---
title: "Search"
method: POST
path: "/identity/credentials/search"
tags: ["Credentials"]
---

# Search

`POST /identity/credentials/search`

## Request

- Base URL: `https://api.recordedfuture.com`
- URL: `https://api.recordedfuture.com/identity/credentials/search`
- Auth: one of:
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`
  - API key in header `X-RFToken`

Find compromised identities across breach data and stealer logs for one or more domains.

## Request body

- CredentialsSearchRequest
  - `organization_id` string
  - `domains` string[]: A domain or multiple domains to be queried
  - `domain_types` DomainType[]: "Email", "Authorization" or both can be specified in the array
  - `filter` IdentityRequestFilter
    - `first_downloaded_gte` string, date-time: The first date when these credentials were received and indexed by Recorded Future.
    - `latest_downloaded_gte` string, date-time: Latest date when these credentials were received and indexed by Recorded Future. It is not unusual for the same credentials to be exposed multiple times, in data from different dumps and/or logs.
    - `exfiltration_date_gte` string, date-time: The date when data was exfiltrated (stolen) from the victim. Note: Only applicable for malware-based exposures.
    - `properties` PasswordProperty[]: Password property filters
    - `username_properties` UsernameProperty[]
    - `breach_properties` BreachProperties
      - `name` string
      - `date` string, date-time
    - `dump_properties` DumpProperties
      - `name` string
      - `date` string, date-time
    - `authorization_technologies` string[]: Filter results by specific authorization technologies (e.g., SAML, LDAP)
    - `authorization_protocols` string[]
    - `malware_families` string[]: Filter by malware family names
  - `offset` string: Pagination token from a previous response's next_offset
  - `limit` integer: Maximum number of results to return (up to 1000)

## Response `200`

Success

- SearchResponse
  - `count` integer
  - `count_relation` string
  - `identities` SearchResponseIdentity[]
    - union
      - string
      - DomainLoginResponseIdentity
        - `login` string, required
        - `domain` string, required
  - `next_offset` string

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `500`: Internal Server Error
- `default`: Error

---

[API](https://skmtc.dev/recordedfuture/apis/recorded-future-identity-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-identity-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-identity-api/revisions/95e20835fe80?raw)