--- title: "Unlock leaks for advanced search" method: POST path: "/search/advanced/unlock" tags: ["Search Advanced"] --- # Unlock leaks for advanced search `POST /search/advanced/unlock` Unlock leaks returned by the same advanced search filters as `/search/advanced`. Provide filters in the JSON body. Optional query parameter `max` limits how many new leaks to unlock. **Behavior** - If `max` is omitted, the service unlocks as many as your available points allow (subscription + extra). - Only previously locked items are unlocked. Already unlocked items remain unchanged. - Only newly unlocked items consume points. - **Hard cap**: synchronous unlocks are limited to 10,000. Use `/search/advanced/unlock/task` for higher volumes. **Plan requirement** Requires a paid plan with `advanced_search` enabled. **Errors** - 400 Insufficient points, no matching data, all items already unlocked, more than 10,000 unlocks (use /search/advanced/unlock/task), unlock not needed on your plan. - 401 Authentication required, or invalid/expired API key. - 403 Advanced search not available on your plan, this search is blocked, account banned, or pending email verification. - 404 The provided list_id does not exist or is not yours. - 422 Request validation error. - 429 Rate limit exceeded. - 503 Advanced search under maintenance, or public API temporarily disabled. ## Query parameters - `max` integer, nullable — 0 or omitted = use all your points - `list_id` integer, nullable — Assign this list id to new unlocks. ## Request body - LeakSearchFilters — Advanced text values are literal, including *, ? and backslash. Use contains, starts_with or ends_with to select the matching mode. - `username` string[], nullable — Username values to match. - `username_not` string[], nullable — Username values to exclude. - `username_match_type` 'contains' | 'starts_with' | 'ends_with' - `username_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `password` string[], nullable — Password values to match. - `password_not` string[], nullable — Password values to exclude. - `password_match_type` 'contains' | 'starts_with' | 'ends_with' - `password_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `url` string[], nullable — URL values to match. - `url_not` string[], nullable — URL values to exclude. - `url_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_domain` string[], nullable — URL domain values to match. - `url_domain_not` string[], nullable — URL domain values to exclude. - `url_domain_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_domain_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_host` string[], nullable — URL host values to match. - `url_host_not` string[], nullable — URL host values to exclude. - `url_host_match_type` 'contains' | 'starts_with' | 'ends_with' - `url_host_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `username_hash` string[], nullable — Username SHA-1 hash prefix (hex). - `password_hash` string[], nullable — Password SHA-1 hash prefix (hex). - `url_scheme` string[], nullable — URL scheme(s) to include (multi). - `url_scheme_not` string[], nullable — URL scheme(s) to exclude (multi). - `url_port` integer[], nullable — URL port(s) to include (multi). - `url_port_not` integer[], nullable — URL port(s) to exclude (multi). - `url_tld` string[], nullable — URL TLD(s) to include (multi). - `url_tld_not` string[], nullable — URL TLD(s) to exclude (multi). - `is_email` boolean, nullable — Identifier type filter: true=email only, false=username only, null=both. - `email_domain` string[], nullable — Email domain values to match. - `email_domain_not` string[], nullable — Email domain values to exclude. - `email_domain_match_type` 'contains' | 'starts_with' | 'ends_with' - `email_domain_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `email_host` string[], nullable — Email host values to match. - `email_host_not` string[], nullable — Email host values to exclude. - `email_host_match_type` 'contains' | 'starts_with' | 'ends_with' - `email_host_not_match_type` 'contains' | 'starts_with' | 'ends_with' - `email_tld` string[], nullable — Email TLD(s) to include (multi). - `email_tld_not` string[], nullable — Email TLD(s) to exclude (multi). - `password_strength` 'too_weak' | 'weak' | 'medium' | 'strong' - `added_from` string, date-time, nullable — Only include leaks indexed on/after this UTC datetime. - `added_to` string, date-time, nullable — Only include leaks indexed on/before this UTC datetime. - `force_and` boolean, nullable — When true, require all values within each field (AND within field). ## Response `200` Unlocked leaks returned successfully. - LeakDetails[] - `id` string, nullable — Unique leak identifier. Only returned when the item is unlocked or the plan includes full access. - `url` string, nullable — Source URL where the credentials were found. Redacted for locked items on non-advanced plans. - `username` string, nullable — Leaked username or email address. Masked when locked. - `username_masked` string, nullable — Partially masked version of the username (e.g. j***@example.com). - `password` string, nullable — Leaked password. Only returned when the item is unlocked. - `password_strength` integer, nullable — Password strength raw score (integer, 0+). Categories: too_weak (0-2), weak (3-4), medium (5-7), strong (8+). - `unlocked` boolean — Whether this item has been unlocked by the current account. - `is_email` boolean, nullable — True if the username is an email address, false if it is a plain username. - `added_at` string, date-time, nullable — Date when this leak was added to the database. - `status` string, nullable — Remediation status of the unlocked leak: new, in_progress, fixed, accepted_risk. Only present for unlocked items. ## Other responses - `400` — Insufficient points, no matching data, all items already unlocked, more than 10,000 unlocks (use the /unlock/task endpoint), unlock not needed on your plan. - `401` — Authentication required, or invalid/expired API key. - `403` — Advanced search not available on your plan, this search is blocked, account banned, or pending email verification. - `404` — The provided list_id does not exist or is not yours. - `422` — Validation Error - `429` — Rate limit exceeded (10 req/sec). See Retry-After / X-RateLimit-* headers. - `503` — Advanced search under maintenance, or public API temporarily disabled. --- [API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) · [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) · [OpenAPI document](https://skmtc.dev/leakradar/apis/leakradar-io-api/revisions/99aaaa4fbeb1?raw)