---
title: "List the entries of an Android app"
method: GET
path: "/search/applications/{package}/leaks"
tags: ["Search Applications"]
---

# List the entries of an Android app

`GET /search/applications/{package}/leaks`

## Request

- Base URL: `https://api.leakradar.io`
- URL: `https://api.leakradar.io/search/applications/{package}/leaks`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/leakradar/apis/leakradar-io-api/docs/search/applications/:package/leaks/get.ts> (a function with typed inputs; its response is checked against the schema)

Paginated Stealer Logs entries saved for an Android app (`android://` URLs of the package), newest first.

**Query parameters**
- `page` starts at 1, `page_size` is 1 to 1000 (default 100).
- `search` optional term to narrow results.
- `is_email` optional: true = emails only, false = usernames only, null = both.

**Access and visibility**
- With `domain_search` in your plan, full URLs and item IDs are returned.
- Otherwise URLs are redacted except for the first 10 items per page and IDs are omitted.
- Credentials are returned only for items with `unlocked=true`.

**Auto-unlock**
Pass `auto_unlock=true` to unlock the locked items of the current page with your points (partial unlock when points run out, see `auto_unlock_points_consumed`).

## Path parameters

- `package` string, required: Android application id, e.g. `com.netflix.mediaclient`.

## Query parameters

- `search` string, nullable: Optional search term to filter results.
- `is_email` boolean, nullable: true = emails only, false = usernames only, null = both.
- `page` integer: Page number (starts at 1).
- `page_size` integer: Items per page (1-1000, default 100).
- `auto_unlock` boolean: Unlock the locked items of the current page using your points.

## Response `200`

Entries returned successfully.

- PaginatedLeaksResponse
  - `items` LeakDetails[], required: List of leak records for the current page.
    - `id` string, nullable: Unique leak identifier. Only returned when the item is unlocked or the plan includes full access.
    - `url` string, nullable: Source URL where the credentials were found. Redacted for locked items on non-advanced plans.
    - `username` string, nullable: Leaked username or email address. Masked when locked.
    - `username_masked` string, nullable: Partially masked version of the username (e.g. j***@example.com).
    - `password` string, nullable: Leaked password. Only returned when the item is unlocked.
    - `password_strength` integer, nullable: Password strength raw score (integer, 0+). Categories: too_weak (0-2), weak (3-4), medium (5-7), strong (8+).
    - `unlocked` boolean: Whether this item has been unlocked by the current account.
    - `is_email` boolean, nullable: True if the username is an email address, false if it is a plain username.
    - `added_at` string, date-time, nullable: Date when this leak was added to the database.
    - `status` string, nullable: Remediation status of the unlocked leak: new, in_progress, fixed, accepted_risk. Only present for unlocked items.
  - `total` integer, required: Total number of matching leak records.
  - `total_unlocked` integer, required: Number of already-unlocked records in the total results.
  - `page` integer, required: Current page number.
  - `page_size` integer, required: Number of items per page.
  - `blacklisted_value` string, nullable: If a filter value matched a blacklist entry, this field contains the matched value.
  - `auto_unlock_points_consumed` integer, nullable: Number of points consumed by auto-unlock on this request.

## Other responses

- `400`: Pagination too deep (offset > 1,000,000, use the `/export` endpoint).
- `401`: Authentication required, or invalid/expired API key.
- `403`: Account banned, or pending email verification.
- `422`: Invalid Android application id or parameters.
- `429`: Rate limit exceeded. See Retry-After / X-RateLimit-* headers.
- `503`: Search under maintenance, or public API temporarily disabled.

## Changes

- **2026-10-06** `2083d6cb0a44`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/leakradar/apis/leakradar-io-api/changes/search/applications/:package/leaks/get.md)

---

[API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) - [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) - [OpenAPI document](https://skmtc.dev/leakradar/apis/leakradar-io-api/revisions/8dcd4b54cc4a?raw)