Sign in

v1

latestOpenAPI 3.1.12026-07-242899061.7 MB
Credentials

Search

Find compromised identities across breach data and stealer logs for one or more domains.

post/identity/credentials/search

Request body

organization_idstring
domainsstring[]

A domain or multiple domains to be queried

domain_typesDomainType[]

"Email", "Authorization" or both can be specified in the array

offsetstring

Pagination token from a previous response's next_offset

limitinteger

Maximum number of results to return (up to 1000)

Example request

{
  "organization_id": "uhash:a1b2c3d4",
  "domains": [
    "example-corp.com"
  ],
  "filter": {
    "first_downloaded_gte": "2024-01-01T00:00:00Z",
    "latest_downloaded_gte": "2024-01-01T00:00:00Z",
    "exfiltration_date_gte": "2024-01-01T00:00:00Z",
    "breach_properties": {
      "name": "ExampleCorp Breach 2024",
      "date": "2024-03-15T00:00:00Z"
    },
    "dump_properties": {
      "name": "Collection",
      "date": "2019-01-07T00:00:00Z"
    },
    "authorization_technologies": [
      "SAML"
    ],
    "authorization_protocols": [
      "RDP"
    ],
    "malware_families": [
      "RedLine Stealer"
    ]
  },
  "offset": "cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="
}

Response

Success

Example response

{
  "data": [
    {
      "entity": {
        "type": "type:Malware",
        "id": "JLHNoH",
        "name": "Cobalt Strike"
      },
      "links": [
        {
          "type": "type:IpAddress",
          "id": "ip:8.8.8.8",
          "name": "8.8.8.8",
          "section": "iU_ZsI",
          "attributes": [
            {
              "value": 90
            }
          ]
        }
      ],
      "error": {
        "Source": "RISKRECON_API",
        "ReasonCode": "UNAUTHORIZED",
        "Description": "Unauthorized request",
        "Details": "Some optional detailed human readable explanation for the error."
      }
    }
  ]
}