--- title: "Export your unlocked leaks to CSV/TXT/JSON (advanced filters)" method: POST path: "/profile/unlocked/advanced/export" tags: ["Unlocked Leaks"] --- # Export your unlocked leaks to CSV/TXT/JSON (advanced filters) `POST /profile/unlocked/advanced/export` ## Request - Base URL: `https://api.leakradar.io` - URL: `https://api.leakradar.io/profile/unlocked/advanced/export` - Auth: HTTP bearer - TypeScript: (a function with typed inputs; its response is checked against the schema) Queue an export of your unlocked leaks filtered by the same fields supported by `LeakSearchFilters`. Provide advanced filters in the JSON request body. The job runs asynchronously and the file will appear in the Exports section when ready. Request body - JSON payload following the `LeakSearchFilters` schema. - The four scope fields below may also be sent as keys of this same flat body. A value given in the query string wins over the body one. Scope, as query parameters or body keys - `unlocked_at_min` optional ISO 8601 timestamp with timezone to include items unlocked at or after this instant. - `list_id` optional list id filter. - `list_none` optional boolean to only include leaks without list. - `status` optional remediation status: `new`, `in_progress`, `fixed` or `accepted_risk`. Omit it to export every status. - `format` optional output format: `csv` (default), `txt`, or `json`. Limits - At least one advanced filter is required. - You can have at most 5 exports with status PENDING or IN_PROGRESS. Response `ExportResponse` with `status`, `message`, and `export_id`. ## Query parameters - `list_id` integer, nullable: Filter by list id - `list_none` boolean, nullable: Only leaks without list - `status` 'new' | 'in_progress' | 'fixed' | 'accepted_risk', nullable: Remediation status filter. Omit to export every status. - `format` 'csv' | 'txt' | 'json' - `unlocked_at_min` string, date-time, nullable: Only include items unlocked at or after this ISO 8601 timestamp (with timezone). ## Request body - UnlockedAdvancedExportRequest: Advanced filters plus the unlocked scope, in one flat JSON body. The route historically declared the scope keys as query parameters while the app sent them in the body, where pydantic dropped them without a word. Widening the body model is what makes them arrive; the query parameters are kept so existing API callers are unaffected. It has to be a SUBCLASS and the three fields must never move onto `LeakSearchFilters` itself: `has_effective_advanced_filters` iterates the base class's `model_fields`, so a scope-only payload keeps being refused here, and the ten other call sites of that gate (advanced unlock, full corpus exports) keep their meaning. - `username` string[], nullable: Username values to match. - `username_not` string[], nullable: Username values to exclude. - `username_match_type` 'contains' | 'starts_with' | 'ends_with' - `username_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `password` string[], nullable: Password values to match. - `password_not` string[], nullable: Password values to exclude. - `password_match_type` 'contains' | 'starts_with' | 'ends_with' - `password_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `url` string[], nullable: URL values to match. - `url_not` string[], nullable: URL values to exclude. - `url_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_domain` string[], nullable: URL domain values to match. - `url_domain_not` string[], nullable: URL domain values to exclude. - `url_domain_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_domain_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_host` string[], nullable: URL host values to match. - `url_host_not` string[], nullable: URL host values to exclude. - `url_host_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_host_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `username_hash` string[], nullable: Username SHA-1 hash prefix (hex). - `password_hash` string[], nullable: Password SHA-1 hash prefix (hex). - `url_scheme` string[], nullable: URL scheme(s) to include (multi). - `url_scheme_not` string[], nullable: URL scheme(s) to exclude (multi). - `url_port` integer[], nullable: URL port(s) to include (multi). - `url_port_not` integer[], nullable: URL port(s) to exclude (multi). - `url_tld` string[], nullable: URL TLD(s) to include (multi). - `url_tld_not` string[], nullable: URL TLD(s) to exclude (multi). - `is_email` boolean, nullable: Identifier type filter: true=email only, false=username only, null=both. - `email_domain` string[], nullable: Email domain values to match. - `email_domain_not` string[], nullable: Email domain values to exclude. - `email_domain_match_type` 'contains' | 'starts_with' | 'ends_with' - `email_domain_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `email_host` string[], nullable: Email host values to match. - `email_host_not` string[], nullable: Email host values to exclude. - `email_host_match_type` 'contains' | 'starts_with' | 'ends_with' - `email_host_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `email_tld` string[], nullable: Email TLD(s) to include (multi). - `email_tld_not` string[], nullable: Email TLD(s) to exclude (multi). - `password_strength` 'too_weak' | 'weak' | 'medium' | 'strong' - `added_from` string, date-time, nullable: Only include leaks indexed on/after this UTC datetime. - `added_to` string, date-time, nullable: Only include leaks indexed on/before this UTC datetime. - `force_and` boolean, nullable: When true, require all values within each field (AND within field). - `unlocked_at_min` string, date-time, nullable: Only items unlocked at or after this instant. Needs a timezone. - `list_id` integer, nullable: Filter by list id. - `list_none` boolean, nullable: Only items that belong to no list. - `status` 'new' | 'in_progress' | 'fixed' | 'accepted_risk', nullable: Remediation status filter. Omit to export every status. ## Response `200` Export queued successfully. - ExportResponse - `status` string, required: Export job status: 'queued', 'processing', 'completed', or 'failed'. - `message` string, required: Human-readable status message. - `export_id` integer, required: ID of the export job. Use this to check status or download the result. ## Other responses - `400`: No filters provided, maximum concurrent exports reached. - `401`: Authentication required, or invalid/expired API key. - `422`: Validation Error ## Changes - **2026-09-04** `eb219e94d077`: 1 breaking, 5 info - for the `query` request parameter `list_none`, default value `false` was removed - added the new optional `query` request parameter `status` - added the new optional request property `list_id` - added the new optional request property `list_none` - …2 more - **2026-09-01** `82a99c608e1a`: 1 info - endpoint added [Operation history](https://skmtc.dev/leakradar/apis/leakradar-io-api/changes/profile/unlocked/advanced/export/post.md) --- [API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) - [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) - [OpenAPI document](https://skmtc.dev/leakradar/apis/leakradar-io-api/revisions/8dcd4b54cc4a?raw)