Skip to main content
What changed in the public API, newest first. Each entry links to the guide (or the API reference) for the endpoint it touches.
Breaking changes ship with at least 60 days’ notice — each one names what breaks, the migration, and its sunset date. Use the tag filter to show only Breaking. Subscribe via the RSS feed.
Entries before July 2026 were reconstructed from the API history and grouped by month. Going forward, each entry tracks a single release.
​
BreakingNewChangedFixed
Breaking
  • Credit Card and Hacker Forums endpoints removed. The 11 endpoints under the Credit Card and Hacker Forums tags no longer exist: cc_search_request, cc_search_results, retrieve_cc_hf_request, retrieve_credit_card_task_results, delete_cc_hf_request, cc_crawlers_status, download_results_file, hf_search_request, hf_search_results, retrieve_hacker_forum_task_results and hf_crawlers_status. Search cards with cc_leaks_search, which returns cards on sale when saleCategory is on_sale or all. Search data broker listings with data_broker_search. A name quick search no longer starts card tasks. These endpoints were removed in this release without the 60 days’ notice this changelog promises. Credit cards → Data Brokers →
Changed
  • Domain scans use Monitored Assets slots. Each distinct domain with a domain scan now holds one Monitored Assets slot, from the same pool as your monitors. The separate Domain Monitoring slot is gone. When every slot is in use, start_domain_analysis returns 409 with "resource": "monitored_assets" and "detail": "You have reached your Monitored Assets limit of 10.", where it returned spoofguard_domains. Guide →
  • The Domain takedowns allowance runs per contract year. It resets at 00:00 UTC on each anniversary of your license’s start date, not on 1 January. Yearly takedown packs add takedowns to the contract year. Guide →
  • Registered assets hold no slot. Registering a domain or another asset is no longer limited by a slot count. Guide →
New
  • Filter Filtered credentials by discovery date. The result and export calls take leak_discover_date_from and leak_discover_date_to (YYYY-MM-DD, both ends included) to keep accounts from leaks discovered in that range. Guide →
Fixed
  • IP ranges in quick search reach Raw Data and Telegram. An IP term such as 203.0.113.* now reaches the leak index and Telegram with its *, so they match the range. They used to receive 203.0.113. and found nothing. The other sources still receive 203.0.113.. Guide →
  • Fewer failures on reads after an idle connection. When the service behind an endpoint has closed an idle connection, GET, PUT and DELETE requests are retried once instead of failing. Guide →
​
New
New
  • Register assets with an API key. Six endpoints under the Organization Settings tag list, read, create, update and delete your organization’s registered assets, such as the domains Domain monitoring scans. organization_assets_bulk registers many in one call. Creating needs a license in force. A subdomain of a domain you already registered is reported as covered, and nothing is created. Guide →
  • Narrow keyword search of new domain registrations. tld, hyphen_separated and max_extra_characters keep only matches on the top-level domains you name, joined to another word by a hyphen, or with few other characters around the keyword. Guide →
  • Report templates choose light or dark pages. Report templates take mode, dark or light. Templates without it print dark. Guide →
​
NewChangedFixed
New
  • Leak and account searches flag incomplete results. leak_extended_database_search, leak_simple_database_search and accounts_database_search return partial and partialReason beside content. partial is true when the search hit its time limit or part of the index did not answer in time, and the page and its counts then cover only the parts that answered. partialReason says why, such as timeout or shard_failures, and is null when the results are complete. Guide →
Changed
  • An unavailable service returns 503, and a timed-out one 504. When the service behind an endpoint reports that it is unavailable, the API answers 503 with {"detail": "The requested service is temporarily unavailable."}. When that service reports a timeout, the API answers 504 with {"detail": "The requested service timed out."}. Both used to arrive as 502. Retry them with backoff, as you would a 502. Guide →
  • Quick search says why the leak and account sources rejected a query. Their submission_failed entry carries the reason in error_message, for example for a wildcard the index does not support, instead of an empty string. Its service_status_code can now be 503 or 504 as well as 502. Guide →
Fixed
