---
title: "List your unlocked leaks"
method: GET
path: "/profile/unlocked"
tags: ["Unlocked Leaks"]
---

# List your unlocked leaks

`GET /profile/unlocked`

## Request

- Base URL: `https://api.leakradar.io`
- URL: `https://api.leakradar.io/profile/unlocked`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/leakradar/apis/leakradar-io-api/docs/profile/unlocked/get.ts> (a function with typed inputs; its response is checked against the schema)

Return a paginated list of unlocked leaks for the authenticated account.

Pagination
- `page` starts at 1.
- `page_size` is 1 to 1000 (default 100).

Filtering
- `search` optional free-text filter applied to URL or username.
- `is_email` optional boolean: `true` emails only, `false` usernames only, `null` both.
- `list_id` optional integer: filter leaks assigned to this list.
- `list_none` optional boolean: filter leaks with no list assignment.

Response semantics
- When no filter is provided at all (no `search`, no `is_email`, no list filter), `total` equals your global count of unlocked items.
- When any filter is provided (including only `is_email`), `total` equals the filtered count, while `total_unlocked` remains your global total.

**Errors**
- 401 Authentication required, or invalid/expired API key.
- 404 Page out of range.
- 422 Request validation error.

## Query parameters

- `page` integer: Page number (starts at 1).
- `page_size` integer: Items per page (1–1000, default 100).
- `search` string, nullable: Optional free-text filter on URL or username.
- `is_email` boolean, nullable: true=email, false=username
- `list_id` integer, nullable: Filter by list id.
- `list_none` boolean, nullable: Only leaks without a list when true
- `status` string, nullable: Filter by remediation status: new, in_progress, fixed, accepted_risk

## Response `200`

Unlocked leaks returned successfully.

- PaginatedUnlockedLeaksResponse
  - `items` UnlockedLeakDetails[], required: List of unlocked leak records for the current page.
    - `id` string, required: Unique leak identifier.
    - `url` string, required: Source URL where the credentials were found.
    - `username` string, required: Leaked username or email address.
    - `password` string, nullable: Leaked password (plaintext). Null when the user has enabled `hide_passwords` in their preferences.
    - `password_strength` integer, required: Password strength raw score (integer, 0+). Categories: too_weak (0-2), weak (3-4), medium (5-7), strong (8+).
    - `unlocked` boolean: Always true for unlocked items.
    - `is_email` boolean, required: True if the username is an email address.
    - `added_at` string, date-time, required: Date when this leak was added to the database.
    - `unlocked_at` string, date-time, required: Date when this item was unlocked by the current account.
    - `auto_unlocked` boolean: Whether this item was automatically unlocked (via auto_unlock or notification).
    - `auto_unlocked_by` integer, nullable: ID of the notification that triggered the auto-unlock, if applicable.
    - `list_id` integer, nullable: ID of the unlocked list this item is assigned to.
    - `comment` string, nullable: User-defined comment on this unlocked item.
    - `status` string: Remediation status: new, in_progress, fixed, accepted_risk.
  - `total` integer, required: Total number of matching records.
  - `total_unlocked` integer, required: Total number of unlocked records.
  - `page` integer, required: Current page number.
  - `page_size` integer, required: Number of items per page.

## Other responses

- `401`: Authentication required.
- `404`: Page out of range.
- `422`: Validation Error

## Changes

- **2026-09-01** `82a99c608e1a`: 2 breaking, 14 info
  - the response property `items/items/password` became optional for the status `200`
  - response property `items/items/password` list-of-types was widened by adding types `null` to media type `application/json` of response `200`
  - api tag `Unlocked Leaks` added
  - api tag `Profile` removed
  - …12 more
- **2025-06-07** `00e5aabba957`: 1 info
  - added the new optional `query` request parameter `is_email`
- **2025-05-26** `033a9f3cacd1`: 9 info
  - the response property `items/items/added_at` became required for the status `200`
  - the response property `items/items/unlocked_at` became required for the status `200`
  - response property `items/items/added_at` list-of-types was narrowed by removing types `null` from media type `application/json` of response `200`
  - response property `items/items/id` list-of-types was narrowed by removing types `null` from media type `application/json` of response `200`
  - …5 more
- **2025-05-10** `7d4c71f01e30`: 2 info
  - added the optional property `items/items/added_at` to the response with the `200` status
  - added the optional property `items/items/unlocked_at` to the response with the `200` status
- …earlier changes not shown

[Operation history](https://skmtc.dev/leakradar/apis/leakradar-io-api/changes/profile/unlocked/get.md)

---

[API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) - [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) - [OpenAPI document](https://skmtc.dev/leakradar/apis/leakradar-io-api/revisions/8dcd4b54cc4a?raw)