Skip to main content
POST
/
firework
/
v4
/
credentials
/
global
/
_search
Credentials Global Search
curl --request POST \
  --url https://api.flare.io/firework/v4/credentials/global/_search \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "query": {
    "type": "<string>",
    "fqdn": "<string>"
  },
  "filters": {
    "imported_at": {
      "gte": "2023-11-07T05:31:56Z",
      "lte": "2023-11-07T05:31:56Z"
    }
  },
  "from": "<string>",
  "size": 10,
  "include": [
    "known_password_id"
  ],
  "order": "desc"
}
'
{
    "items": [
        {
            "domain": "scatterholt.com",
            "hash": "B@dPassw0rd",
            "hash_type": null,
            "id": 33880703907,
            "identity_name": "ryan.howard@scatterholt.com",
            "imported_at": "2024-07-22T19:25:52.893439+00:00",
            "known_password_id": null,
            "source": {
                "breached_at": null,
                "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
                "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
                "id": "combolists",
                "is_alert_enabled": true,
                "leaked_at": null,
                "name": "Combolists"
            },
            "source_id": "combolists"
        },
        {
            "domain": "scatterholt.com",
            "hash": "1qaz2wsx",
            "hash_type": "unknown",
            "id": 33880703906,
            "identity_name": "ryan.howard@scatterholt.com",
            "imported_at": "2024-07-22T19:25:52.893439+00:00",
            "known_password_id": null,
            "source": {
                "breached_at": null,
                "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
                "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
                "id": "combolists",
                "is_alert_enabled": true,
                "leaked_at": null,
                "name": "Combolists"
            },
            "source_id": "combolists"
        }
    ],
    "next": "WyJjb20uc2NhdHRlcmhvbHQiLCAxNjczNjg4ODg4NV0"
}
This endpoint is subject to quotas and is subject to the Search ratelimiting tier. See Rate Limits and Quotas .
Flare supports searching in credentials via two endpoints:
Returns a list of credentials matching the query provided. 
{
    "items": [
        {
            "domain": "scatterholt.com",
            "hash": "B@dPassw0rd",
            "hash_type": null,
            "id": 33880703907,
            "identity_name": "ryan.howard@scatterholt.com",
            "imported_at": "2024-07-22T19:25:52.893439+00:00",
            "known_password_id": null,
            "source": {
                "breached_at": null,
                "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
                "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
                "id": "combolists",
                "is_alert_enabled": true,
                "leaked_at": null,
                "name": "Combolists"
            },
            "source_id": "combolists"
        },
        {
            "domain": "scatterholt.com",
            "hash": "1qaz2wsx",
            "hash_type": "unknown",
            "id": 33880703906,
            "identity_name": "ryan.howard@scatterholt.com",
            "imported_at": "2024-07-22T19:25:52.893439+00:00",
            "known_password_id": null,
            "source": {
                "breached_at": null,
                "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
                "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
                "id": "combolists",
                "is_alert_enabled": true,
                "leaked_at": null,
                "name": "Combolists"
            },
            "source_id": "combolists"
        }
    ],
    "next": "WyJjb20uc2NhdHRlcmhvbHQiLCAxNjczNjg4ODg4NV0"
}

​
Paging

This endpoint supports the Flare standard paging pattern .

​
Body Parameters

​
size
number
Maximum size of the JSON object that will be returned (maximum 10 000)
​
from
string
The next value from the last response.
​
order
string
default:"desc"
The order in which the results will be returned. (asc or desc)
​
query
object
One of the supported queries.
This query will match all credentials that contain the specified domain in the email address.
{
  "type": "domain",
  "fqdn": "<string>"
}
​
filters
object

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
​
query
DomainQuery · object
required
​
filters
CredentialsQueryFilters · object
​
from
string | null
​
size
integer
default:10
Required range: 1 <= x <= 10000
​
include
enum<string>[]
Available options:
known_password_id
​
order
enum<string>
default:desc
Available options:
asc,
desc

Response

Successful Response

​
items
Credential · object[]
required
​
next
string | null
required