  • Domain monitoring scan lists load for every organization. analysis_list returned 502 when a scan included a detection module that is no longer offered. That module’s entry in params.modules now has module_name set to null. Guide →
​
Fixed
Fixed
  • Intermittent 500 errors at busy times. On 9, 10 and 12 October, API calls could fail with 500 and {"message": "Internal server error, please try again!"} while many quick searches ran at once. The cause is fixed. Guide →
​
NewChangedFixed
Fixes to the editions release
New
  • Data Brokers monitors. A monitor can watch data broker listings with service 17. A space in its query means AND, and OR, NOT, "phrase" and a trailing * are operators. Guide →
Changed
  • Leak Filter monitors are checked before they save. Creating or updating a Leak Filter monitor (service 6) asks the Filtered credentials service whether it would run the search. A domain it blocks, or one it has already counted above its direct-search limit, returns 400 with the reason in error. A domain it has not counted yet is accepted. If the check cannot complete, the call returns 502 and the monitor is not saved. Guide →
Fixed
  • API keys work on quick search. The nine quick search endpoints, such as domain_quick_search, returned 500 to API keys. They return 201 with the search record. Guide →
  • API keys create and delete monitors. alert_system_alert_create_alert_rule returned 400 with {"error": "user_id and org_id are required"}, and alert_system_alert_delete_alert_rule returned 400 with {"error": "user_id is required"}. Both now work with an API key. Guide →
  • API keys create report schedules. create_report_schedule returned 400 to API keys. It now creates the schedule. Guide →
  • Webhook payloads carry match_detail_id and alert_rule_id. The generic JSON payload had left out both fields, which the delivery guide describes. They now come first in the payload. Slack, Discord and Microsoft Teams messages are unchanged. Guide →
​
NewChanged
Editions release
The editions release changes how the API authenticates callers, how it limits them, and the contract of a few endpoints. Migrate an integration to the editions release gives the before and after of every change below, and ends with a checklist to run once the release is live.Changed
  • API keys authenticate every request. Create a key in the dashboard under Developers → API Tokens, send it in the X-API-Key header on every request, and remove any Authorization header. A request without a key returns 401 with {"detail": "Authentication credentials were not provided."}. An unknown, expired or revoked key returns 401 with {"detail": "Invalid or expired API key."}. Guide →
  • A key acts only as its own organization. Remove org_id from every query string and request body. A request that names another organization returns 403. organization_list returns only the key’s organization, and organization_info returns 404 for any other ID. To serve several client organizations, create one key per client. A client key uses that client’s plan and allowances. Guide →
  • The organization profile drops license and used_credits. get_direct_org_info, organization_info and organization_list no longer return them. country changes from id and name to code and name. code is the ISO 3166-1 alpha-2 code, such as US, and country is null when no valid country is set. Your plan is in the dashboard under Admin → Organizations, on your organization’s Plan tab. Guide →
  • Country lookups return codes, and city_list is removed. country_list returns code instead of id, with ISO country names. If you store country IDs, map them to codes by name. GET /api/service/city_list/ returns 404. Guide →
  • General Stats is removed. GET /api/service/leak_analysis_general_stats/ returns 404. For credential counts, call leaked_credentials_stats. Guide →
  • License and plan checks. Nearly every endpoint needs a license in force, or returns 403 with {"detail": "Your license is not active."}. An endpoint or data source your plan does not include returns 403 with {"detail": "This feature is not included in your plan."}. Plan features gate paste, credit card, cloud storage, URL shortener, app store, Telegram, Discord and ransomware search, legacy forum search (hf_search_request), Tor & I2P and Email References live search, Live Data Broker Search, code exposure, Domain monitoring, Infra search, credential comparison report generation, webhooks, and changes to email senders and templates. Guide →
  • Capacity limits return 409. Each monitor, each distinct domain in Domain monitoring and each active credential comparison report schedule takes one slot. When every slot is in use, a call that needs one more returns 409 with detail, resource and limit. The monitor limit no longer returns 400 with “You have reached your alert rule limit of 100.” Creating an inactive report schedule takes no slot. Guide →
