List Identifier Events

curl --request POST \
  --url https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "query": {},
  "size": 123,
  "from": "<string>",
  "order": "<string>",
  "filters": {
    "severity": [
      "<string>"
    ],
    "type": [
      "<string>"
    ],
    "estimated_created_at": {
      "gt": "<string>",
      "gte": "<string>",
      "lt": "<string>",
      "lte": "<string>"
    },
    "tags": [
      "<string>"
    ],
    "is_ignored": true,
    "is_remediated": true
  }
}
'

import requests

url = "https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search"

payload = {
    "query": {},
    "size": 123,
    "from": "<string>",
    "order": "<string>",
    "filters": {
        "severity": ["<string>"],
        "type": ["<string>"],
        "estimated_created_at": {
            "gt": "<string>",
            "gte": "<string>",
            "lt": "<string>",
            "lte": "<string>"
        },
        "tags": ["<string>"],
        "is_ignored": True,
        "is_remediated": True
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    query: {},
    size: 123,
    from: '<string>',
    order: '<string>',
    filters: {
      severity: ['<string>'],
      type: ['<string>'],
      estimated_created_at: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
      tags: ['<string>'],
      is_ignored: true,
      is_remediated: true
    }
  })
};

fetch('https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'query' => [
        
    ],
    'size' => 123,
    'from' => '<string>',
    'order' => '<string>',
    'filters' => [
        'severity' => [
                '<string>'
        ],
        'type' => [
                '<string>'
        ],
        'estimated_created_at' => [
                'gt' => '<string>',
                'gte' => '<string>',
                'lt' => '<string>',
                'lte' => '<string>'
        ],
        'tags' => [
                '<string>'
        ],
        'is_ignored' => true,
        'is_remediated' => true
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search"

	payload := strings.NewReader("{\n  \"query\": {},\n  \"size\": 123,\n  \"from\": \"<string>\",\n  \"order\": \"<string>\",\n  \"filters\": {\n    \"severity\": [\n      \"<string>\"\n    ],\n    \"type\": [\n      \"<string>\"\n    ],\n    \"estimated_created_at\": {\n      \"gt\": \"<string>\",\n      \"gte\": \"<string>\",\n      \"lt\": \"<string>\",\n      \"lte\": \"<string>\"\n    },\n    \"tags\": [\n      \"<string>\"\n    ],\n    \"is_ignored\": true,\n    \"is_remediated\": true\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"query\": {},\n  \"size\": 123,\n  \"from\": \"<string>\",\n  \"order\": \"<string>\",\n  \"filters\": {\n    \"severity\": [\n      \"<string>\"\n    ],\n    \"type\": [\n      \"<string>\"\n    ],\n    \"estimated_created_at\": {\n      \"gt\": \"<string>\",\n      \"gte\": \"<string>\",\n      \"lt\": \"<string>\",\n      \"lte\": \"<string>\"\n    },\n    \"tags\": [\n      \"<string>\"\n    ],\n    \"is_ignored\": true,\n    \"is_remediated\": true\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"query\": {},\n  \"size\": 123,\n  \"from\": \"<string>\",\n  \"order\": \"<string>\",\n  \"filters\": {\n    \"severity\": [\n      \"<string>\"\n    ],\n    \"type\": [\n      \"<string>\"\n    ],\n    \"estimated_created_at\": {\n      \"gt\": \"<string>\",\n      \"gte\": \"<string>\",\n      \"lt\": \"<string>\",\n      \"lte\": \"<string>\"\n    },\n    \"tags\": [\n      \"<string>\"\n    ],\n    \"is_ignored\": true,\n    \"is_remediated\": true\n  }\n}"

response = http.request(request)
puts response.read_body

{
    "items": [
        {
            "metadata": {
                "estimated_created_at": "2019-09-20T16:30:37.589388Z",
                "matched_at": "2019-09-21T10:15:22.123456Z",
                "type": "listing",
                "uid": "listing/apollon_market/9861",
                "severity": "critical"
            },
            "tenant_metadata": {
                "severity": {
                    "original": "low",
                    "override": "critical"
                },
                "tags": [
                    "important",
                ],
                "notes": "This reason why this is tagged as 'important' is: ..."
            },
            "identifiers": [
                {
                    "id": 1,
                    "name": "An identifier"
                }
            ],
            "highlights": {
                "description": [
                    "Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
                ],
                "title": [
                    "Bank Statement PSD <mark>Template</mark>"
                ]
            }
        }
    ],
    "next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
}

