---
title: "Search dark web mentions"
method: POST
path: "/search/dark-web"
tags: ["Dark Web Search"]
---

# Search dark web mentions

`POST /search/dark-web`

Look for mentions of a company, domain, IP, or email across scraped dark web/forum posts.

**Simple mode**: Use `query` to search across title + content.

**Advanced mode**: Use specific fields (`title`, `content`, `author`, `source_url`) with AND/OR logic.

- Pagination: `page` starts at 1, `page_size` max 100.
- Fields: title, content, author, source, source_ref, target, published_at, ingested_at.

## Query parameters

- `page` integer — Page number (starts at 1).
- `page_size` integer — Items per page (1–100, default 25).
- `sources` string, nullable — Comma-separated list of sources to filter by
- `date_from` string, date-time, nullable — Filter posts published after this date
- `date_to` string, date-time, nullable — Filter posts published before this date
- `sort_by` string — Sort field: ingested_at or published_at
- `sort_order` string — Sort order: asc or desc

## Request body

- DarkWebSearchRequest
  - `query` string, nullable — Global search term (simple mode).
  - `title` string, nullable — Search in title only (advanced mode).
  - `content` string, nullable — Search in content only (advanced mode).
  - `author` string, nullable — Exact author match (advanced mode).
  - `source_url` string, nullable — Source URL contains (advanced mode).
  - `logic` string, nullable — Logic for combining fields: AND or OR.

## Response `200`

Search results (censored on free plans).

- DarkWebSearchResponse
  - `items` DarkWebItem[], required — List of dark web posts for the current page.
    - `id` string, nullable — Unique post identifier.
    - `title` string, nullable — Post title.
    - `content` string, nullable — Post content. May be truncated for long posts.
    - `source` string, nullable — Source identifier (forum/market).
    - `source_name` string, nullable — Human-readable source name.
    - `target` string, nullable — Target entity mentioned in the post.
    - `source_ref` string, nullable — Original reference URL on the source.
    - `author` string, nullable — Post author.
    - `published_at` string, nullable — Original publication date.
    - `ingested_at` string, date-time, nullable — Date when the post was indexed by LeakRadar.
    - `truncated` boolean — Whether the content was truncated due to length.
    - `censored` boolean — Whether sensitive content was censored.
  - `total` integer, required — Total number of matching posts.
  - `page` integer, required — Current page number.
  - `page_size` integer, required — Number of items per page.

## Other responses

- `400` — Pagination limit exceeded (offset + page_size > 10,000).
- `401` — Authentication required, or invalid/expired API key.
- `403` — Source filtering or source_url search requires a paid plan with dark web access; account banned, or pending email verification.
- `422` — Validation error in search parameters.
- `429` — Rate limit exceeded. See Retry-After / X-RateLimit-* headers.
- `503` — Dark web index unavailable, under maintenance, or public API temporarily disabled.

---

[API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) · [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/leakradar/leakradar-io-api/revisions/82a99c608e1a/schema)