  • A spent allowance returns 429 without Retry-After. A call that starts metered work returns 429 with detail, resource, period and limit when the allowance is spent. Queue that work for the next period instead of retrying. The per-second rate-limit 429 carries message and retry_after_seconds instead. Guide →
  • Refusals carry detail. Authentication, license, plan, capacity and allowance refusals return a detail field. A 403 from an access check no longer returns message, and a 401 no longer returns {"error": "Authentication failed."}. Guide →
  • start_domain_analysis has a new contract. Domain monitoring is the SpoofGuard tag in the API reference. domain is the only required field, and modules is ignored. The domain must be registered as an asset of your organization, or the call returns 400. A subdomain must be registered as its own asset. The call needs the Domain Monitoring plan feature (403) and a free Domain Monitoring slot for a new domain (409). New optional fields: logo_id, branding_id, whitelist_id and wordlist_code. Guide →
  • The quick search Data Brokers entry answers inline. The quick search result reports Data Brokers as data_broker_search, with status ok and the listings in data, in place of an hf_search_request task to poll. It searches the name without its top-level domain, so acme.com searches acme. Guide →
  • Two new quick search source statuses. A source your plan does not include reports not_entitled. A source refused by a spent allowance or the per-second rate limit reports quota_exceeded. Both replace submission_failed for these cases, use no allowance, and let the rest of the search go on. Guide →
  • Monitors check their data source against your plan. A monitor is an alert rule in the API. Creating or updating one for a data source your plan does not include returns 403, and so does a missing or unknown service. Guide →
  • Webhooks and custom email need plan features. All five webhook endpoints need the Webhooks plan feature. Creating, updating and deleting email senders and templates needs Custom Email Server. Reading them needs no plan feature. Guide →
  • A per-second rate limit and an API Calls allowance replace credits and daily limits. Credits, used_credits and the 402 response are gone, and so are per-endpoint daily limits. Every caller has a per-second rate limit. Requests made with an API key also count toward a monthly API Calls allowance, and only 2xx responses use it. The X-RateLimit-* headers report the tightest of your limits, usually the per-second window. Guide →
  • Metered work draws on allowances. Starting an Infra search scan, generating a credential comparison report, running Live Data Broker Search, starting an Attack Surface assessment and starting a code exposure scan take units before the work starts. A code exposure keyword scan takes 1 unit per distinct keyword. Domain takedowns draw on a yearly allowance. A call that ends in any status other than 2xx gets its units back. Monthly allowances reset at 00:00 UTC on the 1st. Guide →
New
  • Telegram totals can be estimates. telegram-search-create and telegram-search-history-results return total_is_estimate. When it is true, total is an estimate, not an exact count. Guide →
  • Code exposure on 11 routes. Under the Code Scan tag, start keyword scans across GitHub, GitLab, Gist, Google and Postman in one request, start contributor scans, read, rank and export findings, and save scan templates. Guide →
  • Domain monitoring: scan lifecycle, alerts and brand library. 32 new endpoints. Stop, rescan, update and delete a scan. Categorize and triage its results. Read and mark look-alike alerts in one organization-wide inbox. Manage the logos, branding keyword sets, whitelists and word lists a scan checks for. Guide →
  • Domain takedowns. 13 new endpoints. Upload a signed power of attorney, draft a takedown for a look-alike domain your scan found, send it to the registrar, the hosting provider and blacklists, and track the replies. Guide →
  • Attack Surface assessments. 18 new endpoints under /api/hackerview/. Start full and targeted assessments of a domain, follow their progress and queue position, generate and download branded reports, read report data as JSON, and manage report templates and exclusion rules. In the dashboard, these are Risk Intelligence → Assessments. Guide →
  • Guides for plans, errors and the migration. Plans and quotas explains license status, plan features, allowances and capacity slots. Errors lists every error body and when to retry. Migrate to the editions release walks an existing integration through this release.
  • Guides for Domain monitoring. Overview, Scans, Brand library, Monitors and alerts and Domain takedowns.