POST

firework

events

identifiers

{identifier_id}

_search

List Identifier Events

curl --request POST \
  --url https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "query": {},
  "size": 123,
  "from": "<string>",
  "order": "<string>",
  "filters": {
    "severity": [
      "<string>"
    ],
    "type": [
      "<string>"
    ],
    "estimated_created_at": {
      "gt": "<string>",
      "gte": "<string>",
      "lt": "<string>",
      "lte": "<string>"
    },
    "tags": [
      "<string>"
    ],
    "is_ignored": true,
    "is_remediated": true
  }
}
'

import requests

url = "https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search"

payload = {
    "query": {},
    "size": 123,
    "from": "<string>",
    "order": "<string>",
    "filters": {
        "severity": ["<string>"],
        "type": ["<string>"],
        "estimated_created_at": {
            "gt": "<string>",
            "gte": "<string>",
            "lt": "<string>",
            "lte": "<string>"
        },
        "tags": ["<string>"],
        "is_ignored": True,
        "is_remediated": True
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    query: {},
    size: 123,
    from: '<string>',
    order: '<string>',
    filters: {
      severity: ['<string>'],
      type: ['<string>'],
      estimated_created_at: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
      tags: ['<string>'],
      is_ignored: true,
      is_remediated: true
    }
  })
};

fetch('https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'query' => [
        
    ],
    'size' => 123,
    'from' => '<string>',
    'order' => '<string>',
    'filters' => [
        'severity' => [
                '<string>'
        ],
        'type' => [
                '<string>'
        ],
        'estimated_created_at' => [
                'gt' => '<string>',
                'gte' => '<string>',
                'lt' => '<string>',
                'lte' => '<string>'
        ],
        'tags' => [
                '<string>'
        ],
        'is_ignored' => true,
        'is_remediated' => true
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search"

	payload := strings.NewReader("{\n  \"query\": {},\n  \"size\": 123,\n  \"from\": \"<string>\",\n  \"order\": \"<string>\",\n  \"filters\": {\n    \"severity\": [\n      \"<string>\"\n    ],\n    \"type\": [\n      \"<string>\"\n    ],\n    \"estimated_created_at\": {\n      \"gt\": \"<string>\",\n      \"gte\": \"<string>\",\n      \"lt\": \"<string>\",\n      \"lte\": \"<string>\"\n    },\n    \"tags\": [\n      \"<string>\"\n    ],\n    \"is_ignored\": true,\n    \"is_remediated\": true\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"query\": {},\n  \"size\": 123,\n  \"from\": \"<string>\",\n  \"order\": \"<string>\",\n  \"filters\": {\n    \"severity\": [\n      \"<string>\"\n    ],\n    \"type\": [\n      \"<string>\"\n    ],\n    \"estimated_created_at\": {\n      \"gt\": \"<string>\",\n      \"gte\": \"<string>\",\n      \"lt\": \"<string>\",\n      \"lte\": \"<string>\"\n    },\n    \"tags\": [\n      \"<string>\"\n    ],\n    \"is_ignored\": true,\n    \"is_remediated\": true\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"query\": {},\n  \"size\": 123,\n  \"from\": \"<string>\",\n  \"order\": \"<string>\",\n  \"filters\": {\n    \"severity\": [\n      \"<string>\"\n    ],\n    \"type\": [\n      \"<string>\"\n    ],\n    \"estimated_created_at\": {\n      \"gt\": \"<string>\",\n      \"gte\": \"<string>\",\n      \"lt\": \"<string>\",\n      \"lte\": \"<string>\"\n    },\n    \"tags\": [\n      \"<string>\"\n    ],\n    \"is_ignored\": true,\n    \"is_remediated\": true\n  }\n}"

