Top usernames for a given host (scoped)
For a given host, returns the top usernames found in leaks on that host, restricted to the org's monitored scope.
Authorization
ApiKeyAuth API key for authentication
In: header
Query Parameters
1 <= length <= 320"root_domain" | "email_domain" | "all"Limit result length
Username of the leaked user (can be phone, email, ID, ...)
Type of leak (combo, stealer)
Uniq identifier for the concatenation of : username, password and domain
Upload date on stealed, ISO 8601, pattern YYYY-MM-DD
Upload date on the plateform the credential was found, ISO 8601, pattern YYYY-mm-dd
Log date of the device at compromized moment (if applicable, stealer only)
Start date to search from leaks, format: YYYY-mm-dd (default: today - 14days at 0:00am)
End date to search leaks from, format YYYY-mm-dd (default: today)
FQDN of the leaked data
Local part of the username section (if applicable, email only)
Protocol identified (if applicable)
Email domain to filter on (if multiple email domains declared)
Root domain to filter on (if multiple root domains declared)
Machine ID (if applicable, stealer only)
Computer name (if applicable, stealer only)
Hardware ID (if applicable, stealer only)
Machine user (if applicable, stealer only)
IP address (if applicable, stealer only)
Country (if applicable, stealer only)
Software (if applicable, stealer only)
Stealer name (if applicable)
Opaque source label(s) to filter on, of the form Source-<6 hex> (as returned by the sources breakdown). The raw telegram_channel is never exposed: the label is matched back against the same MD5-prefix expression server-side.
Keyword to filter on (only active keywords for tenant)
Match type for leaks_matched table (root_domain or email_domain)
Root domains to exclude (NOT IN filter)
Email domains to exclude (NOT IN filter)
Domains to exclude (NOT IN filter)
Types to exclude
Software to exclude
Stealer names to exclude
Protocols to exclude
Countries to exclude
Show only hashes whose first appearance (min upload_stealed) falls on this exact date. Format: YYYY-MM-DD.
Show only hashes whose first appearance (min upload_stealed) is on or after this date. Format: YYYY-MM-DD.
Minimum number of sources (source_count >= N)
Response Body
application/json
application/json
curl -X GET "https://api.stealed.io/leaks/host-users?host=string&identifier_column=root_domain"null{
"detail": [
{
"loc": [
"string"
],
"msg": "string",
"type": "string"
}
]
}Paginated list of hosts grouped, with leak and user counts GET
Returns a paginated list of distinct hosts found in leaks for the org's monitored scope. For each host: total leak count and number of distinct usernames seen on that host.
Retrieve public exposure analytics stats for a domain GET
Endpoint to retrieve pre-aggregated analytics statistics for a domain. Restricted to MSSP role. No raw credential data is returned -- stats only. Data comes from the harmonised global stats tables (the same hash-deduplicated source the cockpit / Référencé views consume), so figures are coherent across the product. Coverage starts from when the stats pipeline began accumulating. **Returns:** - `total_leaks`: Total number of leaks (hash-deduplicated) - `unique_usernames`: Unique usernames (HyperLogLog estimate) - `unique_passwords`: **Deprecated** -- always 0 (not aggregated in the stats pipeline) - `unique_leaks`: Unique credentials by hash (equals `total_leaks`) - `unique_sources`: **Deprecated** -- always 0 (not aggregated in the stats pipeline) - `unique_domains`: Unique cross-domains seen in the leaks - `latest_leak_date`: Date of the most recent leak - `leaks_by_type`: Leaks split by type (Stealer / Combo) - `leaks_by_day`: Leak timeline (daily for 30d, monthly for 12m) - `leaks_by_stealer`: Top 20 stealer families - `leaks_by_country`: Top 20 countries - `subdomains`: Top 50 compromised sub-domains **Example Usage:** ```bash GET /leaks/stats/analytics?domain=example.com&identifier_column=root_domain GET /leaks/stats/analytics?domain=gmail.com&identifier_column=email_domain ```