LEleakradar
Raw Search

Search raw leak blocks

Changed on

Perform a full-text search across raw leak blocks. Provide the search payload in the JSON body.

Request body

  • q: Optional search string (minimum 4 characters once quotes are removed).
  • container_id: Optional container identifier.
  • exts / exts_not: File extensions to include / exclude.
  • categories / categories_not: Raw file categories to include / exclude.
  • file_name / file_name_not: Match on entry_name (max 50 items, min 4 chars each).
  • file_name_match_type / file_name_not_match_type: How each list is matched, one mode per list: contains (default), starts_with, ends_with or exact (the whole entry name).
  • folder_name / folder_name_not: Match on the folder holding the block (max 20 items, min 4 chars each, surrounding slashes ignored). folder_name_not is not a standalone selector.
  • folder_name_match_type / folder_name_not_match_type: contains (default, substring of the path), starts_with (the path begins with the value), ends_with (the path ends with the value) or exact (a whole folder at any depth: data matches a/b/data, not a/b/database).
  • file_name_exact / folder_name_exact: Deprecated. true means exact on both the include and the exclude list when no match type is given.
  • include_terms: Extra content terms that must ALL be present, on top of q (substring, case-insensitive, max 20 items, 4 to 256 chars each). This is the AND: q=acme.com with include_terms=["admin", "vpn"] keeps only the blocks holding the three of them. Unlike exclude_terms it is a positive selector, so it works without q.
  • exclude_terms: Content terms to exclude (substring, case-insensitive, max 20 items, min 4 chars each). Not a standalone selector.
  • force_and: Apply AND logic within file_name and within folder_name (default OR).
  • ingested_at_min / ingested_at_max: Datetime range filter (ISO 8601 with timezone).

If q is omitted, you must provide at least one filter among container_id, exts, categories, file_name, folder_name.

Query parameters

  • page starts at 1.
  • page_size ranges from 1 to 100 (default 10).
  • cursor: Cursor returned in the previous response to fetch the next page of results.

Rate limit: 5 requests per second per user.

Response: { items, total, page, page_size }

Limits:

ConstraintValue
Max file name filters50
Max folder name filters20
Min characters per file / folder name4
Max export results5 000
Max export files25
Download link retention7 days
post/search/raw

Request

Query parameters

pageinteger

Page number (starts at 1).

page_sizeinteger

Items per page (1–100, default 10).

cursorstring nullable

Cursor from previous response to fetch the next page

dedupboolean

Collapse blocks with identical content (same block_fp64) into a single result. Dedup is per-page: with cursor pagination the same content may resurface on a later page.

Request body

qstring nullable

Optional full text query to match within raw blocks. Quotes are ignored for the length check. When omitted or empty, you must provide at least one filter among container_id, exts, categories, file_name.

container_idinteger nullable

Restrict the search to a specific container id.

extsstring[] nullable

List of file extensions to include (case-insensitive, without leading dot).

exts_notstring[] nullable

List of file extensions to exclude (case-insensitive, without leading dot).

categoriesstring[] nullable

Filter results by raw file category. Applied after the search query.

categories_notstring[] nullable

Exclude these raw file categories. Applied after the search query.

file_namestring[] nullable

Case-insensitive wildcards that must match the entry name (OR by default, AND if force_and=true).

file_name_notstring[] nullable

Case-insensitive wildcards that must NOT match the entry name.

folder_namestring[] nullable

Case-insensitive match on the folder holding the block (OR by default, AND if force_and=true). By default the value must appear anywhere in the folder path; with folder_name_exact=true it must be a whole folder at any depth. Leading and trailing slashes are ignored.

folder_name_notstring[] nullable

Folders to exclude, same matching rules as folder_name. Not a standalone selector: a search using only folder_name_not is rejected, provide q or another positive filter.

force_andboolean nullable

When true, require all file_name values to match, and all folder_name values to match (AND instead of OR within each list).

file_name_match_type'contains' | 'starts_with' | 'ends_with' | 'exact'

How a raw file-name or folder value is matched.

Separate from AdvancedTextMatchType on purpose: raw has an EXACT mode the stealer fields do not, and adding it there would widen a contract that seven surfaces already depend on.

file_name_not_match_type'contains' | 'starts_with' | 'ends_with' | 'exact'

How a raw file-name or folder value is matched.

Separate from AdvancedTextMatchType on purpose: raw has an EXACT mode the stealer fields do not, and adding it there would widen a contract that seven surfaces already depend on.

folder_name_match_type'contains' | 'starts_with' | 'ends_with' | 'exact'

How a raw file-name or folder value is matched.

Separate from AdvancedTextMatchType on purpose: raw has an EXACT mode the stealer fields do not, and adding it there would widen a contract that seven surfaces already depend on.

folder_name_not_match_type'contains' | 'starts_with' | 'ends_with' | 'exact'

How a raw file-name or folder value is matched.

Separate from AdvancedTextMatchType on purpose: raw has an EXACT mode the stealer fields do not, and adding it there would widen a contract that seven surfaces already depend on.

file_name_exactboolean nullable

Deprecated, use file_name_match_type and file_name_not_match_type. When true and neither is given, both file_name and file_name_not are matched as exact.

folder_name_exactboolean nullable

Deprecated, use folder_name_match_type and folder_name_not_match_type. When true and neither is given, both folder_name and folder_name_not are matched as exact.

q_exactboolean nullable

When true, the q term must match on word boundaries: '4.4.4.4' will not match '4.4.4.400'. Applied as a content post-filter (no effect without q).

include_termsstring[] nullable

Extra content terms that must ALL be present, on top of q: a block is kept only if its content contains q AND every term listed here (substring, case-insensitive). Min 4 characters per term, max 20 terms. Unlike exclude_terms this IS a positive selector, so it can be used without q.

exclude_termsstring[] nullable

Content terms to exclude: any block whose content contains one of these (substring, case-insensitive) is removed from the results. Min 4 characters per term, max 20 terms. Not a standalone selector: a search using only exclude_terms is rejected, provide q or another positive filter.

ingested_at_minstring date-time nullable

Filter results ingested on or after this datetime (inclusive).

ingested_at_maxstring date-time nullable

Filter results ingested on or before this datetime (inclusive).

Example request

{
  "q": "example.com"
}

Response

Search executed successfully.

totalinteger required

Total number of results (-1 if using cursor mode).

pageinteger required

Requested page index (1-based).

page_sizeinteger required

Maximum number of items returned in this page.

has_moreboolean nullable

True if more results available (cursor mode only).

next_cursorstring nullable

Cursor for next page (cursor mode only).

blacklisted_valuestring nullable

If a filter value matched a blacklist entry, this field contains the matched value.

Changes

  • 2a4d24c5f38dRevision changes
    • info

      added the new optional request property

  • eb219e94d077Revision changes
    • info

      added the new optional request property

    • info

      added the new optional request property

    • info

      added the new optional request property

    • info

      added the new optional request property