Get all leaked credentials - ProjectDiscovery Documentation

This is the new consolidated leaks endpoint that replaces the deprecated individual endpoints (/v1/leaks/domain, /v1/leaks/email, /v1/leaks/domain/customers).It returns all types of leaks (personal, employee, customer) with optional filtering by type.

Overview

The consolidated leaks endpoint provides access to all leaked credentials associated with your account:

Personal leaks: Leaks associated with your personal email address
Employee leaks: Leaks from employees of your verified domains, classified as:
- organization_leaks: Leaks on organization systems (login URL domain matches email domain)
- external_vendor_leaks: Leaks on external vendor systems (login URL domain differs from email domain)
Customer leaks: Leaks from customers using your verified domains

Key Features

Advanced Filtering

Filter by leak type (personal, employee, customer, external_vendor_leaks, organization_leaks)
Search across all fields
Filter by domain, email, status, and date ranges
Sort by various fields (URL, username, log_date, country, etc.)

Grouping & Analytics

Use the group_by parameter to get aggregated data:

Group by URL, country, device_ip, hostname, email, or hardware_id
Returns group summaries instead of individual leak records
Perfect for analytics and reporting

Pagination

Standard pagination with limit and page_number parameters
Default limit: 20 results per page

Response Structure

Individual Leaks Response

{
  "data": [
    {
      "id": "leak_id_hash",
      "url": "https://example.com",
      "username": "[email protected]",
      "password": "masked_or_unmasked",
      "device_ip": "192.168.1.1",
      "hostname": "DESKTOP-ABC123",
      "os": "Windows 10",
      "country": "United States",
      "log_date": "2023-01-15",
      "hardware_id": "hw_12345",
      "domain": "example.com",
      "email_domain": "example.com",
      "url_domain": "example.com",
      "status": "open",
      "user_type": "employee"
    }
  ],
  "total_leaks": 150,
  "total_pages": 8,
  "total_count": 150,
  "summary": {
    "total_leaks": 150,
    "personal_leaks": 25,
    "employee_leaks": 100,
    "customer_leaks": 25,
    "external_vendor_leaks": 60,
    "organization_leaks": 40
  }
}

Grouped Response (when using `group_by`)

{
  "group_summary": [
    {
      "url": "https://facebook.com",
      "count": 45
    },
    {
      "url": "https://linkedin.com", 
      "count": 32
    }
  ],
  "total_leaks": 150
}

Privacy & Security

Access Control

Personal leaks: Always accessible to the authenticated user
Employee/Customer leaks: Requires domain verification
Password unmasking: Requires domain verification

Data Classification

The API automatically classifies employee leaks:

Organization leaks: Login URL domain matches or is a subdomain of the email domain
External vendor leaks: Login URL domain is completely different from email domain

Migration from Deprecated Endpoints

If you’re currently using the deprecated endpoints, here’s how to migrate:

Deprecated Endpoint	New Equivalent
`GET /v1/leaks/email`	`GET /v1/leaks?type=personal`
`GET /v1/leaks/domain`	`GET /v1/leaks?type=employee`
`GET /v1/leaks/domain/customers`	`GET /v1/leaks?type=customer`

Examples

Get all leaks

curl -X GET "https://api.projectdiscovery.io/v1/leaks" \
  -H "Authorization: Bearer YOUR_API_KEY"

Get only employee leaks

curl -X GET "https://api.projectdiscovery.io/v1/leaks?type=employee" \
  -H "Authorization: Bearer YOUR_API_KEY"

Get leaks grouped by URL

curl -X GET "https://api.projectdiscovery.io/v1/leaks?group_by=url" \
  -H "Authorization: Bearer YOUR_API_KEY"

Search for specific domain

curl -X GET "https://api.projectdiscovery.io/v1/leaks?domain=example.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

Authorizations

X-API-Key

string

header

required

Query Parameters

type

enum<string>

default:all

Filter by specific leak type (single value only)

Available options:

all,

personal,

employee,

customer,

external_vendor_leaks,

organization_leaks

domain

string

Filter leaks by specific domain (applies to employee/customer leaks)

string

Filter leaks by specific email (can be personal, employee, or customer email from user's authorized results)

string

Search query to filter results across all fields

limit

number

Number of results per page for pagination

page_number

number

Page number for pagination (starts from 1)

start_date

string<date>

time filter start date

time_range

enum<string>

default:all_time

Available options:

all_time,

current_month,

last_month,

last_3_months,

last_6_months,

last_12_months

end_date

string<date>

time filter end date

sort_by

enum<string>

supported sort fields

Available options:

url,

username,

log_date,

country,

device_ip,

host_username,

hostname,

os,

hardware_id,

malware_path

sort_order

enum<string>

supported sort order (asc or desc)

Available options:

asc,

desc

status

enum<string>

supported status (fixed or open)

Available options:

fixed,

open

group_by

enum<string>

Group results by field - returns group summaries when used without field-specific filtering

Available options:

url,

country,

device_ip,

hostname,

email,

hardware_id

url

string

Filter by specific URL (used with group_by for drill-down)

country

string

Filter by specific country (used with group_by for drill-down)

device_ip

string

Filter by specific device IP (used with group_by for drill-down)

hostname

string

Filter by specific hostname (used with group_by for drill-down)

hardware_id

string

Filter by specific hardware ID (used with group_by for drill-down)

Response

data

object[]

Show child attributes

data.id

string

data.url

string

data.username

string

data.password

string

data.device_ip

string

data.hostname

string

data.os

string

data.malware_path

string

data.country

string

data.log_date

string

data.hardware_id

string

data.domain

string

data.email_domain

string

data.url_domain

string

data.fetched_at

string

data.status

string

data.user_type

string

Classification of leak type (personal, employee, customer, external_vendor_leaks, organization_leaks)

total_leaks

number

total_pages

number

total_count

number

summary

object

Show child attributes

summary.total_leaks

number

summary.personal_leaks

number

summary.employee_leaks

number

summary.customer_leaks

number

summary.external_vendor_leaks

number

Employee leaks on external vendor systems (login URL domain != email domain)

summary.organization_leaks

number

Employee leaks on organization systems (login URL domain == email domain)

group_summary

object[]

Group summary data when group_by parameter is used

API Reference

​Overview

​Key Features

​Advanced Filtering

​Grouping & Analytics

​Pagination

​Response Structure

​Individual Leaks Response

​Grouped Response (when using group_by)

​Privacy & Security

​Access Control

​Data Classification

​Migration from Deprecated Endpoints

​Examples

​Get all leaks

​Get only employee leaks

​Get leaks grouped by URL

​Search for specific domain

Authorizations

Query Parameters

Response

Overview

Key Features

Advanced Filtering

Grouping & Analytics

Pagination

Response Structure

Individual Leaks Response

Grouped Response (when using `group_by`)

Privacy & Security

Access Control

Data Classification

Migration from Deprecated Endpoints

Examples

Get all leaks

Get only employee leaks

Get leaks grouped by URL

Search for specific domain