---
title: "Unlock leaks for an email"
method: POST
path: "/search/email/unlock"
tags: ["Search Email"]
---

# Unlock leaks for an email

`POST /search/email/unlock`

## Request

- Base URL: `https://api.leakradar.io`
- URL: `https://api.leakradar.io/search/email/unlock`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/leakradar/apis/leakradar-io-api/docs/search/email/unlock/post.ts> (a function with typed inputs; its response is checked against the schema)

Unlock leaks for the given email or username. Provide the search payload in the JSON body. Use the `max` query parameter to cap how many new leaks to unlock. The effective limit is capped by your available points.

Request body
- `email` the email or username to search.
- `search` optional free-text filter applied to URL or username.
- `is_email` optional boolean: `true` emails only, `false` usernames only, `null` both.

Behavior
- Only previously locked items are unlocked. Already unlocked items are left unchanged.
- Only newly unlocked items consume points.
- If nothing new can be unlocked but matching unlocked items exist, those unlocked items are returned.
- **Hard cap**: synchronous unlocks are limited to 10,000. Use `/search/email/unlock/task` for higher volumes.

Plan requirement
Requires a paid plan with `email_search` enabled.

## Query parameters

- `max` integer, nullable: 0 or omitted = use all your points
- `list_id` integer, nullable: Assign this list id to new unlocks.

## Request body

- EmailSearchRequest
  - `email` string, required: Email or username to search.
  - `search` string, nullable: Optional free-text filter.
  - `is_email` boolean, nullable: Identifier type filter: true=email only, false=username only, null=both.

## Response `200`

Unlocked leaks returned successfully.

- LeakDetails[]
  - `id` string, nullable: Unique leak identifier. Only returned when the item is unlocked or the plan includes full access.
  - `url` string, nullable: Source URL where the credentials were found. Redacted for locked items on non-advanced plans.
  - `username` string, nullable: Leaked username or email address. Masked when locked.
  - `username_masked` string, nullable: Partially masked version of the username (e.g. j***@example.com).
  - `password` string, nullable: Leaked password. Only returned when the item is unlocked.
  - `password_strength` integer, nullable: Password strength raw score (integer, 0+). Categories: too_weak (0-2), weak (3-4), medium (5-7), strong (8+).
  - `unlocked` boolean: Whether this item has been unlocked by the current account.
  - `is_email` boolean, nullable: True if the username is an email address, false if it is a plain username.
  - `added_at` string, date-time, nullable: Date when this leak was added to the database.
  - `status` string, nullable: Remediation status of the unlocked leak: new, in_progress, fixed, accepted_risk. Only present for unlocked items.

## Other responses

- `400`: Insufficient points, no matching data, all items already unlocked, more than 10,000 unlocks (use the /unlock/task endpoint), unlock not needed on your plan.
- `401`: Authentication required, or invalid/expired API key.
- `403`: Email search not available on your plan, this search is blocked, account banned, or pending email verification.
- `404`: The provided list_id does not exist or is not yours.
- `422`: Validation Error
- `429`: Rate limit exceeded (10 req/sec). See Retry-After / X-RateLimit-* headers.
- `503`: Email search under maintenance, or public API temporarily disabled.

---

[API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) - [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) - [OpenAPI document](https://skmtc.dev/leakradar/apis/leakradar-io-api/revisions/8dcd4b54cc4a?raw)