Search across all data sources

A quick search sends one term to every data source that covers it. A domain reaches 12 sources, an email address 8 and a password 4. You make one call and get back one search record, with one entry per source in its result. Sources that answer at once put their findings straight into the record. The others start a background job: you follow the job, then read its findings from that source’s own endpoint. In the dashboard, the same search is Search → Unified Search. Availability: every plan with a license in force. Each source also needs its plan feature. A source your plan does not include reports not_entitled in the record instead of findings. See What each search covers. Cost: no metered allowance. The search and each poll are one API call each. With an API key, a call that returns 2xx counts toward your monthly API Calls allowance, and any other status is refunded. The sources the search fans out to do not count against your API Calls allowance. Rate limits explains both limits. Besides a missing or invalid API key (401) and a malformed request (400), listed under Errors, the search and poll endpoints refuse a call in two ways:

Status	Body	When
`403`	`{"detail": "Your license is not active."}`	Your organization has no license in force.
`429`	`{"message": "Rate limit exceeded", "retry_after_seconds": 1}`	You went over the per-second rate limit. When the API Calls allowance is used up, the body also carries `limit`, `remaining` and `reset_at`.

Plan features never refuse the search itself. They show up per source, inside result. Errors lists every error body.

Pick the search for your term

Each endpoint takes a JSON body with one search_term. Pick the endpoint that matches what the term is.

Your term	Example `search_term`	Endpoint
Domain	`acme.com`	`domain_quick_search`
Email address	`jdoe@acme.com`	`email_quick_search`
Person’s name	`Jane Doe`	`name_quick_search`
Brand	`Acme`	`brand_quick_search`
IP address or range	`203.0.113.10` or `203.0.113.*`	`ip_address_and_range_quick_search`
Host name	`vpn.acme.com`	`host_name_quick_search`
File name	`acme customers`	`file_name_quick_search`
Password	`Summer2026!`	`password_quick_search`
Card number	`4111111111111111`	`credit_card_quick_search`

A file name search also takes file_extension, such as csv, pdf or sql. Send it with every file name search: Leaks, Pastes Live Search and Open Cloud Storage build their query from the name and the extension together.

curl https://client-api.leak.center/api/service/file_name_quick_search/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"search_term": "acme customers", "file_extension": "csv"}'

What each search covers

The term type decides which sources run. A ✓ means that search reaches that source. Source names are the names the record returns in feature_names.

Source	Domain	Email	Name	Brand	IP	Host	File	Password	Card
Telegram	✓	✓	✓	✓	✓	✓	✓	✓	✓
Discord	✓	✓	✓	✓	✓	✓	✓	✓	✓
Leaks	✓	✓	✓	✓	✓	✓	✓		✓ (16 digits)
Data Brokers	✓	✓	✓	✓	✓	✓
Pastes Live Search	✓	✓			✓	✓	✓	✓
Open Cloud Storage	✓				✓	✓	✓
URL Shorteners	✓	✓			✓	✓
Accounts		✓	✓	✓				✓
Credentials	✓	✓
Credit Cards			✓						✓
SSL Transparency Logs	✓			✓
Phishtank Monitoring	✓			✓
Fake Apps	✓			✓
Cyber Intel	✓

A card search reaches Leaks only when the term contains 16 digits in a row. Each source either answers inline or starts a background job, and each needs a plan feature or is included in every plan. The same sources are searchable one at a time in Expert Search, some under another name.

Source	Same source in Expert Search	Answers	Plan feature
Leaks	Raw Leaks	Inline	Every plan
Accounts	Raw Credentials	Inline	Every plan
Data Brokers	Data Brokers	Inline	Every plan
SSL Transparency Logs	SSL Transparency Logs	Inline	Every plan
Phishtank Monitoring	Phishing References	Inline for a domain, background job for a brand	Every plan
Credentials	Filtered Credentials	Background job	Every plan
Telegram	Telegram	Inline	Telegram/Discord Monitoring
Discord	Discord	Inline	Telegram/Discord Monitoring
Credit Cards	Credit Cards	Inline	Credit Card Exposure
Cyber Intel	Threat Actor Publications	Inline	Ransomware Threat Actor Monitoring
Open Cloud Storage	Open Cloud Storage	Background job	Cloud Storage Exposure
URL Shorteners	URL Shorteners	Background job	URL Shortener Abuse
Fake Apps	App Store Monitoring	Background job	App Store Impersonation
Pastes Live Search	Data Pastes	Background job	Paste Leaks

Plans and quotas lists which plans include each feature.

How a quick search runs

Submit the term

POST your term to the matching endpoint. The platform calls every source in parallel and answers once each one has returned findings or started its job, so allow the call several seconds. It returns 201 with the search record.

curl https://client-api.leak.center/api/service/domain_quick_search/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"search_term": "acme.com"}'

Read the inline findings

Every inline source is done by the time the 201 arrives. Its entry has status: "ok" and its findings in data.

