---
title: "FortiBleed v2 Feed { NEW }"
method: POST
path: "/fortinet/v2"
tags: ["Domain Intelligence"]
---

# FortiBleed v2 Feed { NEW }

`POST /fortinet/v2`

## Request

- Base URL: `https://api.hudsonrock.com/json/v3`
- URL: `https://api.hudsonrock.com/json/v3/fortinet/v2`
- Auth: API key in header `api-key`
- TypeScript: <https://skmtc.dev/hudsonrock/apis/cavalier-api/docs/fortinet/v2/post.ts> (a function with typed inputs; its response is checked against the schema)

Paginated FortiBleed v2 feed.

## Query parameters

- `page` integer
- `limit` integer

## Response `200`

Successful operation

- object
  - `data` FortinetV2Data[]
    - `domain` string, nullable: Domain associated with the Fortinet exposure.
    - `industry` string, nullable: Company industry.
    - `size` string, nullable: Employee-count bucket.
    - `revenue` string, nullable: Estimated company revenue.
    - `batches` integer[]: Ingest batches merged into this record. Contains `2` when the domain has FortiBleed v2 credentials; empty for v1-only domains.
    - `v2_added_at` string, date-time, nullable: When FortiBleed v2 credentials were added for this domain; `null` if the domain has none.
    - `credentials` FortinetV2Credential[]: All credential rows for the domain (batch 1 and batch 2), v2 rows first.
      - `batch` 1 | 2: Ingest batch: `1` for the original FortiBleed data, `2` for FortiBleed v2.
      - `url` string, nullable: Compromised FortiGate URL. Never censored.
      - `login` string, nullable: Login/username. Follows the `usernames` permission (email-aware masking).
      - `password` string, nullable: Password. Follows the `passwords` permission.
      - `FortiGuardID` string, nullable: FortiGuard identifier (exact casing: FortiGuardID). Follows the `usernames` permission (email-aware masking).
      - `country` string, nullable: ISO country code.
      - `user_email` string, nullable: Email address linked to the account (v2). Follows the `usernames` permission (email-aware masking).
      - `ldap_dn` string, nullable: LDAP distinguished name of the account (v2). Follows the `usernames` permission.
      - `trusthosts` string, nullable: Trusted-host list from the firewall config as `ip mask` pairs separated by spaces (v2). Follows the `ip` permission.
      - `hostname` string, nullable: FortiGate device hostname (v2). Follows the `computer_name` permission.
      - `serial_or_alias` string, nullable: FortiGate serial number or alias (v2). Follows the `computer_name` permission.
      - `report_date` string, nullable: Report timestamp of the v2 source data (v2).
      - `device_ip` string, nullable: Public IP of the FortiGate device (v2). Never censored.
      - `admin_port` string, nullable: Admin interface port (v2).
      - `vpn_port` string, nullable: SSL-VPN port (v2).
      - `target_port` string, nullable: Port the credential was collected from (v2).
      - `attribution_source` string, nullable: How the device was attributed to the domain, e.g. `LDAP_DN_Public`, `User_Admin_Email_Domain`, `FortiGuard_ID_Only (Check_If_MSSP)`, `Firewall_Address_Object_FQDN`, `System_DNS_Domain`, `unattributed` (v2).
      - `credential_category` string, nullable: Credential category, e.g. `FortiGate_Local_User (SSL-VPN/Auth)`, `FortiGate_System_Admin_Config`, `FortiGate_Super_Admin_Verified_Login`, `Active_Directory_LDAP_Bind_Account`, `FortiGate_HA_Cluster`, `SMTP_Email_Server` (v2).
      - `secret_type` string, nullable: Form the secret was recovered in, e.g. `cleartext`, `empty`, `FortiOS_ENC_Ciphertext (Undecrypted)`, `FortiOS_Admin_Hash_SH2 (SHA-256)`, `FortiOS_Admin_Hash_PB2 (PBKDF2)` (v2).
      - `account_status` string, nullable: Account status, e.g. `Verified_Active_Login`, `Enabled`, `Disabled`, `Hash`, `Decrypted` (v2).
      - `accprofile` string, nullable: FortiGate access profile, e.g. `local_user`, `super_admin`, `prof_admin`, `ldap_bind`, `super_admin_readonly` (v2).
      - `vdom` string, nullable: Virtual domain (VDOM) context of the account, e.g. `config global`, `root` (v2).
      - `two_fa` string, nullable: Two-factor method configured for the account, e.g. `fortitoken`, `fortitoken-cloud`, `email`, `sms`; `null` when none (v2).
      - `ldap_server` string, nullable: LDAP server configured on the device (v2).
      - `all_public_domains` string, nullable: Comma-separated public domains seen on the device (v2).
      - `all_internal_domains` string, nullable: Comma-separated internal domains seen on the device (v2).
      - `config_file` string, nullable: Name of the FortiGate config file the credential was extracted from (v2). Present ONLY when the API key is fully uncensored for `usernames`, `passwords`, `ip` and `computer_name`; omitted otherwise.
  - `total` integer: Total number of domains with FortiBleed v2 credentials across all pages. Refreshed every 10 minutes.
  - `page` integer
  - `limit` integer
  - `totalPages` integer

## Other responses

- `400`: Validation error - the request or request body was invalid
- `401`: Unauthorized - the server could not authenticate the request
- `403`: Forbidden - the server authenticated the request but refuses to process it because of insufficient permissions
- `405`: Method Not Allowed - only POST is supported on this endpoint.
- `500`: Internal server error - the server encountered an unexpected condition that prevented it from fulfilling the request

## Changes

- **2026-11-03** `a7ebb4dfd47f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hudsonrock/apis/cavalier-api/changes/fortinet/v2/post.md)

---

[API](https://skmtc.dev/hudsonrock/apis/cavalier-api.md) - [All operations](https://skmtc.dev/hudsonrock/apis/cavalier-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hudsonrock/apis/cavalier-api/revisions/a7ebb4dfd47f?raw)