---
title: "Advanced Search"
method: POST
path: "/advanced-search"
tags: ["Advanced Search"]
---

# Advanced Search

`POST /advanced-search`

Perform an advanced search to identify potential compromises with multiple filters (domains, employees, users, last compromised, last uploaded, company size, industry, country).

## Request body

- object
  - `domains` string[] — List of domains to search for. Accepts root domains (example.com) and will aggregate data across all subdomains. Between 1-500 domains can be specified per request.
  - `min_employees_compromised` number — Minimum threshold for employee compromises. Returns only domains with at least this many compromised employee accounts. Useful for filtering out domains with negligible compromise counts.
  - `max_employees_compromised` number — Maximum threshold for employee compromises. Returns only domains with no more than this many compromised employee accounts. Useful for focusing on organizations within specific size ranges.
  - `min_users_compromised` number — Minimum threshold for user compromises. Returns only domains with at least this many compromised user accounts. Helps identify domains with significant consumer impact.
  - `max_users_compromised` number — Maximum threshold for user compromises. Returns only domains with no more than this many compromised user accounts. Helps focus on domains with specific consumer impact ranges.
  - `last_employee_compromised` string, date-time — ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with employee compromises after this date. Identifies domains with recent corporate breaches.
  - `last_user_compromised` string, date-time — ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with user compromises after this date. Identifies domains with recent consumer-facing breaches.
  - `last_employee_uploaded` string, date-time — ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with employee data uploaded after this date. Reflects when the data became available in our system.
  - `last_user_uploaded` string, date-time — ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with user data uploaded after this date. Reflects when the data became available in our system.
  - `company_sizes` string[] — List of company sizes to filter for. Accepts 1-10, 11-50, 51-200, 201-500, 501-1000, 1001-5000, 5001-10000, 10001+.
  - `industries` string[] — List of industries to filter for. Accepts 147 industries - list can be found at https://api.hudsonrock.com/company-filters.json
  - `countries` string[] — List of countries to filter for. Accepts 247 countries - list can be found at https://api.hudsonrock.com/company-filters.json
  - `usa_regions` string[] — List of USA regions to filter for. Accepts 57 regions - list can be found at https://api.hudsonrock.com/company-filters.json
  - `sort_by` 'last_employee_compromised' | 'last_user_compromised' | 'last_employee_uploaded' | 'last_user_uploaded' | 'compromised_employees' | 'compromised_users' — Field to sort overview results by. Time-based sorting helps identify recent breaches, while count-based sorting identifies the most severely affected domains.
  - `sort_direction` 'asc' | 'desc' — Direction to sort overview results. 'desc' prioritizes recent breaches or highest compromise counts (recommended for threat monitoring), while 'asc' shows oldest breaches or lowest counts first.
  - `cursor` string — Base64 encoded pagination cursor for retrieving the next set of overview results. Obtained from the 'nextCursor' field in the previous response. Essential for processing large domain lists.

## Response `200`

Successful operation

- object
  - `data` object[]
    - `_id` string — Unique identifier for the domain
    - `domain` string — Domain
    - `compromised_employees` number — Number of compromised employees
    - `compromised_users` number — Number of compromised users
    - `last_employee_compromised` string, date-time — Last employee compromised date
    - `last_user_compromised` string, date-time — Last user compromised date
    - `last_employee_uploaded` string, date-time — Last employee uploaded date
    - `last_user_uploaded` string, date-time — Last user uploaded date
    - `company_size` string — Company size
    - `industry` string — Industry
    - `country` string — Country
    - `sensitive_applications` string[] — Identifies sensitive applications within the compromised URL structure, based on a predefined list of sensitive apps.
  - `nextCursor` string — Base64 encoded cursor for the next page

## Other responses

- `400` — Validation error - the request or request body was invalid
- `401` — Unauthorized - the server could not authenticate the request
- `403` — Forbidden - the server authenticated the request but refuses to process it because of insufficient permissions
- `404` — Not found - the server could not find the requested resource
- `408` — Timeout - the server timed out while waiting for a response (90 seconds)
- `429` — Rate limit exceeded - the server has received too many requests in a short period of time
- `500` — Internal server error - the server encountered an unexpected condition that prevented it from fulfilling the request

---

[API](https://skmtc.net/hudsonrock/apis/cavalier-api.md) · [All operations](https://skmtc.net/hudsonrock/apis/cavalier-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hudsonrock/cavalier-api/revisions/5ba0142eec4d/schema)