---
title: "Search leaks by email or username"
method: POST
path: "/search/email"
tags: ["Search Email"]
---

# Search leaks by email or username

`POST /search/email`

Search for leaks associated with a specific email or username. Provide the search payload in the JSON body.

Pagination
- `page` starts at 1.
- `page_size` is 1 to 100 (default 100).

Access and visibility
- If your plan includes `email_search`, full URLs and item IDs are returned.
- Otherwise URLs are redacted except for the first 10 items per page and IDs are omitted.
- Credentials are returned only when `unlocked=true` and your plan includes `email_search`.

Auto-unlock
Pass `auto_unlock=true` to automatically unlock locked items on the current page. Points are consumed per newly unlocked item. If insufficient points, partial unlock is performed. The response field `auto_unlock_points_consumed` indicates how many points were used.

Response
`EmailSearchResponse` with `items`, `total`, `total_unlocked`, `page`, `page_size`.

Special case: if `email` is a full SHA-1 (40 hex chars, no '@'), search is done on username_hash exactly.

## Query parameters

- `page` integer — Page number (starts at 1).
- `page_size` integer — Items per page (1–100, default 100).
- `auto_unlock` boolean — Automatically unlock locked items on the current page using your points.

## Request body

- EmailSearchRequest
  - `email` string, required — Email or username to search.
  - `search` string, nullable — Optional free-text filter.
  - `is_email` boolean, nullable — Identifier type filter: true=email only, false=username only, null=both.

## Response `200`

Search results successfully returned.

- EmailSearchResponse
  - `items` LeakDetails[], required — List of leak records for the current page.
    - `id` string, nullable — Unique leak identifier. Only returned when the item is unlocked or the plan includes full access.
    - `url` string, nullable — Source URL where the credentials were found. Redacted for locked items on non-advanced plans.
    - `username` string, nullable — Leaked username or email address. Masked when locked.
    - `username_masked` string, nullable — Partially masked version of the username (e.g. j***@example.com).
    - `password` string, nullable — Leaked password. Only returned when the item is unlocked.
    - `password_strength` integer, nullable — Password strength raw score (integer, 0+). Categories: too_weak (0-2), weak (3-4), medium (5-7), strong (8+).
    - `unlocked` boolean — Whether this item has been unlocked by the current account.
    - `is_email` boolean, nullable — True if the username is an email address, false if it is a plain username.
    - `added_at` string, date-time, nullable — Date when this leak was added to the database.
    - `status` string, nullable — Remediation status of the unlocked leak: new, in_progress, fixed, accepted_risk. Only present for unlocked items.
  - `total` integer, required — Total number of matching leak records.
  - `total_unlocked` integer, required — Number of already-unlocked records in the total results.
  - `page` integer, required — Current page number.
  - `page_size` integer, required — Number of items per page.
  - `blacklisted_value` string, nullable — If a filter value matched a blacklist entry, this field contains the matched value.
  - `auto_unlock_points_consumed` integer, nullable — Number of points consumed by auto-unlock on this request.

## Other responses

- `401` — Authentication required, or invalid/expired API key.
- `403` — Account banned, or pending email verification.
- `422` — Validation error.
- `429` — Rate limit exceeded. See Retry-After / X-RateLimit-* headers.
- `503` — Email search under maintenance, or public API temporarily disabled.

---

[API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) · [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/leakradar/leakradar-io-api/revisions/82a99c608e1a/schema)