Skip to main content
POST
/
astp
/
v2
/
credentials
/
_search
Search Credentials
curl --request POST \
  --url https://api.flare.io/astp/v2/credentials/_search \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "size": 123,
  "from": "<string>",
  "order": "<string>",
  "query": {},
  "filters": {
    "imported_at": {
      "gte": "<string>",
      "lte": "<string>"
    }
  }
}'
{
    "items": [
        {
            "domain": "scatterholt.com",
            "hash": "B@dPassw0rd",
            "hash_type": null,
            "id": 33880703907,
            "identity_name": "ryan.howard@scatterholt.com",
            "imported_at": "2024-07-22T19:25:52.893439+00:00",
            "known_password_id": null,
            "source": {
                "breached_at": null,
                "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
                "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
                "id": "combolists",
                "is_alert_enabled": true,
                "leaked_at": null,
                "name": "Combolists"
            },
            "source_id": "combolists"
        },
        {
            "domain": "scatterholt.com",
            "hash": "1qaz2wsx",
            "hash_type": "unknown",
            "id": 33880703906,
            "identity_name": "ryan.howard@scatterholt.com",
            "imported_at": "2024-07-22T19:25:52.893439+00:00",
            "known_password_id": null,
            "source": {
                "breached_at": null,
                "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
                "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
                "id": "combolists",
                "is_alert_enabled": true,
                "leaked_at": null,
                "name": "Combolists"
            },
            "source_id": "combolists"
        }
    ],
    "next": "WyJjb20uc2NhdHRlcmhvbHQiLCAxNjczNjg4ODg4NV0"
}
This endpoint requires access to Account & Session Takeover Prevention (ASTP). Please contact your Customer Success Manager for more details.
Flare supports searching in credentials via two endpoints:
Returns a list of credentials matching the query provided.

​
Guides

See the guide for using this endpoint: Exporting a Domain’s Credentials . 
{
    "items": [
        {
            "domain": "scatterholt.com",
            "hash": "B@dPassw0rd",
            "hash_type": null,
            "id": 33880703907,
            "identity_name": "ryan.howard@scatterholt.com",
            "imported_at": "2024-07-22T19:25:52.893439+00:00",
            "known_password_id": null,
            "source": {
                "breached_at": null,
                "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
                "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
                "id": "combolists",
                "is_alert_enabled": true,
                "leaked_at": null,
                "name": "Combolists"
            },
            "source_id": "combolists"
        },
        {
            "domain": "scatterholt.com",
            "hash": "1qaz2wsx",
            "hash_type": "unknown",
            "id": 33880703906,
            "identity_name": "ryan.howard@scatterholt.com",
            "imported_at": "2024-07-22T19:25:52.893439+00:00",
            "known_password_id": null,
            "source": {
                "breached_at": null,
                "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
                "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
                "id": "combolists",
                "is_alert_enabled": true,
                "leaked_at": null,
                "name": "Combolists"
            },
            "source_id": "combolists"
        }
    ],
    "next": "WyJjb20uc2NhdHRlcmhvbHQiLCAxNjczNjg4ODg4NV0"
}

​
Paging

This endpoint supports the Flare standard paging pattern .

​
Body Parameters

​
size
number
Maximum size of the JSON object that will be returned (maximum 10 000)
​
from
string
The next value from the last response.
​
order
string
default:"desc"
The order in which the results will be returned. (asc or desc)
​
query
object
One of the supported queries.
  • Domain Query
  • Auth Domain Query
  • Password Query
  • Email Query
  • Keyword Query
This query will match all credentials that contain the specified domain in the email address.
{
  "type": "domain",
  "fqdn": "<string>"
}
​
filters
object