---
title: "Search"
method: POST
path: "/identity/credentials/search"
tags: ["Credentials"]
---

# Search

`POST /identity/credentials/search`

Find compromised identities across breach data and stealer logs for one or more domains.

## Request body

- CredentialsSearchRequest
  - `organization_id` string
  - `domains` string[] — A domain or multiple domains to be queried
  - `domain_types` DomainType[] — "Email", "Authorization" or both can be specified in the array
  - `filter` IdentityRequestFilter
    - `first_downloaded_gte` string, date-time — The first date when these credentials were received and indexed by Recorded Future.
    - `latest_downloaded_gte` string, date-time — Latest date when these credentials were received and indexed by Recorded Future. It is not unusual for the same credentials to be exposed multiple times, in data from different dumps and/or logs.
    - `exfiltration_date_gte` string, date-time — The date when data was exfiltrated (stolen) from the victim. Note: Only applicable for malware-based exposures.
    - `properties` PasswordProperty[] — Password property filters
    - `username_properties` UsernameProperty[]
    - `breach_properties` BreachProperties
      - `name` string
      - `date` string, date-time
    - `dump_properties` DumpProperties
      - `name` string
      - `date` string, date-time
    - `authorization_technologies` string[] — Filter results by specific authorization technologies (e.g., SAML, LDAP)
    - `authorization_protocols` string[]
    - `malware_families` string[] — Filter by malware family names
  - `offset` string — Pagination token from a previous response's next_offset
  - `limit` integer — Maximum number of results to return (up to 1000)

## Response `200`

Success

- SearchResponse — Technically validated entity relationships (from sandbox analysis, Insikt Group research). Supports batch queries and filtering by section, entity type, source, timeframe.
  - `data` ResultSet[] — Array of per-entity link results (one entry per queried entity).
    - `entity` object — A Recorded Future entity reference.
      - `type` string — Entity type (e.g., IpAddress, InternetDomainName, Hash, CyberVulnerability, Malware)
      - `id` string — Recorded Future entity ID (e.g., ip:8.8.8.8, idn:example.com, hash:abc123)
      - `name` string — Human-readable entity name
    - `links` LinkedEntity[] — Linked entities with source attribution and risk scores.
      - `type` string — Linked entity type (e.g., type:IpAddress)
      - `id` string — Linked entity ID
      - `name` string — Linked entity name
      - `source` 'technical' | 'insikt' — Link source: technical (sandbox/automated) or insikt (analyst research)
      - `section` string — Link section ID (use Links Metadata Sections to decode)
      - `attributes` union[] — Risk attributes for the linked entity.
        - union
          - object
            - `id` 'risk_score' | 'risk_level'
            - `value` integer
          - object
            - `id` 'criticality'
            - `value` string
          - object
            - `id` 'display_name'
            - `value` string
          - object
            - `id` 'threat_actor'
            - `value` boolean
    - `error` Error — Error Object
      - `Source` string — The application or component that generated this error.
      - `ReasonCode` string — Reason code is a unique constant identifying the error case encountered during request processing.
      - `Description` string — Human-readable short description of the reasonCode
      - `Recoverable` boolean — Recoverable flag indicates whether this error is always returned for this request, or retrying could change the outcome. For example, 'true' or 'false'.
      - `Details` string, nullable — Optional detailed description provides information about data received and calculated during request processing. This helps the user to diagnose errors.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal Server Error
- `default` — Error

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)