---
title: "Domains Overview"
method: POST
path: "/search-by-domain/overview"
tags: ["Domain Intelligence"]
---

# Domains Overview

`POST /search-by-domain/overview`

Get overview about domain-wide compromises and intelligence

## Request body

- object
  - `domains` string[], required — List of domains to retrieve compromise overview statistics for. Accepts root domains (example.com) and will aggregate data across all subdomains. Between 1-500 domains can be specified per request.
  - `min_employees_compromised` number — Minimum threshold for employee compromises. Returns only domains with at least this many compromised employee accounts. Useful for filtering out domains with negligible compromise counts.
  - `max_employees_compromised` number — Maximum threshold for employee compromises. Returns only domains with no more than this many compromised employee accounts. Useful for focusing on organizations within specific size ranges.
  - `min_users_compromised` number — Minimum threshold for user compromises. Returns only domains with at least this many compromised user accounts. Helps identify domains with significant consumer impact.
  - `max_users_compromised` number — Maximum threshold for user compromises. Returns only domains with no more than this many compromised user accounts. Helps focus on domains with specific consumer impact ranges.
  - `last_employee_compromised` string, date-time — ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with employee compromises after this date. Identifies domains with recent corporate breaches.
  - `last_user_compromised` string, date-time — ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with user compromises after this date. Identifies domains with recent consumer-facing breaches.
  - `last_employee_uploaded` string, date-time — ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with employee data uploaded after this date. Reflects when the data became available in our system.
  - `last_user_uploaded` string, date-time — ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with user data uploaded after this date. Reflects when the data became available in our system.
  - `sort_by` 'last_employee_compromised' | 'last_user_compromised' | 'last_employee_uploaded' | 'last_user_uploaded' | 'compromised_employees' | 'compromised_users' — Field to sort overview results by. Time-based sorting helps identify recent breaches, while count-based sorting identifies the most severely affected domains.
  - `sort_direction` 'asc' | 'desc' — Direction to sort overview results. 'desc' prioritizes recent breaches or highest compromise counts (recommended for threat monitoring), while 'asc' shows oldest breaches or lowest counts first.
  - `cursor` string — Base64 encoded pagination cursor for retrieving the next set of overview results. Obtained from the 'nextCursor' field in the previous response. Essential for processing large domain lists.

## Response `200`

Successful operation

- object
  - `data` object[]
    - `_id` string — Unique identifier for the domain
    - `domain` string — Domain
    - `compromised_employees` number — Number of compromised employees
    - `compromised_users` number — Number of compromised users
    - `last_employee_compromised` string, date-time — Last employee compromised date
    - `last_user_compromised` string, date-time — Last user compromised date
    - `last_employee_uploaded` string, date-time — Last employee uploaded date
    - `last_user_uploaded` string, date-time — Last user uploaded date
    - `sensitive_applications` string[] — Identifies sensitive applications within the compromised URL structure, based on a predefined list of sensitive apps.
    - `fortinet` FortinetData — A FortiBleed (Fortinet) domain record. Contains fully UNCENSORED credential data and is therefore restricted to API keys with the `fortibleed` permission.
      - `domain` string, nullable — Domain associated with the Fortinet exposure.
      - `industry` string, nullable — Company industry.
      - `size` string, nullable — Employee-count bucket.
      - `revenue` string, nullable — Estimated company revenue.
      - `credentials` FortinetCredential[] — All compromised credential rows for the domain, fully uncensored.
        - `url` string, nullable — Full, uncensored compromised URL.
        - `login` string, nullable — Full, uncensored login/username.
        - `password` string, nullable — Full, uncensored password.
        - `FortiGuardID` string, nullable — Full, uncensored FortiGuard identifier (exact casing: FortiGuardID).
        - `country` string, nullable — ISO country code.
  - `nextCursor` string — Base64 encoded cursor for the next page

## Other responses

- `400` — Validation error - the request or request body was invalid
- `401` — Unauthorized - the server could not authenticate the request
- `403` — Forbidden - the server authenticated the request but refuses to process it because of insufficient permissions
- `404` — Not found - the server could not find the requested resource
- `408` — Timeout - the server timed out while waiting for a response (90 seconds)
- `429` — Rate limit exceeded - the server has received too many requests in a short period of time
- `500` — Internal server error - the server encountered an unexpected condition that prevented it from fulfilling the request

---

[API](https://skmtc.net/hudsonrock/apis/cavalier-api.md) · [All operations](https://skmtc.net/hudsonrock/apis/cavalier-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hudsonrock/cavalier-api/versions/5ba0142eec4d/schema)