---
title: "Bulk assign or unassign a list across many unlocked leaks"
method: POST
path: "/profile/unlocked/lists/bulk-assign"
tags: ["Unlocked Leaks Lists"]
---

# Bulk assign or unassign a list across many unlocked leaks

`POST /profile/unlocked/lists/bulk-assign`

## Request

- Base URL: `https://api.leakradar.io`
- URL: `https://api.leakradar.io/profile/unlocked/lists/bulk-assign`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/leakradar/apis/leakradar-io-api/docs/profile/unlocked/lists/bulk-assign/post.ts> (a function with typed inputs; its response is checked against the schema)

Start a background task that assigns a target list to all unlocked leaks matching the provided filters. Use a null `target_list_id` to remove the assignment for matches.

Filtering
- Supports the same filtering fields used by the advanced unlocked search API.
- Optional helpers, applied on top of `filters` when both are sent: `search`, `is_email`, `list_id_filter`, `list_none`, `status_filter`.

Validation
- `target_list_id` must be a positive integer when provided. Use null to unassign.

Response
- Returns a `task_id` that you can poll with `/profile/unlocked/list-tasks/{task_id}`.

## Request body

- BulkAssignIn
  - `target_list_id` integer, nullable, required
  - `dataset` 'stealer_logs' | 'combolist'
  - `search` string, nullable
  - `is_email` boolean, nullable
  - `list_id_filter` integer, nullable
  - `list_none` boolean, nullable
  - `status_filter` string, nullable
  - `filters` LeakSearchFilters: Advanced text values are literal, including *, ? and backslash. Use contains, starts_with or ends_with to select the matching mode.
    - `username` string[], nullable: Username values to match.
    - `username_not` string[], nullable: Username values to exclude.
    - `username_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `username_not_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `password` string[], nullable: Password values to match.
    - `password_not` string[], nullable: Password values to exclude.
    - `password_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `password_not_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `url` string[], nullable: URL values to match.
    - `url_not` string[], nullable: URL values to exclude.
    - `url_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `url_not_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `url_domain` string[], nullable: URL domain values to match.
    - `url_domain_not` string[], nullable: URL domain values to exclude.
    - `url_domain_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `url_domain_not_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `url_host` string[], nullable: URL host values to match.
    - `url_host_not` string[], nullable: URL host values to exclude.
    - `url_host_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `url_host_not_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `username_hash` string[], nullable: Username SHA-1 hash prefix (hex).
    - `password_hash` string[], nullable: Password SHA-1 hash prefix (hex).
    - `url_scheme` string[], nullable: URL scheme(s) to include (multi).
    - `url_scheme_not` string[], nullable: URL scheme(s) to exclude (multi).
    - `url_port` integer[], nullable: URL port(s) to include (multi).
    - `url_port_not` integer[], nullable: URL port(s) to exclude (multi).
    - `url_tld` string[], nullable: URL TLD(s) to include (multi).
    - `url_tld_not` string[], nullable: URL TLD(s) to exclude (multi).
    - `is_email` boolean, nullable: Identifier type filter: true=email only, false=username only, null=both.
    - `email_domain` string[], nullable: Email domain values to match.
    - `email_domain_not` string[], nullable: Email domain values to exclude.
    - `email_domain_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `email_domain_not_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `email_host` string[], nullable: Email host values to match.
    - `email_host_not` string[], nullable: Email host values to exclude.
    - `email_host_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `email_host_not_match_type` 'contains' | 'starts_with' | 'ends_with'
    - `email_tld` string[], nullable: Email TLD(s) to include (multi).
    - `email_tld_not` string[], nullable: Email TLD(s) to exclude (multi).
    - `password_strength` 'too_weak' | 'weak' | 'medium' | 'strong'
    - `added_from` string, date-time, nullable: Only include leaks indexed on/after this UTC datetime.
    - `added_to` string, date-time, nullable: Only include leaks indexed on/before this UTC datetime.
    - `force_and` boolean, nullable: When true, require all values within each field (AND within field).

## Response `200`

Bulk assign task started.

- TaskStatusOut
  - `task_id` string, required
  - `running` boolean, required
  - `completed` boolean, required
  - `total` integer, nullable
  - `updated` integer, nullable
  - `version_conflicts` integer, nullable

## Other responses

- `400`: Invalid target_list_id.
- `401`: Authentication required, or invalid/expired API key.
- `404`: Target list not found.
- `422`: Validation error.

## Changes

- **2026-09-04** `eb219e94d077`: 1 info
  - added the new optional request property `dataset`
- **2026-09-01** `82a99c608e1a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/leakradar/apis/leakradar-io-api/changes/profile/unlocked/lists/bulk-assign/post.md)

---

[API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) - [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) - [OpenAPI document](https://skmtc.dev/leakradar/apis/leakradar-io-api/revisions/8dcd4b54cc4a?raw)