---
title: "Export leaked credentials"
method: POST
path: "/v1/leaks/export"
tags: ["export"]
---

# Export leaked credentials

`POST /v1/leaks/export`

Export leaked credentials with filtering by type, domain, email, date range, and more. Passwords are unmasked after domain verification. See [Domain Verification](/cloud/credential-monitoring#domain-verification) for setup instructions.

## Query parameters

- `format` 'json' | 'csv'

## Headers

- `X-Team-Id` string

## Request body

- object
  - `type` 'all' | 'personal' | 'employee' | 'customer' | 'external_vendor_leaks' | 'organization_leaks' — Filter by specific leak type (single value only)
  - `domain` string — Filter leaks by specific domain (applies to employee/customer leaks)
  - `email` string — Filter leaks by specific email (can be personal, employee, or customer email from user's authorized results)
  - `search` string — Search query to filter results across all fields
  - `limit` number — Number of results per page for pagination
  - `page_number` number — Page number for pagination (starts from 1)
  - `start_date` string, date — time filter start date
  - `time_range` 'all_time' | 'current_month' | 'last_month' | 'last_3_months' | 'last_6_months' | 'last_12_months'
  - `end_date` string, date — time filter end date
  - `sort_by` 'url' | 'username' | 'log_date' | 'country' | 'device_ip' | 'host_username' | 'hostname' | 'os' | 'hardware_id' | 'malware_path' — supported sort fields
  - `sort_order` 'asc' | 'desc' — supported sort order (asc or desc)
  - `status` 'fixed' | 'open' — supported status (fixed or open)
  - `group_by` 'url' | 'country' | 'device_ip' | 'hostname' | 'email' | 'hardware_id' — Group results by field - returns group summaries when used without field-specific filtering
  - `url` string — Filter by specific URL (used with group_by for drill-down)
  - `country` string — Filter by specific country (used with group_by for drill-down)
  - `device_ip` string — Filter by specific device IP (used with group_by for drill-down)
  - `hostname` string — Filter by specific hostname (used with group_by for drill-down)
  - `hardware_id` string — Filter by specific hardware ID (used with group_by for drill-down)

## Response `200`

Export data returned successfully

- object
  - `data` object[]
    - `id` string
    - `url` string
    - `username` string
    - `password` string
    - `device_ip` string
    - `hostname` string
    - `os` string
    - `malware_path` string
    - `country` string
    - `log_date` string
    - `hardware_id` string
    - `domain` string
    - `email_domain` string
    - `url_domain` string
    - `fetched_at` string
    - `status` string
    - `user_type` string — Classification of leak type (personal, employee, customer, external_vendor_leaks, organization_leaks)
  - `total_leaks` number
  - `total_pages` number
  - `total_count` number
  - `summary` object
    - `total_leaks` number
    - `personal_leaks` number
    - `employee_leaks` number
    - `customer_leaks` number
    - `external_vendor_leaks` number — Employee leaks on external vendor systems (login URL domain != email domain)
    - `organization_leaks` number — Employee leaks on organization systems (login URL domain == email domain)
  - `group_summary` object[] — Group summary data when group_by parameter is used

## Other responses

- `400` — Example response
- `401` — Example response
- `403` — Example response
- `404` — Example response
- `500` — Example response
- `default` — Example response

## Changes

- **2026-03-06** `b69f036fb8ff` — 1 info
  - added the new optional `header` request parameter `X-Team-Id`
- **2026-01-15** `5b9dc99a8e6a` — 1 warning
  - deleted the `header` request parameter `X-Team-Id`
- **2025-10-28** `c9df54e2fb2c` — 1 info
  - endpoint added
- **2023-12-05** `5c3748c387f7` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/projectdiscovery/apis/pdcp-api/changes/v1/leaks/export/post.md)

---

[API](https://skmtc.dev/projectdiscovery/apis/pdcp-api.md) · [All operations](https://skmtc.dev/projectdiscovery/apis/pdcp-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/projectdiscovery/pdcp-api/revisions/220f0adf9efd/schema)