---
title: "FortiBleed Feed"
method: POST
path: "/fortinet"
tags: ["Domain Intelligence"]
---

# FortiBleed Feed

`POST /fortinet`

## Request

- Base URL: `https://api.hudsonrock.com/json/v3`
- URL: `https://api.hudsonrock.com/json/v3/fortinet`
- Auth: API key in header `api-key`
- TypeScript: <https://skmtc.dev/hudsonrock/apis/cavalier-api/docs/fortinet/post.ts> (a function with typed inputs; its response is checked against the schema)

Paginated FortiBleed (Fortinet) compromise feed. Returns Fortinet domain records in the original (v1) schema (`url`, `login`, `password`, `FortiGuardID`, `country`). For the v2 schema with the FortiBleed v2 fields, use the FortiBleed v2 Feed (`/fortinet/v2`).

Requires the `fortibleed` api permission. A missing or invalid `api-key` returns `401`; a valid key that lacks `fortibleed` returns `403`.

**Censoring** follows the API key's permissions, exactly as in the FortiBleed v2 Feed. Masked characters are `*`.

| Field | Gate | Partial | Hidden |
|---|---|---|---|
| `login`, `FortiGuardID` | usernames | first 2 chars of the part before `@`, rest `*`; the `@domain` stays visible | whole part before `@` is `*`; the `@domain` stays visible |
| `password` | passwords | first 2 chars, rest `*` | all `*` |

`url`, `country` and the domain-level fields are never censored. Missing values are `null`.

Results are returned in a stable, deterministic order (most compromised users first, then domain ascending) identical to the public website feed, so pagination is consistent across pages.

Example request:

```bash
curl -X POST 'https://api.hudsonrock.com/json/v3/fortinet?page=1&limit=20' \
  -H 'api-key: YOUR_API_KEY'
```

Example response (API key with the `usernames` and `passwords` permissions):

```json
{
  "data": [
    {
      "domain": "example.com",
      "industry": "Financial Services",
      "size": "1001-5000 Employees",
      "revenue": "$500 Million",
      "credentials": [
        {
          "url": "https://vpn.example.com:443/login",
          "login": "david",
          "password": "david",
          "FortiGuardID": "FGT60F-XXXXXXXX",
          "country": "US"
        }
      ]
    }
  ],
  "total": 21632,
  "page": 1,
  "limit": 20,
  "totalPages": 1082
}
```

## Query parameters

- `page` integer
- `limit` integer

## Response `200`

Successful operation

- object
  - `data` FortinetData[]
    - `domain` string, nullable: Domain associated with the Fortinet exposure.
    - `industry` string, nullable: Company industry.
    - `size` string, nullable: Employee-count bucket.
    - `revenue` string, nullable: Estimated company revenue.
    - `credentials` FortinetCredential[]: All compromised credential rows for the domain.
      - `url` string, nullable: Compromised URL. Never censored.
      - `login` string, nullable: Login/username. Follows the `usernames` permission: email-aware masking, only the part before `@` is masked.
      - `password` string, nullable: Password. Follows the `passwords` permission.
      - `FortiGuardID` string, nullable: FortiGuard identifier (exact casing: FortiGuardID). Follows the `usernames` permission: email-aware masking, only the part before `@` is masked.
      - `country` string, nullable: ISO country code.
  - `total` integer: Total number of Fortinet domains across all pages.
  - `page` integer
  - `limit` integer
  - `totalPages` integer

## Other responses

- `400`: Validation error - the request or request body was invalid
- `401`: Unauthorized - the server could not authenticate the request
- `403`: Forbidden - the server authenticated the request but refuses to process it because of insufficient permissions
- `405`: Method Not Allowed - only GET is supported on this endpoint.
- `500`: Internal server error - the server encountered an unexpected condition that prevented it from fulfilling the request

## Changes

- **2026-11-03** `a7ebb4dfd47f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hudsonrock/apis/cavalier-api/changes/fortinet/post.md)

---

[API](https://skmtc.dev/hudsonrock/apis/cavalier-api.md) - [All operations](https://skmtc.dev/hudsonrock/apis/cavalier-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hudsonrock/apis/cavalier-api/revisions/a7ebb4dfd47f?raw)