  • Guides for Attack Surface assessments. Overview, Start an assessment, Follow an assessment, Reports, Report data, Report branding and Exclusion rules.
  • Guides for code, credentials and hosts. Code exposure covers the new Code Scan routes. Organization analytics reads credential totals, password strength and a breach feed for your domain. Credential check checks credentials from your sign-up, login and password-change flows. Infra search, the dashboard’s Quick Scan, maps the hosts, ports and CVEs under a domain.
Updated 2026-10-15: the dashboard’s menus were renamed on 2026-10-09. Admin → Organizations is now Manage → Plan & usage, with client organizations under Manage → Organizations. Developers → API Tokens is Manage → API tokens. Risk Intelligence → Assessments is Exposure → Risk Assessments, and Quick Scan is Exposure → Attack Surface Discovery. The guides use the new names.
Updated 2026-11-02: the dashboard renamed more pages on 30 October and 2 November. Manage → Plan & usage is now Manage → Usage for usage and Manage → Buy more for the plan and its packs. Client organizations are client workspaces, under Manage → Workspaces. Monitoring → Monitors is Monitoring → Monitored Assets, and Delivery settings has its own row under Monitoring. The guides use the new names.
​
Changed
Changed
  • Microsoft Teams webhooks receive an Adaptive Card. Webhook URLs on powerplatform.com are now recognized as Microsoft Teams, alongside webhook.office.com and outlook.office.com. Teams URLs receive an Adaptive Card instead of the legacy message card, and Power Automate URLs no longer receive the generic JSON payload, which Teams rejected. Guide →
​
Changed
Changed
  • Alert links open the right organization. The results_url in webhook payloads and the results link in alert emails now name the organization the match belongs to, so the link opens the match in that organization in the dashboard. Guide →
​
New
New
  • Data Brokers listings API. data_broker_search searches the listings data brokers advertise for sale. Narrow it by site, data type, location, seller, price and listing date, sort it, and page with a cursor. data_broker_filters returns the values you can filter on, and data_broker_sites lists the source sites. Guide →
​
Changed
Changed
  • API call usage leaves out empty months. get_api_call_usage no longer returns a month with no recorded calls. Guide →
​
BreakingNewChangedFixed
Breaking
  • Domain monitoring monitor lists are paginated. analysis_monitors and monitor_alerts return count, next, previous and results instead of a plain array, and monitor_alerts adds alert_type_counts. Monitor and alert records are reshaped: a monitor carries domain, analysis_id, conditions, enabled, recipients, logo and branding, and an alert carries monitor_id, condition, change_detail, severity and seen. create_analysis_monitor returns a list of monitors and no longer accepts email, logo or brand. monitor_update requires enabled. Guide →
  • Cloud storage, URL shortener and Infra search result lists require searchrequest. list_bucket_search_result, list_shortener_search_result and list_infra_search_result return 400 when searchrequest is missing or is not a UUID. The list, retrieve and delete calls return only your organization’s results. Cloud storage → URL shorteners → Infra search →
New
  • Credential Check API. Four endpoints check a password, an email address, or an email and password pair against known leaks, and search the leak records behind the answer. Guide →
  • API call usage history. get_api_call_usage returns your organization’s API calls for a range of months, set with from_year_month and to_year_month as YYYYMM, with a total per month and a breakdown per day and per HTTP status code. Guide →
  • Cards on sale and more card fields. cc_leaks_search takes saleCategory: free (the default), on_sale or all. Results add lastDigits, type, subType, country, state, city, zip, source, seller, balance, saleCategory and metadata, and the query can target the new fields. Credit card exports accept saleCategory too. Guide →
