Paginated, count-sorted distinct-value breakdown for the keyword insight KPI tiles

Drill into a keyword-insight KPI tile (Total Users / Total Domains) with a server-paginated, count-sorted list of distinct values, computed from the organization's active keywords over leaks_history (same dedup-by-hash rows as GET /leaks/keyword/search).

field=source is rejected (returns an empty page): keyword leaks have no reliable per-credential source attribution (see the keyword teaser-tier rule) -- classic leaks use GET /leaks/breakdown?field=source instead.

Parameters:

Parameter	Default	Description
`field`	required	`username`, `domain`, or `source` (rejected, empty page)
`page`	1	Page number
`page_size`	50	Items per page (max 200)
`search`	-	Substring filter on the returned `value`

Plus all standard DynamicFilters, exactly like GET /leaks/keyword/search.

Response:

{
  "data": [{"value": "acme-corp-recrute.talent-soft.com", "count": 12}],
  "total": 34,
  "page": 1,
  "page_size": 50,
  "total_pages": 1
}

total is the number of distinct field values matching the filters -- the same figure as unique_usernames / unique_domains from GET /leaks/keyword/stats.

Example:

GET /leaks/keyword/breakdown?field=domain&page=1&page_size=50

Authorization

ApiKeyAuth

X-API-Key<token>

API key for authentication

In: header

Query Parameters

field*Field

KPI dimension to break down

Value in"username" | "domain" | "source"

page?Page

Page number

Default1

Range1 <= value

page_size?Page Size

Items per page (max 200)

Default50

Range1 <= value <= 200

search?Search

Substring filter on the returned value

Lengthlength <= 200

username?|array<string>|

Username of the leaked user (can be phone, email, ID, ...)

type?|array<string>|

Type of leak (combo, stealer)

hash?|array<string>|

Uniq identifier for the concatenation of : username, password and domain

upload_stealed?||array<|string>|

Upload date on stealed, ISO 8601, pattern YYYY-MM-DD

upload_date?||array<|string>|

Upload date on the plateform the credential was found, ISO 8601, pattern YYYY-mm-dd

log_date?||array<|string>|

Log date of the device at compromized moment (if applicable, stealer only)

start_date?||

Start date to search from leaks, format: YYYY-mm-dd (default: today - 14days at 0:00am)

end_date?||

End date to search leaks from, format YYYY-mm-dd (default: today)

host?|array<string>|

URL of the leaked data

domain?|array<string>|

FQDN of the leaked data

local_part?|array<string>|

Local part of the username section (if applicable, email only)

protocol?|array<string>|

Protocol identified (if applicable)

email_domain?|array<string>|

Email domain to filter on (if multiple email domains declared)

root_domain?|array<string>|

Root domain to filter on (if multiple root domains declared)

machine_id?|array<string>|

Machine ID (if applicable, stealer only)

computer_name?|array<string>|

Computer name (if applicable, stealer only)

hardware_id?|array<string>|

Hardware ID (if applicable, stealer only)

machine_user?|array<string>|

Machine user (if applicable, stealer only)

ip_address?|array<string>|

IP address (if applicable, stealer only)

country?|array<string>|

Country (if applicable, stealer only)

software?|array<string>|

Software (if applicable, stealer only)

stealer_name?|array<string>|

Stealer name (if applicable)

source?|array<string>|

Opaque source label(s) to filter on, of the form Source-<6 hex> (as returned by the sources breakdown). The raw telegram_channel is never exposed: the label is matched back against the same MD5-prefix expression server-side.

keyword?|array<string>|

Keyword to filter on (only active keywords for tenant)

match_type?|array<string>|

Match type for leaks_matched table (root_domain or email_domain)

not_root_domain?|array<string>|

Root domains to exclude (NOT IN filter)

not_email_domain?|array<string>|

Email domains to exclude (NOT IN filter)

not_domain?|array<string>|

Domains to exclude (NOT IN filter)

not_type?|array<string>|

Types to exclude

not_software?|array<string>|

Software to exclude

not_stealer_name?|array<string>|

Stealer names to exclude

not_protocol?|array<string>|

Protocols to exclude

not_country?|array<string>|

Countries to exclude

first_seen_date?|

Show only hashes whose first appearance (min upload_stealed) falls on this exact date. Format: YYYY-MM-DD.

first_seen_since?|

Show only hashes whose first appearance (min upload_stealed) is on or after this date. Format: YYYY-MM-DD.

limit?|

Limit result length

min_occurrences?|

Minimum number of sources (source_count >= N)

Response Body

`application/json`

curl -X GET "https://api.stealed.io/leaks/keyword/breakdown?field=domain"

{
  "data": [
    {
      "count": 42,
      "value": "[email protected]"
    },
    {
      "count": 17,
      "value": "[email protected]"
    }
  ],
  "page": 1,
  "page_size": 50,
  "total": 118,
  "total_pages": 3
}

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string"
    }
  ]
}

Paginated, count-sorted distinct-value breakdown for the keyword insight KPI tiles

Authorization

Query Parameters

Response Body

200application/json

422application/json

`application/json`

`application/json`