--- title: "Search leaks with advanced filters (JSON body)" method: POST path: "/search/advanced" tags: ["Search Advanced"] --- # Search leaks with advanced filters (JSON body) `POST /search/advanced` Search leaked credentials using any combination of fields defined in `LeakSearchFilters`. **Pagination:** `page` ≥ 1, `page_size` in [1, 1 000] (default 100). **Access:** If your plan includes `advanced_search`, full URLs and item IDs are returned; otherwise redacted. **Rate limit:** 5 requests per second per user. **Auto-unlock:** Pass `auto_unlock=true` to automatically unlock locked items on the current page. Points are consumed per newly unlocked item. If insufficient points, partial unlock is performed. The response field `auto_unlock_points_consumed` indicates how many points were used. --- **Filter limits:** | Constraint | Value | |------------|-------| | Max values per filter field | 50 | | Min characters per value (default) | 3 | | Min characters for `url_scheme`, `url_tld`, `email_tld` | 2 | | Min characters for `username_hash`, `password_hash` | 4 | | Max characters per string value | 100 | | Max characters for `url_scheme` | 20 | | Max characters for `url_tld`, `email_tld` | 10 | ## Query parameters - `page` integer — Page number (starts at 1). - `page_size` integer — Items per page (1–1000, default 100). - `auto_unlock` boolean — Automatically unlock locked items on the current page using your points. ## Request body - LeakSearchFilters - `username` string[], nullable — Username values to match. - `username_not` string[], nullable — Username values to exclude. - `username_match_type` 'contains' | 'starts_with' | 'ends_with' - `username_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `password` string[], nullable — Password values to match. - `password_not` string[], nullable — Password values to exclude. - `password_match_type` 'contains' | 'starts_with' | 'ends_with' - `password_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `url` string[], nullable — URL values to match. - `url_not` string[], nullable — URL values to exclude. - `url_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_domain` string[], nullable — URL domain values to match. - `url_domain_not` string[], nullable — URL domain values to exclude. - `url_domain_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_domain_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_host` string[], nullable — URL host values to match. - `url_host_not` string[], nullable — URL host values to exclude. - `url_host_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_host_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `username_hash` string[], nullable — Username SHA-1 hash prefix (hex). - `password_hash` string[], nullable — Password SHA-1 hash prefix (hex). - `url_scheme` string[], nullable — URL scheme(s) to include (multi). - `url_scheme_not` string[], nullable — URL scheme(s) to exclude (multi). - `url_port` integer[], nullable — URL port(s) to include (multi). - `url_port_not` integer[], nullable — URL port(s) to exclude (multi). - `url_tld` string[], nullable — URL TLD(s) to include (multi). - `url_tld_not` string[], nullable — URL TLD(s) to exclude (multi). - `is_email` boolean, nullable — Identifier type filter: true=email only, false=username only, null=both. - `email_domain` string[], nullable — Email domain values to match. - `email_domain_not` string[], nullable — Email domain values to exclude. - `email_domain_match_type` 'contains' | 'starts_with' | 'ends_with' - `email_domain_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `email_host` string[], nullable — Email host values to match. - `email_host_not` string[], nullable — Email host values to exclude. - `email_host_match_type` 'contains' | 'starts_with' | 'ends_with' - `email_host_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `email_tld` string[], nullable — Email TLD(s) to include (multi). - `email_tld_not` string[], nullable — Email TLD(s) to exclude (multi). - `password_strength` 'too_weak' | 'weak' | 'medium' | 'strong' - `added_from` string, date-time, nullable — Only include leaks indexed on/after this UTC datetime. - `added_to` string, date-time, nullable — Only include leaks indexed on/before this UTC datetime. - `force_and` boolean, nullable — When true, require all values within each field (AND within field). ## Response `200` Search results returned successfully. - PaginatedLeaksResponse - `items` LeakDetails[], required — List of leak records for the current page. - `id` string, nullable — Unique leak identifier. Only returned when the item is unlocked or the plan includes full access. - `url` string, nullable — Source URL where the credentials were found. Redacted for locked items on non-advanced plans. - `username` string, nullable — Leaked username or email address. Masked when locked. - `username_masked` string, nullable — Partially masked version of the username (e.g. j***@example.com). - `password` string, nullable — Leaked password. Only returned when the item is unlocked. - `password_strength` integer, nullable — Password strength raw score (integer, 0+). Categories: too_weak (0-2), weak (3-4), medium (5-7), strong (8+). - `unlocked` boolean — Whether this item has been unlocked by the current account. - `is_email` boolean, nullable — True if the username is an email address, false if it is a plain username. - `added_at` string, date-time, nullable — Date when this leak was added to the database. - `status` string, nullable — Remediation status of the unlocked leak: new, in_progress, fixed, accepted_risk. Only present for unlocked items. - `total` integer, required — Total number of matching leak records. - `total_unlocked` integer, required — Number of already-unlocked records in the total results. - `page` integer, required — Current page number. - `page_size` integer, required — Number of items per page. - `blacklisted_value` string, nullable — If a filter value matched a blacklist entry, this field contains the matched value. - `auto_unlock_points_consumed` integer, nullable — Number of points consumed by auto-unlock on this request. ## Other responses - `400` — Pagination too deep (offset > 1,000,000 — use `/search/advanced/export`). - `401` — Authentication required, or invalid/expired API key. - `403` — Account banned, or pending email verification. - `422` — Validation error in filter parameters. - `429` — Rate limit exceeded (5 req/sec). Response includes `Retry-After`, `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` headers. - `503` — Advanced search under maintenance, or public API temporarily disabled. --- [API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) · [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/leakradar/leakradar-io-api/revisions/82a99c608e1a/schema)