---
title: "Search raw leak blocks"
method: POST
path: "/search/raw"
tags: ["Raw Search"]
---

# Search raw leak blocks

`POST /search/raw`

Perform a full-text search across raw leak blocks. Provide the search payload in the JSON body.

**Request body**

- `q`: Optional search string (minimum 4 characters once quotes are removed).
- `container_id`: Optional container identifier.
- `exts` / `exts_not`: File extensions to include / exclude.
- `categories` / `categories_not`: Raw file categories to include / exclude.
- `file_name` / `file_name_not`: Wildcard on `entry_name` (max 50 items, min 4 chars each).
- `file_name_exact`: Match `file_name` values against the whole entry name instead of a substring.
- `folder_name` / `folder_name_not`: Match on the folder holding the block (max 20 items, min 4 chars each, surrounding slashes ignored). `folder_name_not` is not a standalone selector.
- `folder_name_exact`: Require `folder_name` values to be a whole folder at any depth (`data` matches `a/b/data`, not `a/b/database`) instead of a substring of the folder path.
- `exclude_terms`: Content terms to exclude (substring, case-insensitive, max 20 items, min 4 chars each). Not a standalone selector.
- `force_and`: Apply AND logic within `file_name` and within `folder_name` (default OR).
- `ingested_at_min` / `ingested_at_max`: Datetime range filter (ISO 8601 with timezone).

If `q` is omitted, you must provide at least one filter among `container_id`, `exts`, `categories`, `file_name`, `folder_name`.

**Query parameters**

- `page` starts at 1.
- `page_size` ranges from 1 to 100 (default 10).
- `cursor`: Cursor returned in the previous response to fetch the next page of results.

**Rate limit:** 5 requests per second per user.

**Response:** `{ items, total, page, page_size }`

---

**Limits:**

| Constraint | Value |
|------------|-------|
| Max file name filters | 50 |
| Max folder name filters | 20 |
| Min characters per file / folder name | 4 |
| Max export results | 5 000 |
| Max export files | 25 |
| Download link retention | 7 days |

## Query parameters

- `page` integer — Page number (starts at 1).
- `page_size` integer — Items per page (1–100, default 10).
- `cursor` string, nullable — Cursor from previous response to fetch the next page
- `dedup` boolean — Collapse blocks with identical content (same block_fp64) into a single result. Dedup is per-page: with cursor pagination the same content may resurface on a later page.

## Request body

- RawSearchRequest
  - `q` string, nullable — Optional full text query to match within raw blocks. Quotes are ignored for the length check. When omitted or empty, you must provide at least one filter among container_id, exts, categories, file_name.
  - `container_id` integer, nullable — Restrict the search to a specific container id.
  - `exts` string[], nullable — List of file extensions to include (case-insensitive, without leading dot).
  - `exts_not` string[], nullable — List of file extensions to exclude (case-insensitive, without leading dot).
  - `categories` string[], nullable — Filter results by raw file category. Applied after the search query.
  - `categories_not` string[], nullable — Exclude these raw file categories. Applied after the search query.
  - `file_name` string[], nullable — Case-insensitive wildcards that must match the entry name (OR by default, AND if force_and=true).
  - `file_name_not` string[], nullable — Case-insensitive wildcards that must NOT match the entry name.
  - `folder_name` string[], nullable — Case-insensitive match on the folder holding the block (OR by default, AND if force_and=true). By default the value must appear anywhere in the folder path; with folder_name_exact=true it must be a whole folder at any depth. Leading and trailing slashes are ignored.
  - `folder_name_not` string[], nullable — Folders to exclude, same matching rules as folder_name. Not a standalone selector: a search using only folder_name_not is rejected, provide q or another positive filter.
  - `force_and` boolean, nullable — When true, require all file_name values to match, and all folder_name values to match (AND instead of OR within each list).
  - `file_name_exact` boolean, nullable — When true, file_name / file_name_not match the entry name exactly (case-insensitive) instead of as a 'contains' wildcard.
  - `folder_name_exact` boolean, nullable — When true, folder_name / folder_name_not must match a whole folder at any depth: 'data' matches 'a/b/data' but not 'a/b/database'. A value containing slashes matches a whole run of folders ('b/data' matches 'a/b/data/c'). Without it the value is matched as a substring of the folder path.
  - `q_exact` boolean, nullable — When true, the q term must match on word boundaries: '4.4.4.4' will not match '4.4.4.400'. Applied as a content post-filter (no effect without q).
  - `exclude_terms` string[], nullable — Content terms to exclude: any block whose content contains one of these (substring, case-insensitive) is removed from the results. Min 4 characters per term, max 20 terms. Not a standalone selector: a search using only exclude_terms is rejected, provide q or another positive filter.
  - `ingested_at_min` string, date-time, nullable — Filter results ingested on or after this datetime (inclusive).
  - `ingested_at_max` string, date-time, nullable — Filter results ingested on or before this datetime (inclusive).

## Response `200`

Search executed successfully.

- RawSearchResponse
  - `items` RawSearchItem[], required — List of matching raw blocks.
    - `container_id` string, required — Identifier of the container that stores the raw entry.
    - `entry_path` string, required — Path of the entry inside the container.
    - `entry_name` string, nullable — Base file name extracted from the path, when available.
    - `ext` string, nullable — Detected file extension for the entry.
    - `seq` integer, nullable — Sequential block number within the entry.
    - `offset` integer, nullable — Byte offset of the block within the original file.
    - `ingested_at` string, nullable — ISO timestamp of the ingestion time.
    - `sha256_original` string, nullable — SHA-256 hash of the original raw file, when known.
    - `original_file_name` string, nullable — Name of the source leak file (container) this block comes from.
    - `category` string, nullable — Leak category of the source file: 'stealer-logs', 'database' or 'combolist'.
    - `display_name` string, nullable — Friendly name to show: source file name for flat containers, else the entry name.
    - `snippet` string, nullable — Preview of the matching line, censored when the block is locked.
    - `already_unlocked` boolean — Indicates if the user has already unlocked this block or the parent file.
    - `matching_lines` string[] — Lines from the block content that contain the queried text (export only).
  - `total` integer, required — Total number of results (-1 if using cursor mode).
  - `page` integer, required — Requested page index (1-based).
  - `page_size` integer, required — Maximum number of items returned in this page.
  - `has_more` boolean, nullable — True if more results available (cursor mode only).
  - `next_cursor` string, nullable — Cursor for next page (cursor mode only).
  - `blacklisted_value` string, nullable — If a filter value matched a blacklist entry, this field contains the matched value.

## Other responses

- `400` — Invalid query (too short, too long, or empty with no filters), expired search cursor.
- `401` — Authentication required, or invalid/expired API key.
- `403` — Account banned, or pending email verification.
- `422` — Validation Error
- `429` — Rate limit exceeded (5 req/sec). See Retry-After / X-RateLimit-* headers.
- `500` — Upstream search error.
- `503` — Raw search under maintenance, pagination temporarily unavailable, or public API temporarily disabled.

---

[API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) · [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/leakradar/leakradar-io-api/revisions/82a99c608e1a/schema)