Follow each background job

Poll the record by its id to update the status of each job. Credentials is the exception: the record does not update it, so check it on its own endpoint.

Read each job's findings

Polling updates only status. When a job is done, read its findings from the source’s results endpoint, using the entry’s task_id.

The search record

Field	What it holds
`id`	The record’s id. Poll with it.
`type`	The search you ran, such as `domain_quick_search`.
`category`	Always `quick`.
`search_params`	Your term, as `{"query": "acme.com"}`.
`feature_names`	The sources searched, by product name.
`services_slugs`	The same sources, by slug. These are the keys of `result`.
`result`	One entry per source, keyed by slug.
`created_at`, `updated_at`	When the search ran, and when a poll last changed it.

This record from a domain search is trimmed to five sources, and each entry is shortened:

{
  "id": 104173,
  "type": "domain_quick_search",
  "category": "quick",
  "search_params": { "query": "acme.com" },
  "feature_names": ["Leaks", "Data Brokers", "Credentials", "Open Cloud Storage", "Telegram"],
  "services_slugs": [
    "leak_extended_database_search",
    "data_broker_search",
    "leak_filter_search_create",
    "create_bucket_search_request",
    "telegram-search-create"
  ],
  "result": {
    "leak_extended_database_search": {
      "status": "ok",
      "data": {
        "query": "acme.com",
        "highlight": true,
        "totalElements": 214,
        "totalPages": 22,
        "number": 0,
        "size": 10,
        "content": [
          { "fileName": "customers_export.csv", "leakName": "Example breach", "content": "jdoe@acme.com:..." }
        ]
      }
    },
    "data_broker_search": {
      "status": "ok",
      "data": {
        "q": "acme",
        "total": 3,
        "next_cursor": null,
        "items": [
          { "site_name": "Example Market", "name": "Acme customer records", "data_type": "Database", "price": 250.0, "currency": "USD" }
        ]
      }
    },
    "leak_filter_search_create": {
      "status": "submitted",
      "task_id": 48213,
      "domain_url": "acme.com",
      "mode": "soft_wait",
      "filter_id": 5
    },
    "create_bucket_search_request": {
      "status": "submitted",
      "task_id": "9b2e4c1a-5d3f-4e7a-8c6b-1f2a3b4c5d6e",
      "search_term": "acme.com",
      "try_without_tlds_first": true
    },
    "telegram-search-create": {
      "status": "ok",
      "data": {
        "query": "acme",
        "total": 37,
        "page": 1,
        "page_size": 10,
        "total_pages": 4,
        "results": [
          { "channel_username": "acme_leaks_share", "text_preview": "fresh combo list incl. acme.com, 12k lines", "date": "2026-09-18T09:41:00" }
        ]
      }
    }
  },
  "created_at": "2026-10-08T09:12:44.512304Z",
  "updated_at": "2026-10-08T09:12:51.204118Z"
}

Every entry has a status, plus one of these:

data: the source’s findings, when it answered inline.
task_id: the id of the source’s background job. Most job entries also repeat the job’s own fields and the parameters sent to the source.
error_message: why the source did not run. A submission_failed entry usually adds service_status_code. When the leak or account index rejects the query, for example for a wildcard it does not support, error_message carries its reason.

A source your plan does not include still has an entry. On a plan without Cloud Storage Exposure, the Open Cloud Storage entry reads:

"create_bucket_search_request": {
  "status": "not_entitled",
  "error_message": "This feature is not included in your plan."
}

Source statuses

`status`	Sources	Meaning	Next step
`ok`	Inline sources	Findings are in `data`.	Read them.
`submitted`	Background sources	The job started. `task_id` is set.	Poll the record. For Credentials, check its own endpoint.
`in_progress`	Open Cloud Storage, URL Shorteners, Fake Apps, Phishtank Monitoring (brand)	The job is running.	Keep polling.
`finished`	The same four	The job is done.	Read its results.
`queued`, `running`	Pastes Live Search	The job is waiting or running.	Keep polling.
`completed`	Pastes Live Search	The job is done.	Read its results.
`error`, `cancelled`	Pastes Live Search	The job ended without results.	Run the search again later.
`not_entitled`	Any	Your plan does not include this source. `error_message` reads `This feature is not included in your plan.` Nothing ran.	Leave it out.
`quota_exceeded`	Any	The per-second rate limit refused the source. Nothing ran.	Run the search again later.
`submission_failed`	Any	The source could not run.	Run the search again later.

A source that fails never fails the search. Treat each entry on its own: partial results are normal. The record re-checks an entry only while it has a task_id and its status is not ok, finished or submission_failed. When a status check fails, the entry keeps its last status. Set your own deadline for each job, and check a job that stops moving on its own endpoint.

