The session cookies stolen from a machine, one page at a time
Every cookie of the machine, deduplicated, cut and counted in the database, with no cap (a log can hold more than a million). Paginated, in the order the sheet sorts them (host, name, browser); total_pages is at least 1, past the last page items is empty. Same access rule, anchor (hash, optional) and masking as the sheet GET /machines/{machine_hash}; the generated_at of a rubric read from the cached sheet is the build of that sheet, and two calls that answer the same one answer the same page. live keeps the cookies with a known expiry still to come at the instant of the call (the sheet's kpis.cookies.live), or the others; session the cookies a browser keeps for the session only, or the others; domain one root domain; host one cookie host (exact, e.g. .example.com). A cookie's value is never returned: has_secret and an opaque secret_id only. Never returns a secret (a cookie value, a Windows password, a card number), never the source of a log for an API key, and never a password of a third party. Every call is written to the access journal as machine.read. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.
Authorization
ApiKeyAuth API key for authentication
In: header
Path Parameters
The machine: any of its logs, as machine_hash of the list says (32 hex characters, any case).
^[0-9a-fA-F]{32}$Query Parameters
Optional: a credential of the tenant that is on this machine (32 hex characters, any case). Without it the server takes the smallest credential of the tenant on the machine itself and checks it exactly the same way; the machine is then open to the same people. With it, that credential is checked instead and anchors the machine: a credential that is not in the perimeter, or not on this machine, is refused (404) with no fallback to another.
Page number, from 1. Past the last page items is empty.
11 <= value <= 1000000Rows per page, 200 at most.
501 <= value <= 200True: expiry still to come; False: no such expiry.
True: session cookies only; False: the others.
Exact root domain, case-insensitive.
Exact cookie host, case-insensitive.
Response Body
application/json
curl -X GET "https://api.stealed.io/api/v1/machines/string/cookies"{
"total": 0,
"page": 0,
"page_size": 0,
"total_pages": 0,
"generated_at": "string",
"items": [
{
"host": "string",
"root_domain": "string",
"name": "string",
"path": "string",
"browser": "string",
"is_secure": true,
"is_session": true,
"expires_at": "string",
"expired": true,
"on_your_domains": true,
"has_secret": true,
"secret_id": "string",
"copies": 0,
"machine_hash": "string"
}
]
}The credentials found on a machine, one page at a time GET
Every credential linked to the machine that has a card (site, user, dates), cut and counted in the database, with no cap. Paginated, in the order the sheet sorts them (host, user, hash); `total_pages` is at least 1, past the last page `items` is empty. Same access rule, anchor (`hash`, optional) and masking as the sheet `GET /machines/{machine_hash}`; the `generated_at` of a rubric read from the cached sheet is the build of that sheet, and two calls that answer the same one answer the same page. `on_your_domains` and `root_is_yours` keep the credentials that are, or are not, on the client's domains (the latter: the site's own root domain is the client's); `host` keeps one site. A credential on the client's domains shows its password fingerprint only, never the password. Never returns a secret (a cookie value, a Windows password, a card number), never the source of a log for an API key, and never a password of a third party. Every call is written to the access journal as `machine.read`. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.
The access tokens stolen from a machine GET
The tokens (JWT, OAuth, API keys of applications) found on the machine, by kind and label. Paginated, in the order the sheet sorts them (the client's own first, then kind, label); `total_pages` is at least 1, past the last page `items` is empty. Same access rule, anchor (`hash`, optional) and masking as the sheet `GET /machines/{machine_hash}`; the `generated_at` of a rubric read from the cached sheet is the build of that sheet, and two calls that answer the same one answer the same page. The token itself is never returned: kind, label, application and domain only. Never returns a secret (a cookie value, a Windows password, a card number), never the source of a log for an API key, and never a password of a third party. Every call is written to the access journal as `machine.read`. An API key's call is counted against the daily and monthly quota of its workspace, refusals included.