlay it on your weekly series.

curl -G https://client-api.leak.center/api/service/get_organization_benchmark_weekly_leak_count_history/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "weeks=12"

[
  { "date": "2026-10-03", "average_weekly_leak_count": 37 },
  { "date": "2026-09-26", "average_weekly_leak_count": 29 }
]

The average is rounded to a whole number. The list ends at the most recent completed Saturday. It is empty when no reference organization matches your size range and industry.

Three ways to compare

Reference organizations are a benchmark set that DarknetSearch keeps for each size range and industry. They are not your competitors, and you cannot change them.

	Peer statistics	Weekly benchmark	Competitors
Compared with	Other customers with your size range, industry and country, plus up to 30 reference organizations	Up to 10 reference organizations with your size range and industry	Up to 5 domains you choose
Measure	All-time leak count, as average and median	Weekly leak count, as average	All-time leak count per domain
You can change it	With the `industry` and `country` overrides	No	Add and remove domains

Competitors

Competitors are domains you track next to your own. Each one carries its own all-time leak_count, the same measure as your leak_count in get_organization_stats. Competitors do not feed the risk score or the benchmark.

List competitors

list_organization_competitors returns your competitors.

curl -G https://client-api.leak.center/api/service/list_organization_competitors/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "ordering=-leak_count"

{
  "count": 2,
  "next": null,
  "previous": null,
  "results": [
    { "id": 11, "domain": "acme-login.com", "leak_count": 920, "last_update": "2026-09-30T03:00:00Z" },
    { "id": 12, "domain": "shop.acme-login.com", "leak_count": 410, "last_update": "2026-09-30T03:00:00Z" }
  ]
}

ordering takes id, -id, leak_count or -leak_count. The default is id.
page is 1-based. size defaults to 10, max 100. An organization has at most 5 competitors, so one page holds them all.
last_update is when the domain’s leak count was last calculated. A count is recalculated once it is 30 days old.

Add a competitor

add_organization_competitor takes one domain. The leak count is calculated before the call returns.

curl https://client-api.leak.center/api/service/add_organization_competitor/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "acme-login.com"}'

The call returns 201 with the new competitor:

{ "id": 11, "domain": "acme-login.com", "leak_count": 920, "last_update": "2026-10-08T09:14:02Z" }

The rules for domain:

A bare domain or subdomain. acme-login.com and shop.acme-login.com are accepted. A protocol or a path, such as https://acme-login.com/, is refused.
Up to 100 characters.
Stored trimmed and in lowercase, so ACME-LOGIN.com and acme-login.com are the same domain.
At most 5 competitors. Remove one to add another.

Remove a competitor

remove_organization_competitor takes the competitor’s id as the competitor_id query parameter and returns 204.

curl -X DELETE "https://client-api.leak.center/api/service/remove_organization_competitor/?competitor_id=11" \
  -H "X-API-Key: YOUR_API_KEY"

Errors

Status	When	Body
`400`	`weeks` is not a whole number	`{"error": "Invalid weeks format"}`
`400`	`weeks` is outside 1 to 260	`{"error": "weeks must be between 1 and 260"}`
`400`	`country` is not a known country code or name	`{"error": "Invalid country."}`
`400`	`domain` is missing on `add_organization_competitor`	`{"domain": ["This field is required."]}`
`400`	`domain` has a protocol or path, or is not a valid domain	`{"domain": ["Invalid domain format"]}`
`400`	`domain` is longer than 100 characters	`{"domain": ["Ensure this field has no more than 100 characters."]}`
`400`	The domain is already a competitor	`{"error": "Competitor with this domain already exists for this organization"}`
`400`	You already have 5 competitors	`{"error": "Maximum of 5 competitors allowed per organization"}`
`400`	`competitor_id` is missing on `remove_organization_competitor`	`{"error": "competitor_id is required."}`
`403`	Your license is not in force	`{"detail": "Your license is not active."}`
`404`	Risk scoring is not set up for your organization yet	`{"error": "Organization not found"}`
`404`	Your organization has no risk score record	`{"error": "No risk score found for this organization."}`
`404`	`competitor_id` does not match one of your competitors	`{"detail": "No Competitor matches the given query."}`, or `{"detail": "Not found."}` when `competitor_id` is not a number
`429`	The per-second rate limit or the API Calls allowance	See Rate limits
`502`	The scoring service is unavailable, or a new competitor’s leak count could not be calculated. No competitor is added.	`{"detail": "The requested service is temporarily unavailable."}`
`504`	The scoring service timed out	`{"detail": "The requested service timed out."}`

Errors explains how to handle each status.

Endpoints

Action	Endpoint
Get the risk score	`GET /api/service/get_organization_risk_score/`
Get leak statistics	`GET /api/service/get_organization_stats/`
Get the risk score history	`GET /api/service/get_organization_risk_score_history/`
Get the weekly leak count history	`GET /api/service/get_organization_weekly_leak_count_history/`
Get the total leak count history	`GET /api/service/get_organization_total_leak_count_history/`
Get the benchmark weekly leak count history	`GET /api/service/get_organization_benchmark_weekly_leak_count_history/`
Get the global weekly leak count history	`GET /api/service/get_global_weekly_leak_count_history/`
List competitors	`GET /api/service/list_organization_competitors/`
Add a competitor	`POST /api/service/add_organization_competitor/`
Remove a competitor	`DELETE /api/service/remove_organization_competitor/`

Get started

Search

Leaked credentials

Assess & report

Monitors

Domain monitoring

Downloads & exports

Changelog

Read an organization's risk score and benchmarks

What you can read

Read the risk score

How each factor is scored

Compare your leak count with peers

Follow the score over time

Leak counts over time

Benchmark against similar organizations

Three ways to compare

Competitors

List competitors

Add a competitor

Remove a competitor

Errors

Endpoints

​What you can read

​Read the risk score

​How each factor is scored

​Compare your leak count with peers

​Follow the score over time

​Leak counts over time

​Benchmark against similar organizations

​Three ways to compare

​Competitors

​List competitors

​Add a competitor

​Remove a competitor

​Errors

​Endpoints

What you can read

Read the risk score

How each factor is scored

Compare your leak count with peers

Follow the score over time

Leak counts over time

Benchmark against similar organizations

Three ways to compare

Competitors

List competitors

Add a competitor

Remove a competitor

Errors

Endpoints