---
title: "Unlock selected leaks by ID"
method: POST
path: "/unlock"
tags: ["Unlock"]
---

# Unlock selected leaks by ID

`POST /unlock`

Unlock leaks by their IDs for the authenticated account if they have enough points.

**Request body**
- `leak_ids` array of leak IDs to unlock (max 10,000). Duplicates are ignored while preserving order.

**Behavior**
- Requires an active paid subscription.
- 1 point per leak. Points are charged up front and partially refunded if some items were already unlocked during processing.
- Only found leaks are processed. If none are found, the request fails.
- The response reflects the final unlocked state from the account-level index.

**Visibility**
- `id` is included only for paid users.
- Credentials are included only for items with `unlocked=true`.

**Errors**
- 400 No leak IDs provided, too many leak IDs, insufficient points, or all selected data already unlocked.
- 401 Unauthorized.
- 403 Forbidden: subscription does not allow unlocking.
- 404 The provided target_list_id does not exist.
- 410 The selected data is no longer available (refresh your search).
- 422 Validation error.
- 500 Billing or indexation error while unlocking.

## Request body

- UnlockRequest
  - `leak_ids` string[], required — List of leak document IDs to unlock.
  - `target_list_id` integer, nullable — Optional list id to assign to newly unlocked items.

## Response `200`

Selected leaks successfully unlocked.

- LeakDetails[]
  - `id` string, nullable — Unique leak identifier. Only returned when the item is unlocked or the plan includes full access.
  - `url` string, nullable — Source URL where the credentials were found. Redacted for locked items on non-advanced plans.
  - `username` string, nullable — Leaked username or email address. Masked when locked.
  - `username_masked` string, nullable — Partially masked version of the username (e.g. j***@example.com).
  - `password` string, nullable — Leaked password. Only returned when the item is unlocked.
  - `password_strength` integer, nullable — Password strength raw score (integer, 0+). Categories: too_weak (0-2), weak (3-4), medium (5-7), strong (8+).
  - `unlocked` boolean — Whether this item has been unlocked by the current account.
  - `is_email` boolean, nullable — True if the username is an email address, false if it is a plain username.
  - `added_at` string, date-time, nullable — Date when this leak was added to the database.
  - `status` string, nullable — Remediation status of the unlocked leak: new, in_progress, fixed, accepted_risk. Only present for unlocked items.

## Other responses

- `400` — No leak IDs provided, too many leak IDs, insufficient points, or all selected data already unlocked.
- `401` — Unauthorized.
- `403` — Forbidden. The user's subscription does not allow unlocking data.
- `404` — The provided target_list_id does not exist or is not yours.
- `410` — The selected data is no longer available (removed during cleanup). Refresh your search results.
- `422` — Validation error.
- `500` — Billing or indexation error while unlocking.

---

[API](https://skmtc.dev/leakradar/apis/leakradar-io-api.md) · [All operations](https://skmtc.dev/leakradar/apis/leakradar-io-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/leakradar/leakradar-io-api/revisions/82a99c608e1a/schema)