Poll the record

Fetch the record by id. Each poll asks every unfinished job for its status, then returns the whole record. Poll every 10 to 30 seconds.

curl https://client-api.leak.center/api/service/retrieve_quick_search_record_with_status_update/104173/ \
  -H "X-API-Key: YOUR_API_KEY"

After a few polls, the Open Cloud Storage entry from the example above reads:

"create_bucket_search_request": {
  "status": "finished",
  "task_id": "9b2e4c1a-5d3f-4e7a-8c6b-1f2a3b4c5d6e",
  "search_term": "acme.com",
  "try_without_tlds_first": true
}

Read each source’s findings

Inline sources

data holds the first page of the source’s own search. It also repeats the parameters the platform sent to the source, such as query, q, company or domain. To read more, call the source’s endpoint with those values. Its guide covers paging and filters.

Source	Endpoint for more
Leaks	`leak_extended_database_search`
Accounts	`accounts_database_search`
Data Brokers	`data_broker_search`
SSL Transparency Logs	`certificate_database_search`
Phishtank Monitoring (domain)	`phishing_search`
Cyber Intel	`ransomware_victims_list`
Telegram	`telegram-search-create`
Discord	`create_discord_search`
Credit Cards	`cc_leaks_search`

A file name search merges several Leaks queries into one page, so that data repeats no query.

Data Brokers

Data Brokers answers inline, with status: "ok" and no task_id. There is no job to follow. Its data carries items, total, limit, next_cursor, sort_by, sort_dir, applied_filters and q, the query the platform sent. total can be null when the count was not computed. When next_cursor is set, pass it as cursor with the same q to read the next page:

curl "https://client-api.leak.center/api/service/data_broker_search/?q=acme&cursor=NEXT_CURSOR" \
  -H "X-API-Key: YOUR_API_KEY"

Data Brokers covers the listing fields and filters.

Background sources

Source	Follow the job	Done when	Read the findings
Credentials	`leak_filter_search_retrieve` with `filter_task_id` set to `task_id`. The record keeps this entry at `submitted`.	`ready` or `incomplete_ready`. `failed` comes with an `error_message`.	`leak_filter_search_results` with `filter_task_id`
Open Cloud Storage	The record	`finished`	`list_bucket_search_result` with `searchrequest` set to `task_id`
URL Shorteners	The record	`finished`	`list_shortener_search_result` with `searchrequest`
Fake Apps	The record	`finished`	`list_store_search_result` with `searchrequest`
Phishtank Monitoring (brand)	The record	`finished`	`list_phishing_search_result` with `searchrequest`
Pastes Live Search	The record	`completed`	`paste-search-detail` with `task_id` as `job_id` in the path

Read a finished Open Cloud Storage job:

curl "https://client-api.leak.center/api/service/list_bucket_search_result/?searchrequest=9b2e4c1a-5d3f-4e7a-8c6b-1f2a3b4c5d6e" \
  -H "X-API-Key: YOUR_API_KEY"

Follow and read the Credentials job. The first search for a domain can take many minutes.

curl "https://client-api.leak.center/api/service/leak_filter_search_retrieve/?filter_task_id=48213" \
  -H "X-API-Key: YOUR_API_KEY"

curl "https://client-api.leak.center/api/service/leak_filter_search_results/?filter_task_id=48213" \
  -H "X-API-Key: YOUR_API_KEY"

The Credentials entry also carries domain_url and filter_id: 5 for a domain search, and 1 plus filter_parameters with the mailbox name for an email search. Once the job is done, leak_filter_domain_search_results reads the same accounts by domain_url and filter_id, plus filter_parameters for an email search. Filtered credentials covers both reads and the filters.

How your term reaches each source

The platform adapts your term to each source, so a source can match more or less than the same term in an expert search.

Source	What it receives
Data Brokers, Fake Apps, Cyber Intel, Pastes Live Search (domain), Phishtank Monitoring (domain)	The name without its suffix: `acme.com` becomes `acme`. When `acme` matches more than 10 Cyber Intel victims, Cyber Intel searches `acme.com` instead.
Telegram, Discord (domain)	`acme`, unless that leaves 3 characters or fewer. Then the full domain.
SSL Transparency Logs	The name without its suffix when that is longer than 6 characters, otherwise the full term. `acme.com` stays `acme.com`.
Leaks	The domain without subdomains: `www.acme.com` becomes `acme.com`. A host name search keeps the full host.
Discord (email)	The mail domain: `jdoe@acme.com` becomes `@acme.com`.
Credentials (email)	The mail domain, filtered to the mailbox name.
Accounts, Telegram, Discord (name)	The words joined with `AND`. Credit Cards matches each word against the card owner.
Leaks, Telegram (IP)	A range keeps its trailing ``: `203.0.113.` stays `203.0.113.*`.
Every other source (IP)	A trailing `` is dropped: `203.0.113.` becomes `203.0.113.`.

