---
title: "Detections"
method: POST
path: "/identity/detections"
tags: ["Detections"]
---

# Detections

`POST /identity/detections`

Retrieve identity exposure detections with novel-only filtering and malware family attribution.

## Request body

- DetectionsRequest
  - `organization_id` UhashId[] — Organization IDs to scope the detections query
  - `include_enterprise_level` boolean — Include enterprise-level detections across all organizations
  - `filter` DetectionsFilter
    - `novel_only` boolean
    - `malware_only` boolean
    - `domains` string[]
    - `detection_types` DetectionType[]
    - `source_type` SourceType[]
    - `detection_type` 'Workforce' | 'External' | 'Vip'
    - `authorization_technology` DetectionsAuthTechnologyFilter
      - `any` boolean
      - `id` string[]
      - `name` string[]
    - `cookies` 'Cookies' | 'UnexpiredCookies'
    - `created` DetectionsDateFilter
      - `gte` string, date-time
      - `lt` string, date-time
  - `limit` integer — Maximum number of detections to return
  - `offset` string — Pagination token for next page

## Response `200`

Success

- DetectionsResponse
  - `total` integer, required
  - `detections` Detection[], required
    - `id` string, required
    - `organization_id` string
    - `novel` boolean, required
    - `type` 'Workforce' | 'External' | 'Vip', required
    - `source_type` 'MalwareLogs' | 'DatabaseDumps' | 'MalwareCombolists' | 'DatabaseCombolists'
    - `subject` string, required
    - `password` DetectionsLeakedPassword
      - `type` string, required
      - `hashes` PasswordHash[], required
        - union
          - FullPasswordHash
            - `algorithm` 'SHA1' | 'SHA256' | 'HASH32' | 'HASH40' | 'HASH64' | 'HASH96' | 'HASH128' | 'BCRYPT' | 'PHPASS' | 'HASHCAT_HEX' | 'BASE64' | 'SSHA' | 'PBKDF2_SHA256' | 'BASE64_HASH32' | 'BASE64_HASH40' | 'BASE64_HASH128' | 'BASE64_INTEGER_HASH32' | 'BASE64_INTEGER_HASH40' | 'BASE64_INTEGER_HASH64' | 'BASE64_INTEGER_HASH96' | 'BASE64_INTEGER_HASH128' | 'MYSQL_SHA_V41PLUS' | 'NTLM' | 'MD5', required
            - `hash` string, required
          - PrefixPasswordHash
            - `algorithm` 'SHA1' | 'SHA256' | 'HASH32' | 'HASH40' | 'HASH64' | 'HASH96' | 'HASH128' | 'BCRYPT' | 'PHPASS' | 'HASHCAT_HEX' | 'BASE64' | 'SSHA' | 'PBKDF2_SHA256' | 'BASE64_HASH32' | 'BASE64_HASH40' | 'BASE64_HASH128' | 'BASE64_INTEGER_HASH32' | 'BASE64_INTEGER_HASH40' | 'BASE64_INTEGER_HASH64' | 'BASE64_INTEGER_HASH96' | 'BASE64_INTEGER_HASH128' | 'MYSQL_SHA_V41PLUS' | 'NTLM' | 'MD5', required
            - `hash_prefix` string, required
      - `properties` PasswordProperty[], required
      - `cleartext_hint` string
      - `cleartext` string
    - `authorization_service` AuthorizationService
      - `url` string, required
      - `domain` string, required
      - `fqdn` string, required
      - `protocols` string[], required
      - `technology` Technology[], required
        - `id` string
        - `name` string, required
        - `category` string
    - `cookies` Cookie[]
      - `dns` string, required
      - `name` string, required
      - `http` boolean, required
      - `expiration` string, date-time, required
      - `secure` boolean, required
      - `value` string
    - `malware_family` MalwareFamily
      - `id` string, required
      - `name` string, required
    - `dump` DumpMetadata, required
      - `name` string, required
      - `type` string
      - `source` string, required
      - `description` string
      - `infrastructure` Infrastructure
        - `ip` string, required
      - `compromise` Compromise
        - `os` string
        - `os_username` string
        - `malware_file` string
        - `timezone` string
        - `computer_name` string
        - `uac` string
        - `antivirus` string[]
        - `exfiltration_date` string, date-time, required
      - `location` Location
        - `country` CountryCode
          - `name` string, required
          - `displayName` string, required
          - `countryCode` string, required
          - `alpha2Code` string, required
          - `alpha3Code` string, required
        - `city` string
        - `address` string
        - `address1` string
        - `address2` string
        - `state` string
        - `postal_code` string
        - `zip` string
      - `breaches` BreachMetadata[], required
        - `name` string, required
        - `domain` string, required
        - `type` string, required
        - `breached` string, date-time
        - `start` string, date-time
        - `stop` string, date-time
        - `precision` 'YEAR' | 'MONTH' | 'DAY'
        - `description` string, required
        - `site_description` string
      - `downloaded` string, date-time, required
    - `created` string, date-time, required
  - `next_offset` string

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal Server Error
- `default` — Error

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)