> ## Documentation Index
> Fetch the complete documentation index at: https://api.docs.flare.io/llms.txt
> Use this file to discover all available pages before exploring further.

# List URLs by Credential Hash

<Info>
  This endpoint requires access to Account & Session Takeover Prevention (ASTP).
  Please contact your Customer Success Manager for more details.
</Info>

Returns the URLs where a leaked credential was seen being used, for a single credential hash.

Credential hashes are returned in the `credential_hash` field of each credential from the
[Search Credentials <Icon icon="code" size={16} />](/api-reference/astp/endpoints/post-credentials-search)
endpoint.

Each result contains the full `url` (including scheme and path), its host (`domain`), and the
`credential_hash` it belongs to.

<ResponseExample>
  ```json Response Example theme={null}
  {
      "items": [
          {
              "url": "https://login.example.com/signin",
              "domain": "login.example.com",
              "credential_hash": "43804850e72d054f3648660557330630"
          },
          {
              "url": "https://mail.example.com/",
              "domain": "mail.example.com",
              "credential_hash": "43804850e72d054f3648660557330630"
          }
      ],
      "next": "WyJtYWlsLmV4YW1wbGUuY29tIl0"
  }
  ```
</ResponseExample>

## Paging

This endpoint supports the
[Flare standard paging pattern <Icon icon="book" size={16} />](/concepts/paging).
Use the `next` value from the response as the `from` value in the next request to fetch additional URLs.

## Body Parameters

<ParamField body="credential_hash" type="string" required>
  The credential hash to look up URLs for, as returned in the `credential_hash` field of a credential.
</ParamField>

<ParamField body="size" type="number" default="100">
  Maximum number of URLs to return (maximum 5000).
</ParamField>

<ParamField body="from" type="string">
  The `next` value from the last response.
</ParamField>