RErecordedfuture
Credentials

Search

Find compromised identities across breach data and stealer logs for one or more domains.

post/identity/credentials/search

Request

  • Base URL
    https://api.recordedfuture.com
  • URL
    https://api.recordedfuture.com/identity/credentials/search
  • Auth
    • OAuth 2
      Authorization code: https://id.recordedfuture.com/authorize
      Token URL: https://id.recordedfuture.com/token
    • or API key in header X-RFToken

Request body

organization_idstring
domainsstring[]

A domain or multiple domains to be queried

domain_typesDomainType[]

"Email", "Authorization" or both can be specified in the array

offsetstring

Pagination token from a previous response's next_offset

limitinteger

Maximum number of results to return (up to 1000)

Example request

{
  "organization_id": "uhash:a1b2c3d4",
  "domains": [
    "example-corp.com"
  ],
  "filter": {
    "first_downloaded_gte": "2024-01-01T00:00:00Z",
    "latest_downloaded_gte": "2024-01-01T00:00:00Z",
    "exfiltration_date_gte": "2024-01-01T00:00:00Z",
    "breach_properties": {
      "name": "ExampleCorp Breach 2024",
      "date": "2024-03-15T00:00:00Z"
    },
    "dump_properties": {
      "name": "Collection",
      "date": "2019-01-07T00:00:00Z"
    },
    "authorization_technologies": [
      "SAML"
    ],
    "authorization_protocols": [
      "RDP"
    ],
    "malware_families": [
      "RedLine Stealer"
    ]
  },
  "offset": "cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="
}

Response

Success

countinteger
count_relationstring
next_offsetstring

Example response

{
  "count_relation": "gte",
  "identities": [
    "jane.doe@example-corp.com"
  ],
  "next_offset": "cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="
}

Changes

No recorded changes to this operation across all 1 revision of this API.