Search Credentials
curl --request POST \
--url https://api.flare.io/astp/v2/credentials/_search \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"size": 123,
"from": "<string>",
"order": "<string>",
"include": [
"<string>"
],
"query": {},
"filters": {
"imported_at": {
"gte": "<string>",
"lte": "<string>"
}
}
}
'import requests
url = "https://api.flare.io/astp/v2/credentials/_search"
payload = {
"size": 123,
"from": "<string>",
"order": "<string>",
"include": ["<string>"],
"query": {},
"filters": { "imported_at": {
"gte": "<string>",
"lte": "<string>"
} }
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
size: 123,
from: '<string>',
order: '<string>',
include: ['<string>'],
query: {},
filters: {imported_at: {gte: '<string>', lte: '<string>'}}
})
};
fetch('https://api.flare.io/astp/v2/credentials/_search', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flare.io/astp/v2/credentials/_search",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'size' => 123,
'from' => '<string>',
'order' => '<string>',
'include' => [
'<string>'
],
'query' => [
],
'filters' => [
'imported_at' => [
'gte' => '<string>',
'lte' => '<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flare.io/astp/v2/credentials/_search"
payload := strings.NewReader("{\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"include\": [\n \"<string>\"\n ],\n \"query\": {},\n \"filters\": {\n \"imported_at\": {\n \"gte\": \"<string>\",\n \"lte\": \"<string>\"\n }\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flare.io/astp/v2/credentials/_search")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"include\": [\n \"<string>\"\n ],\n \"query\": {},\n \"filters\": {\n \"imported_at\": {\n \"gte\": \"<string>\",\n \"lte\": \"<string>\"\n }\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flare.io/astp/v2/credentials/_search")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"include\": [\n \"<string>\"\n ],\n \"query\": {},\n \"filters\": {\n \"imported_at\": {\n \"gte\": \"<string>\",\n \"lte\": \"<string>\"\n }\n }\n}"
response = http.request(request)
puts response.read_body{
"items": [
{
"auth_domains": ["login.live.com"],
"domain": "scatterholt.com",
"hash": "B@dPassw0rd",
"hash_type": null,
"id": 33880703907,
"identity_name": "ryan.howard@scatterholt.com",
"imported_at": "2024-07-22T19:25:52.893439+00:00",
"known_password_id": null,
"source": {
"breached_at": null,
"description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
"description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
"id": "combolists",
"is_alert_enabled": true,
"leaked_at": null,
"name": "Combolists"
},
"source_id": "combolists"
},
{
"auth_domains": ["www.facebook.com", "discord.com"],
"domain": "scatterholt.com",
"hash": "1qaz2wsx",
"hash_type": "unknown",
"id": 33880703906,
"identity_name": "ryan.howard@scatterholt.com",
"imported_at": "2024-07-22T19:25:52.893439+00:00",
"known_password_id": null,
"source": {
"breached_at": null,
"description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
"description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
"id": "combolists",
"is_alert_enabled": true,
"leaked_at": null,
"name": "Combolists"
},
"source_id": "combolists"
}
],
"next": "WyJjb20uc2NhdHRlcmhvbHQiLCAxNjczNjg4ODg4NV0"
}
Credentials
Search Credentials
POST
/
astp
/
v2
/
credentials
/
_search
Search Credentials
curl --request POST \
--url https://api.flare.io/astp/v2/credentials/_search \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"size": 123,
"from": "<string>",
"order": "<string>",
"include": [
"<string>"
],
"query": {},
"filters": {
"imported_at": {
"gte": "<string>",
"lte": "<string>"
}
}
}
'import requests
url = "https://api.flare.io/astp/v2/credentials/_search"
payload = {
"size": 123,
"from": "<string>",
"order": "<string>",
"include": ["<string>"],
"query": {},
"filters": { "imported_at": {
"gte": "<string>",
"lte": "<string>"
} }
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
size: 123,
from: '<string>',
order: '<string>',
include: ['<string>'],
query: {},
filters: {imported_at: {gte: '<string>', lte: '<string>'}}
})
};
fetch('https://api.flare.io/astp/v2/credentials/_search', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flare.io/astp/v2/credentials/_search",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'size' => 123,
'from' => '<string>',
'order' => '<string>',
'include' => [
'<string>'
],
'query' => [
],
'filters' => [
'imported_at' => [
'gte' => '<string>',
'lte' => '<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flare.io/astp/v2/credentials/_search"
