---
title: "Unlock the entries of an Android app"
method: POST
path: "/search/applications/{package}/unlock"
tags: ["Search Applications"]
---

# Unlock the entries of an Android app

`POST /search/applications/{package}/unlock`

## Request

- Base URL: `https://api.leakradar.io`
- URL: `https://api.leakradar.io/search/applications/{package}/unlock`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/leakradar/apis/leakradar-io-api/docs/search/applications/:package/unlock/post.ts> (a function with typed inputs; its response is checked against the schema)

Unlock the locked entries of an Android app, newest first. `max` caps how many new entries are unlocked; the effective limit is also capped by your available points.

- Only locked items are unlocked and only they consume points.
- Synchronous unlocks are limited to 10,000: use `/search/applications/{package}/unlock/task` above.
- Requires a paid plan with `domain_search` enabled.

## Path parameters

- `package` string, required: Android application id, e.g. `com.netflix.mediaclient`.

## Query parameters

- `search` string, nullable: Optional search term to filter results.
- `is_email` boolean, nullable: true = emails only, false = usernames only, null = both.
- `max` integer, nullable: Maximum number of entries to unlock.
- `list_id` integer, nullable: Assign this list id to new unlocks.

## Response `200`

Unlocked entries returned successfully.

- LeakDetails[]
  - `id` string, nullable: Unique leak identifier. Only returned when the item is unlocked or the plan includes full access.
  - `url` string, nullable: Source URL where the credentials were found. Redacted for locked items on non-advanced plans.
  - `username` string, nullable: Leaked username or email address. Masked when locked.
  - `username_masked` string, nullable: Partially masked version of the username (e.g. j***@example.com).
  - `password` string, nullable: Leaked password. Only returned when the item is unlocked.
  - `password_strength` integer, nullable: Password strength raw score (integer, 0+). Categories: too_weak (0-2), weak (3-4), medium (5-7), strong (8+).
  - `unlocked` boolean: Whether this item has been unlocked by the current account.
  - `is_email` boolean, nullable: True if the username is an email address, false if it is a plain username.
  - `added_at` string, date-time, nullable: Date when this leak was added to the database.
  - `status` string, nullable: Remediation status of the unlocked leak: new, in_progress, fixed, accepted_risk. Only present for unlocked items.

## Other responses

- `400`: Insufficient points, no matching data, all items already unlocked, more than 10,000 unlocks, or unlock not needed on your plan.
- `401`: Authentication required, or invalid/expired API key.
- `403`: Not available on your plan, application blocked, account banned, or pending email verification.
- `404`: The provided list_id does not exist or is not yours.
- `422`: Invalid Android application id or parameters.
- `429`: Rate limit exceeded. See Retry-After / X-RateLimit-* headers.
- `503`: Search under maintenance, or public API temporarily disabled.

## Changes

- **2026-10-06** `2083d6cb0a44`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/leakradar/apis/leakradar-io-api/changes/search/applications/:package/unlock/post.md)

---

[API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) - [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) - [OpenAPI document](https://skmtc.dev/leakradar/apis/leakradar-io-api/revisions/8dcd4b54cc4a?raw)