  • Discord totals can be estimates. Discord search returns total_is_estimate. When it is true, total is an estimate, not an exact count. Guide →
  • Code exposure endpoints. 16 codescan_* endpoints start keyword and contributor scans, read and export their results, and manage templates and schedules. The editions release replaces them with the /api/code_scan/ routes. Guide →
Changed
  • No monthly export cap. The limit of 100 exports per organization per month, which returned “Monthly export limit reached!”, is removed. Guide →
  • Telegram context_chars takes 500, 1000 or 2000. Any other value returns 400. Guide →
  • Phishing scan dates. date_created on phishing scan results is now the date the feed entry was first recorded, not the date of your search. Guide →
  • Google Dork and social-network search left the API reference. Neither is offered through the API. Guide →
  • Domain monitoring analysis detail returns the full record. analysis_detail returns the full analysis payload, and its module_code filter can be repeated to select several modules. Guide →
Fixed
  • Report generation returns the reason for a 400. generate_credential_comparison_report relays the reporting service’s 400 message. Report and schedule lists no longer fail when a report period date is blank. Guide →
  • Cloud storage and URL shortener totals cover the whole search. total_count and the available filter values describe the whole search, not only the filtered page. Guide →
  • Infra search result pages no longer fail on one malformed row. Guide →
​
Changed
Changed
  • Filtered credentials checks a new domain in the background. The first search of a domain no longer returns 503 when its record count cannot be read. The task starts pending while the count runs. It then continues as usual, or ends failed with the reason in error_message. Poll the task until it reaches a final status. Guide →
​
Changed
Changed
  • Webhook-only monitors. email_template is optional on monitor create and update, and required only when the monitor emails recipients. A monitor that only calls a webhook needs no template. On update, "recipients": [] clears the recipients. Guide →
​
New
New
  • Structured queries in stealer-log search. query accepts field clauses on createdAt, leakId, fileName and fileExtension, AND, OR and NOT, - exclusions and [from TO to] ranges. Before, a structured query returned no results. Plain-text queries match as before. Guide →
​
BreakingNewChangedFixed
Breaking
  • Tor & I2P results take ordering instead of sort. external_sources_search_results sorts by ordering: ai_relevance_score, created_at or date, prefixed with - for descending. The default is the highest relevance first. The sort parameter is no longer accepted. Guide →
New
  • AI scoring on Tor & I2P results. Tor & I2P live search runs on a new engine. Each result adds contentExtract, source, aiRelevanceScore, aiSensitivity, aiReasoning and aiKeywords. Guide →
  • Domain Search monitors. Monitors can watch the newly registered domains feed. Give up to 200 comma-separated terms, each with a name of at least 3 characters before the top-level domain. Guide →
  • Own-domain filters on certificate monitors. Certificate monitors accept excludeOwnDomain and onlyOwnDomain. You cannot turn both on. Guide →
  • Certificate filters and Domain Search in the export service. Certificate exports accept the seven risk filters of SSL search. Newly registered domains can be exported as DomainSearch. Guide →
Changed
  • Credit card results can omit the card number. In cc_leaks_search results, number and leakId can be null, and a new bin field carries the card’s BIN. Guide →
  • Quick search pastes come from the paste index only. The Pastes source in quick search no longer adds results from a live Google search. Guide →
  • Infra search lists only your scans. list_infra_search_request no longer includes scans the platform runs in the background. Guide →
Fixed
  • Finished credential comparison reports download reliably. Downloads no longer return 404 intermittently for finished reports. Guide →
​
Changed
Changed