List the host names under a domain

Before you run host name searches, find the host names worth searching. retrieve_all_domain_hostnames lists the host names under a domain that appear in leaked records, each with its record count.

curl -G https://client-api.leak.center/api/service/retrieve_all_domain_hostnames/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "domain=acme.com" \
  --data-urlencode "page=0"

{
  "domain": "acme.com",
  "hostnames": [
    { "hostname": "mail.acme.com", "leak_count": 214 },
    { "hostname": "vpn.acme.com", "leak_count": 37 }
  ],
  "page": 0,
  "total_pages": 3
}

Pages start at 0. Each page holds 10 host names in alphabetical order. A page that is not a number returns 404.
leak_count is a Raw Data count. It is the number of records a Raw Data search for that host name returns. Run host_name_quick_search on a host name to see what those records hold.
The list comes from a sample. The host names are read from up to 11,000 Raw Data records that mention the domain, so a widely leaked domain can have host names the list misses. Every listed host name ends with the domain you sent.
Results are cached for 24 hours. The first call for a domain runs the searches. Later calls within 24 hours read the same list and counts.
Without domain, the call returns an empty hostnames list and total_pages of 1.

The endpoint checks only the license: with no license in force it returns 403 with {"detail": "Your license is not active."}. It has no metered allowance. Each page is one API call.

Errors

Status	When	Body
`400`	`search_term` is missing or blank	`{"search_term": ["This field is required."]}` or `{"search_term": ["This field may not be blank."]}`
`401`	The `X-API-Key` header is missing, or the key is invalid or expired	`{"detail": "Authentication credentials were not provided."}` or `{"detail": "Invalid or expired API key."}`. See Authentication.
`403`	Your organization has no license in force	`{"detail": "Your license is not active."}`
`404`	No quick search with that `id` belongs to your organization	`{"detail": "No SearchRecord matches the given query."}`
`429`	You went over the per-second rate limit, or the API Calls allowance is used up	`{"message": "Rate limit exceeded", "retry_after_seconds": 1}`. See Rate limits.

A source’s own failure never becomes an HTTP error. It shows as that source’s status in result.

Need one source on its own terms? Search individual data sources queries one indexed source with its own filters. For real-time searches outside the index, use Live search.

Endpoints

Action	Endpoint
Search a domain	`POST /api/service/domain_quick_search/`
Search an email address	`POST /api/service/email_quick_search/`
Search a person’s name	`POST /api/service/name_quick_search/`
Search a brand	`POST /api/service/brand_quick_search/`
Search an IP address or range	`POST /api/service/ip_address_and_range_quick_search/`
Search a host name	`POST /api/service/host_name_quick_search/`
Search a file name	`POST /api/service/file_name_quick_search/`
Search a password	`POST /api/service/password_quick_search/`
Search a card number	`POST /api/service/credit_card_quick_search/`
Poll a search record	`GET /api/service/retrieve_quick_search_record_with_status_update/{id}/`
Read more Data Brokers listings	`GET /api/service/data_broker_search/`
Follow the Credentials job	`GET /api/service/leak_filter_search_retrieve/`
Read Credentials results	`GET /api/service/leak_filter_search_results/`
Read Credentials results by domain	`GET /api/service/leak_filter_domain_search_results/`
Read Open Cloud Storage results	`GET /api/service/list_bucket_search_result/`
Read URL Shorteners results	`GET /api/service/list_shortener_search_result/`
Read Fake Apps results	`GET /api/service/list_store_search_result/`
Read Phishtank Monitoring results	`GET /api/service/list_phishing_search_result/`
Read Pastes Live Search results	`GET /api/service/paste-search-detail/{job_id}/`
List the host names under a domain	`GET /api/service/retrieve_all_domain_hostnames/`

Get started

Search

Leaked credentials

Assess & report

Monitors

Domain monitoring

Downloads & exports

Changelog

Search across all data sources

Pick the search for your term

What each search covers

How a quick search runs

The search record

Source statuses

Poll the record

Read each source’s findings

Inline sources

Data Brokers

Background sources

How your term reaches each source

List the host names under a domain

Errors

Endpoints

​Pick the search for your term

​What each search covers

​How a quick search runs

​The search record

​Source statuses

​Poll the record

​Read each source’s findings

​Inline sources

​Data Brokers

​Background sources

​How your term reaches each source

​List the host names under a domain

​Errors

​Endpoints

Pick the search for your term

What each search covers

How a quick search runs

The search record

Source statuses

Poll the record

Read each source’s findings

Inline sources

Data Brokers

Background sources

How your term reaches each source

List the host names under a domain

Errors

Endpoints