response = http.request(request)
puts response.read_body

{
    "items": [
        {
            "metadata": {
                "estimated_created_at": "2019-09-20T16:30:37.589388Z",
                "matched_at": "2019-09-21T10:15:22.123456Z",
                "type": "listing",
                "uid": "listing/apollon_market/9861",
                "severity": "critical"
            },
            "tenant_metadata": {
                "severity": {
                    "original": "low",
                    "override": "critical"
                },
                "tags": [
                    "important",
                ],
                "notes": "This reason why this is tagged as 'important' is: ..."
            },
            "identifiers": [
                {
                    "id": 1,
                    "name": "An identifier"
                }
            ],
            "highlights": {
                "description": [
                    "Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
                ],
                "title": [
                    "Bank Statement PSD <mark>Template</mark>"
                ]
            }
        }
    ],
    "next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
}

Returns a list of events matching an identifier.

Guides

See the guide for using this endpoint: Exporting a Tenant’s Events .

{
    "items": [
        {
            "metadata": {
                "estimated_created_at": "2019-09-20T16:30:37.589388Z",
                "matched_at": "2019-09-21T10:15:22.123456Z",
                "type": "listing",
                "uid": "listing/apollon_market/9861",
                "severity": "critical"
            },
            "tenant_metadata": {
                "severity": {
                    "original": "low",
                    "override": "critical"
                },
                "tags": [
                    "important",
                ],
                "notes": "This reason why this is tagged as 'important' is: ..."
            },
            "identifiers": [
                {
                    "id": 1,
                    "name": "An identifier"
                }
            ],
            "highlights": {
                "description": [
                    "Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
                ],
                "title": [
                    "Bank Statement PSD <mark>Template</mark>"
                ]
            }
        }
    ],
    "next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
}

Paging

This endpoint supports the Flare standard paging pattern .

Body Parameters

query

object

One of the supported queries.

{
  "type": "domain",
  "fqdn": "<string>"
}

{
  "type": "email",
  "email": "<string>"
}

{
  "type": "keyword",
  "keyword": "<string>"
}

{
  "type": "query_string",
  "query_string": "<string>"
}

{
  "type": "username",
  "username": "<string>"
}

{
  "type": "github_repository",
  "repo_owner": "<string>"
  "repo_name": "<string>"
}

{
  "type": "brand",
  "name": "<string>"
}

{
  "type": "name",
  "first_name": "<string>"
  "last_name": "<string>"
  "is_strict": "<boolean>"
}

{
  "type": "bin",
  "bin": "<string>"
}

{
  "type": "ip",
  "ip": "<string>"
}

{
  "type": "credentials",
  "username": "<string>"
  "password": "<string>"
}

{
  "type": "secret",
  "secret": "<string>"
}

{
  "type": "azure_tenant",
  "tenant_id": "<string>"
}

size

number

Limit number of events that will be returned. (Max 10)

from

string

The next value from the last response.

order

string

default:"desc"

The order in which the results will be returned.

Show valid order values

asc desc

filters

object

Hide child attributes

severity

string[]

If a string value is specified, results will contain events that have a greater than or equal severity. Otherwise, if an array of severities is specified, results will only contain events that exactly match one of them.

Show valid severity values

info low medium high critical

type

string[]

Show valid type values

illicit_networks open_web leak domain listing forum_content blog_content profile chat_message ransomleak infected_devices financial_data paste social_media source_code google service buckets

Learn more about Event Source Filters .

estimated_created_at

object

Show child attributes

string

Matches values greater than the specified timestamp.Format: ISO-8601

gte

string

Matches values greater than or equal to the specified timestamp.Format: ISO-8601

string

Matches values lesser than the specified timestamp.Format: ISO-8601

lte

string

Matches values lesser than or equal to the specified timestamp.Format: ISO-8601

Path Parameters

identifier_id

int

required

The ID of the identifier.

List Identifier Credentials

List Identifier Group's Events

⌘I

Authentication API

Events API

Global Search API

Account and Session Takeover Prevention (ASTP) API

Management API

Threat-Flow API

Deprecated APIs

List Identifier Events

Guides

Paging

Body Parameters

Path Parameters

​Guides

​Paging

​Body Parameters

​Path Parameters

Guides

Paging

Body Parameters

Path Parameters