Expand Event V2 Field (Beta)

{
    "items": [
        {
            "host_key": "example.com",
            "path": "/",
            "expires_utc": "2025-01-01T00:00:00",
            "name": "example",
            "value": "🍪"
        }
    ],
    "next": null
}

{
    "items": [
        {
            "url": "https://example.com",
            "username": "john_doe",
            "password": "hunter2",
            "application": "application"
        }
    ],
    "next": null
}

Expand Event Field

curl --request GET \
  --url https://api.flare.io/firework/v4/events/_expand \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.flare.io/firework/v4/events/_expand', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.flare.io/firework/v4/events/_expand",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.flare.io/firework/v4/events/_expand"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.flare.io/firework/v4/events/_expand")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
    "items": [
        {
            "host_key": "example.com",
            "path": "/",
            "expires_utc": "2025-01-01T00:00:00",
            "name": "example",
            "value": "🍪"
        }
    ],
    "next": null
}

{
    "items": [
        {
            "url": "https://example.com",
            "username": "john_doe",
            "password": "hunter2",
            "application": "application"
        }
    ],
    "next": null
}

{
    "items": [
        {
            "host_key": "example.com",
            "path": "/",
            "expires_utc": "2025-01-01T00:00:00",
            "name": "example",
            "value": "🍪"
        }
    ],
    "next": null
}

{
    "items": [
        {
            "url": "https://example.com",
            "username": "john_doe",
            "password": "hunter2",
            "application": "application"
        }
    ],
    "next": null
}

GET

firework

events

_expand

Expand Event Field

curl --request GET \
  --url https://api.flare.io/firework/v4/events/_expand \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.flare.io/firework/v4/events/_expand', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.flare.io/firework/v4/events/_expand",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.flare.io/firework/v4/events/_expand"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.flare.io/firework/v4/events/_expand")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
    "items": [
        {
            "host_key": "example.com",
            "path": "/",
            "expires_utc": "2025-01-01T00:00:00",
            "name": "example",
            "value": "🍪"
        }
    ],
    "next": null
}

{
    "items": [
        {
            "url": "https://example.com",
            "username": "john_doe",
            "password": "hunter2",
            "application": "application"
        }
    ],
    "next": null
}

Required API key permission: Read All Returns a page of items for a particular expanded field in a specified event.

Expandable fields

The following fields can be expanded for the given event type.

Stealer Log

cookies credentials

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

field

enum<string>

required

Available options:

credentials,

cookies,

associated_events,

leaked_files,

leaked_file_extensions,

secrets,

secret_types

uid

string

required

from

string | null

size

integer

default:20

Required range: x <= 20

Response

Successful Response

PaginatedResults[StealerLogCredential, str]
PaginatedResults[StealerLogCookie, str]
PaginatedResults[FeedItem, str]
PaginatedResultsWithTotalCount[LeakedFile, str]
PaginatedResults[LeakedFileExtension, str]
PaginatedResults[EventSecret, str]
PaginatedResults[EventSecretType, str]

items

StealerLogCredential · object[]

required

Show child attributes

string | null

required

Authentication API

Events API

Global Search API

Account and Session Takeover Prevention (ASTP) API

Management API

Entities API

Threat-Flow API

Sandbox API

Deprecated APIs

Expand Event V2 Field (Beta)

Expandable fields

Authorizations

Query Parameters

Response

​Expandable fields

Authorizations

Query Parameters

Response

Expandable fields