payload := strings.NewReader("{\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"include\": [\n \"<string>\"\n ],\n \"query\": {},\n \"filters\": {\n \"imported_at\": {\n \"gte\": \"<string>\",\n \"lte\": \"<string>\"\n }\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flare.io/astp/v2/credentials/_search")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"include\": [\n \"<string>\"\n ],\n \"query\": {},\n \"filters\": {\n \"imported_at\": {\n \"gte\": \"<string>\",\n \"lte\": \"<string>\"\n }\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flare.io/astp/v2/credentials/_search")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"include\": [\n \"<string>\"\n ],\n \"query\": {},\n \"filters\": {\n \"imported_at\": {\n \"gte\": \"<string>\",\n \"lte\": \"<string>\"\n }\n }\n}"
response = http.request(request)
puts response.read_body{
"items": [
{
"auth_domains": ["login.live.com"],
"domain": "scatterholt.com",
"hash": "B@dPassw0rd",
"hash_type": null,
"id": 33880703907,
"identity_name": "ryan.howard@scatterholt.com",
"imported_at": "2024-07-22T19:25:52.893439+00:00",
"known_password_id": null,
"source": {
"breached_at": null,
"description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
"description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
"id": "combolists",
"is_alert_enabled": true,
"leaked_at": null,
"name": "Combolists"
},
"source_id": "combolists"
},
{
"auth_domains": ["www.facebook.com", "discord.com"],
"domain": "scatterholt.com",
"hash": "1qaz2wsx",
"hash_type": "unknown",
"id": 33880703906,
"identity_name": "ryan.howard@scatterholt.com",
"imported_at": "2024-07-22T19:25:52.893439+00:00",
"known_password_id": null,
"source": {
"breached_at": null,
"description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
"description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
"id": "combolists",
"is_alert_enabled": true,
"leaked_at": null,
"name": "Combolists"
},
"source_id": "combolists"
}
],
"next": "WyJjb20uc2NhdHRlcmhvbHQiLCAxNjczNjg4ODg4NV0"
}
This endpoint requires access to Account & Session Takeover Prevention (ASTP).
Please contact your Customer Success Manager for more details.
Flare supports searching in credentials via two endpoints:
- The Global Credentials Search endpoint : This endpoint counts towards your global search quota.
- The ASTP Credentials Search Endpoint : This endpoint does not count towards your search quota but requires ASTP to be enabled on your account. For more information about ASTP, contact your Customer Success Manager.
Guides
See the guide for using this endpoint: Exporting a Domain’s Credentials .{
"items": [
{
"auth_domains": ["login.live.com"],
"domain": "scatterholt.com",
"hash": "B@dPassw0rd",
"hash_type": null,
"id": 33880703907,
"identity_name": "ryan.howard@scatterholt.com",
"imported_at": "2024-07-22T19:25:52.893439+00:00",
"known_password_id": null,
"source": {
"breached_at": null,
"description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
"description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
"id": "combolists",
"is_alert_enabled": true,
"leaked_at": null,
"name": "Combolists"
},
"source_id": "combolists"
},
{
"auth_domains": ["www.facebook.com", "discord.com"],
"domain": "scatterholt.com",
"hash": "1qaz2wsx",
"hash_type": "unknown",
"id": 33880703906,
"identity_name": "ryan.howard@scatterholt.com",
"imported_at": "2024-07-22T19:25:52.893439+00:00",
"known_password_id": null,
"source": {
"breached_at": null,
"description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
"description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
"id": "combolists",
"is_alert_enabled": true,
"leaked_at": null,
"name": "Combolists"
},
"source_id": "combolists"
}
],
"next": "WyJjb20uc2NhdHRlcmhvbHQiLCAxNjczNjg4ODg4NV0"
}
Paging
This endpoint supports the Flare standard paging pattern .Body Parameters
number
Maximum size of the JSON object that will be returned (maximum 10 000)
string
The
next value from the last response.string
default:"desc"
The order in which the results will be returned. (
asc or desc)string[]
Additional fields to return. Available options:
known_password_id: ID of the credential’s password.auth_domains: for each credential, up to 100 hosts (domain only, e.g.login.example.com) where the credential was seen being used.urls: for each credential, up to 100 full URLs (including scheme and path, e.g.https://login.example.com/signin) where the credential was seen being used. These are the complete addresses thatauth_domainsreports the host portion of.
object
One of the supported queries.
- Domain Query
- Auth Domain Query
- Password Query
- Email Query
- Keyword Query
This query will match all credentials that contain the specified domain in the email address.
{
"type": "domain",
"fqdn": "<string>"
}
This query will match the domain of the service that this credential might have been used to log in to.
{
"type": "auth_domain",
"fqdn": "<string>"
}
This query will match all credentials that contain the specified password.
{
"type": "secret",
"secret": "<string>"
}
This query will match all credentials for the exact email address.
{
"type": "email",
"email": "<string>"
}
This query will match with the credential’s username, which is the portion of the
identity_name that preceeds @.{
"type": "keyword",
"keyword": "<string>"
}
Was this page helpful?
⌘I