  • Up to 200 recipients and 200 senders per organization. The cap on each was 10. Webhooks stay at 10 per organization. Guide →
​
BreakingNewFixed
Breaking
  • Live search create body simplified to a single query field. The live_search_create body is now just { "query": ... }. The platform, priority, requested_by, and chat_id fields are no longer accepted — the engine sets them server-side. Guide →
  • Alert-rule sender is now optional. Alert-rule responses may now return a null sender, and sender is optional on create and update. Update any integration that assumes a rule always has a sender. Guide →
New
  • Live Search result filters and platform health endpoints. Guide →
  • Domain Search endpoints for the newly registered domains feed. Reference →
  • Usage Limits endpoint for API rate-limit usage stats. Reference →
  • mask_passwords option for report schedules and report generation. Guide →
  • SpoofGuard analysis endpoints accept and forward filter query params. Reference →
  • Usage limits endpoint gains service_slug and feature filters. Reference →
  • needs_attention field on alert rule responses. Guide →
  • Add seven boolean filters to certificate database search. Guide →
  • New Stealer Logs Search API. Search the credential corpus by infected machine — an async create → poll → read flow that returns each stealer-log capture with a bot record and screenshots you pull on demand. Guide →
  • Add stealer_pics_urls field to stealer log search results. Stealer-log records now include the screenshot URLs captured at infection time. Guide →
  • Add source and date filtering params to phishing search. Guide →
Fixed
  • Report schedule endpoints return detailed validation errors. Guide →
  • Fix Telegram channel suggestion create response contract. Guide →
  • Fix stealer log search timeout handling — timed-out requests now return 504. Reference →
​
BreakingNewFixed
Breaking
  • Report schedule endpoints renamed to unique action-style URLs. Report schedule endpoints moved to unique URLs: create_report_schedule, list_report_schedules, update_report_schedule/{schedule_id}, and list_scheduled_reports/{schedule_id} replace the report-schedules/ paths. Validation failures now return the specific error message in the 400 response, and list_scheduled_reports accepts an optional org_id query parameter for system-level users. Guide →
  • Empty domains list rejected on report and schedule endpoints. Report generation and report schedule endpoints now reject an empty domains list with a 400 error (‘Empty domains list is not allowed.’). Guide →
  • Legacy quick-report endpoints deprecated. generate_extended_report, generate_simple_report, and generate_spr_simple_report will be removed on 2026-07-13. Migrate to the premium and credential-comparison report endpoints. Sunset: 2026-07-13. Guide →
  • Alert rule list: is_deleted filter replaced by include_deleted; soft-delete fields exposed on rule responses. The alert-rule list filter is_deleted is replaced by include_deleted: set include_deleted=true to also return soft-deleted rules; by default only active rules return. Rule responses now include deleted_at, deleted_by, and deletion_snapshot, and sender and email_template can be null on soft-deleted rules. Guide →
New
  • Add ordering param and updated_at field to report listing. Guide →
Fixed
  • Fix a 500 error on app store search results. Guide →
  • Fix 500s on SpoofGuard export and monitors endpoints. Reference →
  • Fix 502 errors on SpoofGuard analysis endpoints (analysis_stats, analysis_detail). Reference →
  • System-level users: report requests now target the managed organization via org_id. Guide →
​
BreakingNew
Breaking
  • 2FA enrollment now requires OTP verification. 2FA enrollment is now a two-step flow. Calling setup_2fa returns a QR code and seed but no longer enables 2FA; you must confirm by posting a 6-digit code to the new /service/verify_2fa_enrollment/ endpoint, which activates 2FA and returns one-time backup codes. At login you can supply a backup code instead of an OTP, and the OTP time window is slightly more forgiving.
