---
title: "Searches through the leaks."
method: POST
path: "/api/v2/riskintelligence/leaks/search"
tags: ["Risk Intelligence"]
---

# Searches through the leaks.

`POST /api/v2/riskintelligence/leaks/search`

Create a search operation for leaks. This endpoint will not return the list of resulting leaks, but instead it will return a search key, that can be used to list the leaks found by using getLeaks operation. 
 **Attention**: Every unique client id can create a maximum of 100000 search key per day. 
 **Attention**: All array type search criteria may take a maximum of 100000 values each.

## Request body

- object
  - `GenericSearchText` string — A generic search text which will be searched over many of the leak fields.
  - `LeakIds` number[], nullable — The list of leak ids
  - `EcosystemIds` number[], nullable — The list of ecosystem ids that the companies are defined under.
  - `LeakTypes` string[], nullable — The list of leak types.
  - `PasswordTypes` string[], nullable — The list of password types.
  - `SourceTypes` string[], nullable — The list of source types.
  - `ThreatActors` string[], nullable — The list of threat actors.
  - `LeakName` string — The name of the leak.
  - `LeakSourceDomain` string — The source domain of the leak.
  - `CurrentExposureGreaterThan` number — The value of minimum current exposure of the leak. 0 means all findings.
  - `CurrentExposureLessThan` number — The value of maximum current exposure of the leak. 0 means all findings.
  - `FreshnessRateGreaterThan` number — The value of minimum freshness rate of the leak. 0 means all findings.
  - `FreshnessRateLessThan` number — The value of maximum freshness rate of the leak. 100 means all findings.
  - `UniqueEmailAccountCountGreaterThan` number — The value of minimum unique email account count of the leak. 0 means all findings.
  - `UniqueEmailAccountCountLessThan` number — The value of maximum unique email account count of the leak. 0 means all findings.
  - `TotalCountGreaterThan` number — The value of minimum total count of the leak. 0 means all findings.
  - `TotalCountLessThan` number — The value of maximum total count of the leak. 0 means all findings.
  - `PublishDateFrom` string, datetime — The earliest date on which the leak was published.
  - `PublishDateTo` string, datetime — The latest date on which the leak was published.

## Response `200`

Success

- object
  - `Key` string, required — A key in GUID format, which points to the newly created leaks of vulnerability search action. Use this key in getLeaks action as a URL parameter in order to fetch the results. The key has a life time of 6 hours. A new search operation should be performed when the search keys are expired.

## Other responses

- `400` — BadRequest
- `401` — Unauthorized
- `default` — Failure

---

[API](https://skmtc.net/blackkitetech/apis/black-kite-api.md) · [All operations](https://skmtc.net/blackkitetech/apis/black-kite-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/blackkitetech/black-kite-api/revisions/7dadaba760fb/schema)