Retrieve keyword-based leak statistics

Retrieve all leak statistics for the current organization's active keywords.

Generic accounts such as admin, root, test are counted in these figures, for an API key as in the application.

Returns the same format as /leaks/stats (StatsResponse), computed from keyword search results on hash_registry (full ingestion history, folded per hash). The rows matching active keywords (excluding the org's own monitored root domains) are fed through the same calculate_all_statistics() pipeline.

If the organization has no active keywords, returns an empty stats response.

Parameters:

Parameter	Default	Description
`granularity`	`day`	Time granularity (unused in keyword stats, kept for API consistency)
`start_date` / `end_date`	all-time	Date range filter; an explicit value narrows the window

Plus all standard DynamicFilters.

Accepts ?tenant_id_override=<child_tenant_id> for an MSSP workspace: the active keywords, excluded roots and paid-plan check then resolve from the CHILD tenant instead of the caller's own org (tenant_id_override=all is rejected with 400, a keyword search has no defined meaning across a whole portfolio).

Example:

GET /leaks/keyword/stats?start_date=2026-03-01&end_date=2026-03-28

Authorization

ApiKeyAuth

X-API-Key<token>

API key for authentication

In: header

Query Parameters

granularity?Granularity

Time granularity (kept for API consistency)

Default"day"

Value in"hour" | "day"

include_all_time?Include All Time

When true, include all-time aggregates (all_time_total_leaks, all_time_unique_users, all_time_unique_hosts, all_time_unique_passwords) computed without date filtering. Used by the cockpit landing page.

Defaultfalse

username?|array<string>|

Username of the leaked user (can be phone, email, ID, ...)

type?|array<string>|

Type of leak (combo, stealer)

hash?|array<string>|

Uniq identifier for the concatenation of : username, password and domain

upload_stealed?||array<|string>|

Upload date on stealed, ISO 8601, pattern YYYY-MM-DD

upload_date?||array<|string>|

Upload date on the plateform the credential was found, ISO 8601, pattern YYYY-mm-dd

log_date?||array<|string>|

Log date of the device at compromized moment (if applicable, stealer only)

start_date?||

Start date to search from leaks, format: YYYY-mm-dd (default: today - 14days at 0:00am)

end_date?||

End date to search leaks from, format YYYY-mm-dd (default: today)

host?|array<string>|

URL of the leaked data

domain?|array<string>|

FQDN of the leaked data

local_part?|array<string>|

Local part of the username section (if applicable, email only)

protocol?|array<string>|

Protocol identified (if applicable)

email_domain?|array<string>|

Email domain to filter on (if multiple email domains declared)

root_domain?|array<string>|

Root domain to filter on (if multiple root domains declared)

machine_id?|array<string>|

Machine ID (if applicable, stealer only)

computer_name?|array<string>|

Computer name (if applicable, stealer only)

hardware_id?|array<string>|

Hardware ID (if applicable, stealer only)

machine_user?|array<string>|

Machine user (if applicable, stealer only)

ip_address?|array<string>|

IP address (if applicable, stealer only)

country?|array<string>|

Country (if applicable, stealer only)

software?|array<string>|

Software (if applicable, stealer only)

stealer_name?|array<string>|

Stealer name (if applicable)

source?|array<string>|

Opaque source label(s) to filter on, of the form Source-<6 hex> (as returned by the sources breakdown). The raw telegram_channel is never exposed: the label is matched back against the same MD5-prefix expression server-side.

keyword?|array<string>|

Keyword to filter on (only active keywords for tenant)

match_type?|array<string>|

Match type for leaks_matched table (root_domain or email_domain)

not_root_domain?|array<string>|

Root domains to exclude (NOT IN filter)

not_email_domain?|array<string>|

Email domains to exclude (NOT IN filter)

not_domain?|array<string>|

Domains to exclude (NOT IN filter)

not_type?|array<string>|

Types to exclude

not_software?|array<string>|

Software to exclude

not_stealer_name?|array<string>|

Stealer names to exclude

not_protocol?|array<string>|

Protocols to exclude

not_country?|array<string>|

Countries to exclude

not_machine_id?|array<string>|

Excludes the credentials whose machine ID is one of these values (NOT IN filter, stealer only)

not_computer_name?|array<string>|

Excludes the credentials whose computer name is one of these values (NOT IN filter, stealer only)

not_hardware_id?|array<string>|

Excludes the credentials whose hardware ID is one of these values (NOT IN filter, stealer only)

not_machine_user?|array<string>|

Excludes the credentials whose machine user is one of these values (NOT IN filter, stealer only)

not_ip_address?|array<string>|

Excludes the credentials whose IP address is one of these values (NOT IN filter, stealer only)

first_seen_date?|

Show only hashes whose first appearance (min upload_stealed) falls on this exact date. Format: YYYY-MM-DD.

first_seen_since?|

Show only hashes whose first appearance (min upload_stealed) is on or after this date. Format: YYYY-MM-DD.

limit?|

Limit result length

min_occurrences?|

Minimum number of sources (source_count >= N)

Response Body

`application/json`

curl -X GET "https://api.stealed.io/leaks/keyword/stats"

null

{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string"
    }
  ]
}

Retrieve keyword-based leak statistics

Authorization

Query Parameters

Response Body

200application/json

422application/json

`application/json`

`application/json`