---
title: "Search by Keyword"
method: POST
path: "/search-by-keyword"
tags: ["Keyword Search"]
---

# Search by Keyword

`POST /search-by-keyword`

Search for domains based on keywords.

## Request body

- object
  - `keywords` string[], required — List of keywords to search for in URLs and domains. Useful for discovering compromises related to specific services (e.g., ['vpn', 'admin', 'portal']). Case-insensitive matching. Between 1-10 keywords required per request.
  - `min_employees_compromised` number — Minimum number of compromised employees required for results. Useful for filtering out domains with low compromise counts and focusing on significant breaches. Set to 0 to include all results regardless of count.
  - `max_employees_compromised` number — Maximum number of compromised employees for results. Useful for excluding extremely large breaches or focusing on organizations of specific sizes. Set to 0 to remove upper limit.
  - `min_users_compromised` number — Minimum number of compromised users (non-employees) required for results. Helps identify services with significant user impact. Set to 0 to include all results regardless of count.
  - `max_users_compromised` number — Maximum number of compromised users (non-employees) for results. Helps focus on services with specific user impact ranges. Set to 0 to remove upper limit.
  - `last_employee_compromised` string, date-time — ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with employee compromises after this date. Useful for monitoring recent corporate breaches and active campaigns.
  - `last_user_compromised` string, date-time — ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with user compromises after this date. Useful for monitoring recent consumer-facing breaches and active campaigns.
  - `last_employee_uploaded` string, date-time — ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with employee data uploaded after this date. Reflects when the data became available in our system rather than infection time.
  - `last_user_uploaded` string, date-time — ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with user data uploaded after this date. Reflects when the data became available in our system rather than infection time.
  - `cursor` string — Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the 'nextCursor' field in the previous response. Enables efficient pagination through large result sets without data loss.

## Response `200`

Successful keyword search

- KeywordResponse
  - `data` KeywordData[]
    - `_id` string
    - `keyword` string
    - `count` integer
    - `domain` string
    - `compromised_employees` integer
    - `compromised_users` integer
    - `last_employee_compromised` string
    - `last_user_compromised` string
    - `last_employee_uploaded` string
    - `last_user_uploaded` string
  - `nextCursor` string — Cursor for the next page of results

## Other responses

- `400` — Validation error - the request or request body was invalid
- `401` — Unauthorized - the server could not authenticate the request
- `403` — Forbidden - the server authenticated the request but refuses to process it because of insufficient permissions
- `404` — Not found - the server could not find the requested resource
- `408` — Timeout - the server timed out while waiting for a response (90 seconds)
- `429` — Rate limit exceeded - the server has received too many requests in a short period of time
- `500` — Internal server error - the server encountered an unexpected condition that prevented it from fulfilling the request

---

[API](https://skmtc.net/hudsonrock/apis/cavalier-api.md) · [All operations](https://skmtc.net/hudsonrock/apis/cavalier-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hudsonrock/cavalier-api/revisions/5ba0142eec4d/schema)