Query the index
from your code

Search records

The core endpoint. Returns a page of records matching your filters. Fields you have not paid to reveal come back masked (▇▇▇▇) together with per-field reveal prices.

Parameters

Request

curl -X POST /secure/api/search \
  -H "X-API-KEY: $KEY" -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "full_domain": "accounts.google.com",
      "!domain_tld": ["cn"],
      "adddate_text": {"gte": "2026-09-01"}
    },
    "page_size": 3,
    "page_number": 1,
    "exclude_unknown_sources": false
  }' 

Response 200

{
  "count": 10000,
  "count_capped": true,
  "limit": 10000,
  "results": [
    {
      "adddate": "2026-09-07T19:43:28",
      "recordhash": "014012e391bf",
      "recordhash_full": "014012e391bfcd64a493adf9ffe110f2…",
      "url": "https://accounts.google.com/*********************",
      "username": "▇▇▇▇▇▇▇▇",
      "password": "▇▇▇▇▇▇▇▇",
      "logpath": "8BF0E7D63802E9AD4893C6FA6262EE3A",
      "soft": "0",
      "stealer_family": "Raccoon v2",
      "stealerid": 5,
      "reveal_price": {"username": 20, "password": 10, "url": 40}
    }
  ],
  "page_size": 3,
  "offset": 0,
  "searchtime": 0.03,
  "tokens_spent": 4,
  "token_balance": 49996
}

• Fields outside your permission tier are null.
• count is exact up to limit (default/max 10000); count_capped=true means the query matched more than that — refine filters for precision.
• CSV export: add ?download_csv=true and send form field data with the same JSON (billing: 1 token/row).

Reveal record fields

Pay tokens to unmask specific fields of specific records (by recordhash_full). A revealed record stays open for your account forever — no double-charging.

Parameters

Request

curl -X POST /secure/api/reveal \
  -H "X-API-KEY: $KEY" -H "Content-Type: application/json" \
  -d '{
    "requests": [
      {"recordhash": "014012e391bfcd64…ac6", "field": "username"},
      {"recordhash": "014012e391bfcd64…ac6", "field": "password"}
    ]
  }' 

Response 200

{
  "revealed": {
    "014012e391bfcd64…ac6": {
      "username": "[email protected]",
      "password": "Hunter2summer"
    }
  },
  "spent": 26,
  "balance": 49970,
  "errors": []
}

• Already-revealed fields are returned for free and not charged again.
• Requests for fields outside your tier are filtered out.
• On insufficient balance nothing is charged and an error is returned.

Estimate export cost

Calculate how many tokens opening all hidden fields in an export would cost — before spending anything.

Parameters

Request

curl -X POST /secure/api/export_estimate \
  -H "X-API-KEY: $KEY" -H "Content-Type: application/json" \
  -d '{"filters": {"full_domain": "accounts.google.com"}}' 

Response 200

{
  "records": 10000,
  "hidden_fields": {"password": 9132, "url": 10000, "username": 9715},
  "tokens_to_open": 746700,
  "tokens_available": 999517,
  "enough": true
}

Filter value suggestions

Autocomplete helper: returns the most frequent values for a filter field that also match the current filters.

Parameters

Request

curl -X POST /secure/api/filters_help \
  -H "X-API-KEY: $KEY" -H "Content-Type: application/json" \
  -d '{"search": "goo", "filters": {"domain_tld": "com"}}' 

Response 200

[
  {"key": "accounts.google.com", "doc_count": 48122},
  {"key": "google.com", "doc_count": 21018},
  {"key": "docs.google.com", "doc_count": 9107}
]

Saved searches

Persist and list reusable queries. The console saves automatically — the same store is available via API.

Parameters

Request

# save
curl -X POST /secure/api/saved_searches \
  -H "X-API-KEY: $KEY" -H "Content-Type: application/json" \
  -d '{"filters": {"full_domain": "example.com"}, "page_size": 100, "page_number": 1}'

# list
curl /secure/api/saved_searches -H "X-API-KEY: $KEY"

Response 200

[
  {"id": 12, "filters": {"full_domain": "example.com"},
   "page_size": 100, "page_number": 1, "created_at": "2026-09-13T19:40:41Z"}
]

• Single item: GET/DELETE /secure/api/saved_searches/<id>.

Delete a record

Removes a document from the index by id. Admin permission (delrec) required.

Parameters

Request

curl -X POST /secure/api/delrecord \
  -H "X-API-KEY: $ADMIN_KEY" -H "Content-Type: application/json" \
  -d '{"id": "014012e391bfcd64a493adf9ffe110f2…"}' 

Response 200

{
  "msg": "Document 014012e3… deleted. success:4, failed:0"
}

• The id is returned in search results as id for admin-tier keys.