  • Organization competitors endpoint paginated. The organization competitors endpoint now returns a paginated response with count, next, previous, and results instead of a plain list, and accepts page, size, and ordering parameters. The weeks parameter on the leak-count history endpoints is documented with a maximum of 260. Guide →
  • Alert exclusions now use a nested AND/OR condition model. Alert rule exclusions take an array of condition groups shaped { "match": "all"|"any", "rules": [{"field","value"}] }, where rules can nest. Exclusion records return a condition object. The CSV upload endpoint takes a match (all|any) parameter. Update any integration built on the old flat field/value exclusion body. Guide →
  • Enforce 2048-char limit on webhook URL. Webhook url values are now capped at 2048 characters when creating or updating a webhook; longer URLs are rejected with a validation error. Guide →
  • Deprecated legacy endpoints removed and hidden from the API. Removed the deprecated Paste, Botnet, Pastebin, legacy Ransomware, favourites, and old export/stats endpoints; calls to these paths now return 404. The GitHub search and legacy live-search endpoints are also no longer listed in the API reference. Reference →
  • Alert rules accept multiple recipients. Alert rules now support multiple recipients. The single ‘recipient’ field on create, update, and list responses is replaced by a ‘recipients’ list of recipient IDs. Guide →
  • Filtered-credentials exports are now asynchronous. Filtered-credentials results export via async jobs: create an export, poll leak_filter_export_retrieve/{id}/, then download from leak_filter_export_download/{id}/ (link expires after 24h). The old leak_filter_search_download/ and leak_filter_domain_search_download/ endpoints are removed. Guide →
  • Deprecated report types removed from report generation. The sprsimple, simple, and extended report types are removed. The generate_spr_simple_report/, generate_simple_report/, and generate_extended_report/ endpoints no longer exist; only premium and credential comparison reports can be generated. Guide →
New
  • org_id parameter added to Ransomwatch endpoints. Guide →
  • Higher max page size for paste and certificate search. Guide →
  • Filter and sort alert match detail results and downloads. Guide →
  • Filtering and pagination for Filtered credentials result endpoints. Guide →
  • Filtering and pagination on the alert list and overview endpoints. Guide →
  • Telegram search service endpoints on the public API. Guide →
  • New Discord search endpoints. Guide →
  • first_discovered date filters on leak filter searches. Guide →
  • Alert frequency options. Guide →
  • exact_match parameter on leak filter searches. Guide →
  • Filter parameters for account breaches and stealer-log analysis. Guide →
  • Credential comparison report type. Guide →
  • Report schedule endpoints. Guide →
  • Ransomware victim export filters. Guide →
  • Filtering and pagination added to export listing endpoints. Guide →
​
BreakingNewFixed
Breaking
  • Paginate alert rule list and rename alert filter params. The alert rule list (alert_system_alert_get_alert_rule_list) now returns a paginated response with count, next, previous, and results, and each rule includes is_deleted, total_alerts_count, and total_matches_count. Filter parameters were renamed to recipient_id, sender_id, email_template_id, and webhook_id, with a new is_deleted filter. The service listing now reports frequency as a number and includes excludable_fields. Guide →
  • Mails external search migrated to new API spec. The mails external search API moved to a new spec. On the create call, company is now company_name, and the type/seniority/department fields moved to the results call. Fetching results is now a GET with query-string filters (type, seniority, department, position, source_domain, search, ordering, page, size) and returns a count/next/previous paginated response. Guide →
  • Pagination, filtering, and premium type on list report requests. The report list endpoint GET /service/list_report_requests/ now supports pagination and filtering via page, page_size, report_type, status, and domain query parameters. The response is now a paginated envelope (data, page, page_size, total_items, total_pages), each item carries a type field, and status values are now slugs (started, in_progress, ready, error) instead of display strings. The premium report type is now accepted. Guide →
  • Report list created_at now includes time. The created_at field in report list responses now includes the time (format dd-mm-yyyy HH:MM:SS) instead of date only. Guide →
New
  • Add alert rule exclusion endpoints. Guide →
  • New paste search endpoints. Guide →
  • Search history gains ordering param and datetime timestamps. Reference →
  • Add filtering, sorting, and pagination to bucket and shortener search result endpoints. Guide →
  • Add main_org_id to organization info response. Guide →
  • Add excluded-item support to alert match endpoints. Guide →
  • Add excluded_count to alert statistics responses. Guide →
Fixed
  • Fix missing id field in alert match list responses. Guide →
​
BreakingNew
Breaking
  • Rework risk score APIs (renamed endpoints and response fields, new endpoints). The risk score API endpoints have been renamed under /api/service/ (get_risk_score becomes get_organization_risk_score, list_competitors becomes list_organization_competitors, and similar). The score history endpoint now returns leak_risk_score and infra_risk_score instead of score, and takes a weeks parameter instead of year. New endpoints return benchmark and global weekly leak-count history. Update integrations to the new paths and fields. Guide →
New
​
Breaking
Breaking
  • Search history moved to a service-scoped endpoint. The search history endpoint now requires a service slug: GET /api/service/get_search_history/{category}/{service_slug}/. Results are scoped to that service, and the old category-only path no longer works. Use page and page_size to paginate. Reference →