Skip to main content
Search answers a question now. You give it a term, such as a domain, an email address, an IP or a brand, and get back where it is exposed. There are three ways to search. They differ in how many sources one call reaches, and in whether they read the index or query a source live.
Not sure where the exposure is yet? Start with a quick search. It sends your term to every source that covers it in one call. Narrow to expert or live search once you know what you are looking for.

​
Pick your approach

Search across all data sources

Quick search. Every source, one call. One term goes to up to 12 sources. One record comes back, with the findings grouped by source and a status for each.

Search individual data sources

Expert search. One source, its own filters. Pick one of 15 indexed sources, such as Telegram, Credit Cards or Open Cloud Storage. Each has its own guide.

Live search

Real time, outside the index. Three live searches: Live Data Broker Search, Tor & I2P Network and Email References.

​
Which one fits

​
How each one answers

  • Quick search is one POST. Sources that answer at once put their findings in the record it returns. The others start a background job that you poll, then read from the source’s own endpoint.
  • Expert search answers in one call on 9 sources, such as Telegram, Data Brokers and Credit Cards. The other 6, such as Filtered Credentials and Open Cloud Storage, run a background job: you submit, poll, then read.
  • Live search always runs in the background. You submit, poll until the search finishes, then read. Expect seconds to minutes.

​
What your plan includes

Your plan decides which sources you can search. No quick, expert or live search has a daily limit in your plan. Of these, only Live Data Broker Search draws on a metered allowance, and the live engine also caps how many of those searches it accepts per hour, day and month. See Two limits. Infra search is metered too: each scan uses 1 unit of your monthly Attack Surface Mapping allowance. Every call counts toward your per-second rate limit. With an API key, a call that returns 2xx also counts toward your monthly API Calls allowance, and any other status is refunded. Rate limits explains both.
  • Quick search needs only a license in force. A source your plan does not include reports not_entitled inside the record, and the search runs on the other sources.
  • Expert search includes seven sources in every plan. The other eight each need a plan feature. A search on one your plan does not include returns 403 with {"detail": "This feature is not included in your plan."}. Search individual data sources lists the feature for each source.
  • Live search needs a plan feature for each search:
When the month’s Live Data Broker sessions are used up, starting a search returns 429 and nothing runs:
limit is your plan’s monthly session allowance. Plans and quotas covers plan features and allowances, and Errors lists every error body.

​
Find these searches in the dashboard

To watch a term continuously instead of searching it again, create a monitor. For every way to look up leaked credentials, see Find leaked credentials.

​
Endpoints