--- title: "List leaks for third parties of a domain" method: GET path: "/search/domain/{domain}/third_parties" tags: ["Search Domain"] --- # List leaks for third parties of a domain `GET /search/domain/{domain}/third_parties` ## Request - Base URL: `https://api.leakradar.io` - URL: `https://api.leakradar.io/search/domain/{domain}/third_parties` - Auth: HTTP bearer - TypeScript: (a function with typed inputs; its response is checked against the schema) Return a paginated list of leaks linked to third parties of the given domain. **Query parameters** - `page` starts at 1. - `page_size` is 1 to 1000 (default 100). - `search` optional term to narrow results. - `is_email` optional boolean to filter emails (true), usernames (false), or both (null). **Access and visibility** - If your plan includes `domain_search`, full URLs and item IDs are returned. - Otherwise URLs are redacted except for the first 10 items per page and IDs are omitted. - Credentials are included only for items with `unlocked=true` and if your plan includes `domain_search`. **Response** `PaginatedLeaksResponse` with `items`, `total`, `total_unlocked`, `page`, `page_size`. **Auto-unlock** Pass `auto_unlock=true` to automatically unlock locked items on the current page. Points are consumed per newly unlocked item. If insufficient points, partial unlock is performed. The response field `auto_unlock_points_consumed` indicates how many points were used. ## Path parameters - `domain` string, required: Domain whose third-party leaks to list, e.g. `example.com`. ## Query parameters - `page` integer: Page number (starts at 1). - `page_size` integer: Items per page (1–1000, default 100). - `search` string, nullable: Optional search term to filter results. - `is_email` boolean, nullable: Filter by identifier type: true=emails only, false=usernames only, null=both. - `auto_unlock` boolean: Automatically unlock locked items on the current page using your points. ## Response `200` Results returned successfully. - PaginatedLeaksResponse - `items` LeakDetails[], required: List of leak records for the current page. - `id` string, nullable: Unique leak identifier. Only returned when the item is unlocked or the plan includes full access. - `url` string, nullable: Source URL where the credentials were found. Redacted for locked items on non-advanced plans. - `username` string, nullable: Leaked username or email address. Masked when locked. - `username_masked` string, nullable: Partially masked version of the username (e.g. j***@example.com). - `password` string, nullable: Leaked password. Only returned when the item is unlocked. - `password_strength` integer, nullable: Password strength raw score (integer, 0+). Categories: too_weak (0-2), weak (3-4), medium (5-7), strong (8+). - `unlocked` boolean: Whether this item has been unlocked by the current account. - `is_email` boolean, nullable: True if the username is an email address, false if it is a plain username. - `added_at` string, date-time, nullable: Date when this leak was added to the database. - `status` string, nullable: Remediation status of the unlocked leak: new, in_progress, fixed, accepted_risk. Only present for unlocked items. - `total` integer, required: Total number of matching leak records. - `total_unlocked` integer, required: Number of already-unlocked records in the total results. - `page` integer, required: Current page number. - `page_size` integer, required: Number of items per page. - `blacklisted_value` string, nullable: If a filter value matched a blacklist entry, this field contains the matched value. - `auto_unlock_points_consumed` integer, nullable: Number of points consumed by auto-unlock on this request. ## Other responses - `400`: Pagination too deep (offset > 1,000,000 — use the matching `/export` endpoint). - `401`: Authentication required, or invalid/expired API key. - `403`: Account banned, or pending email verification. - `422`: Validation Error - `429`: Rate limit exceeded. Response includes `Retry-After`, `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` headers. - `503`: Domain search under maintenance, or public API temporarily disabled. ## Changes - **2026-09-01** `82a99c608e1a`: 5 breaking, 12 info - the response property `items/items/id` became optional for the status `200` - the response property `items/items/is_email` became optional for the status `200` - the response property `items/items/password` became optional for the status `200` - the response property `items/items/url` became optional for the status `200` - …13 more - **2025-06-07** `00e5aabba957`: 1 info - added the new optional `query` request parameter `is_email` - **2025-05-26** `033a9f3cacd1`: 2 breaking, 1 info - the response property `items/items/password_strength` became optional for the status `200` - response property `items/items/password_strength` list-of-types was widened by adding types `null` to media type `application/json` of response `200` - the `password_strength` response's property default value `0` was added for the status `200` - **2025-05-10** `7d4c71f01e30`: 1 info - added the optional property `items/items/added_at` to the response with the `200` status - **2025-04-24** `db95897b513a`: 2 breaking, 2 warning, 2 info - response property `items/items/id` list-of-types was widened by adding types `string` to media type `application/json` of response `200` - the `items/items/id/anyOf[subschema #1]/` response's property type changed from `integer` to `string` for status `200` - deleted the `query` request parameter `show_only_locked` - deleted the `query` request parameter `show_only_unlocked` - …2 more [Operation history](https://skmtc.dev/leakradar/apis/leakradar-io-api/changes/search/domain/:domain/third_parties/get.md) --- [API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) - [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) - [OpenAPI document](https://skmtc.dev/leakradar/apis/leakradar-io-api/revisions/8dcd4b54cc4a?raw)