# Event Source Filters
Source: https://api.docs.flare.io/advanced/event-source-filters



The Flare event feeds allow for searching and filtering using a `types` parameter that defines which
events types should be included in the response.

Flare API endpoints accept either **Base Types** or **Categories** as values.

| Filter    | Description                    |
| --------- | ------------------------------ |
| Base Type | Enables a single event type.   |
| Category  | Enables a group of base types. |

## Categories

Base Types are divided into categories that correspond to the categories in the Flare platform.

| Category          | Contained Types                                                                                                                           |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| illicit\_networks | forum\_content <br /> blog\_content <br /> profile <br /> chat\_message <br /> ransomleak <br /> infected\_devices <br /> financial\_data |
| open\_web         | paste <br /> social\_media <br /> source\_code <br /> google <br /> service <br /> buckets                                                |
| buckets           | bucket <br /> bucket\_object <br />                                                                                                       |
| source\_code      | stack\_exchange <br /> source\_code\_files <br /> source\_code\_secret                                                                    |
| leaks             | leak                                                                                                                                      |
| domains           | domain                                                                                                                                    |
| forum\_content    | forum\_post <br /> forum\_topic                                                                                                           |
| profile           | forum\_profile <br /> seller                                                                                                              |
| infected\_devices | bot <br /> stealer\_log                                                                                                                   |


# List by Domain
Source: https://api.docs.flare.io/api-reference/astp/endpoints/get-by-domain

GET https://api.flare.io/leaksdb/identities/by_domain/{domain}

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/astp/v2/credentials/\_search <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search)
</Warning>

<Info>
  Access to  is required for this feature.
  Please contact your Customer Success Manager for more details.
</Info>

Returns a list of accounts matching the domain provided.
The format of the domain should include everything after the `@`.

Results are returned in ascending order by id.

<ResponseExample>
  ```json Response Example theme={null}
  [
      {
          "links": {},
          "name": "price.glenn@example.com",
          "passwords": [
              {
                  "credential_hash": "da7932a62841a48cc06e639be10cdb1f",
                  "domain": "example.com",
                  "extra": {},
                  "hash": "Secret123!",
                  "hash_type": "unknown",
                  "id": 5378,
                  "imported_at": "2019-06-03T14:20:25.132662+00:00",
                  "source": {
                      "breached_at": "2019-01-07T21:59:00+00:00",
                      "description": "In January 2019, a large collection of credential stuffing lists (combinations of email addresses and passwords used to hijack accounts on other services) was discovered being distributed on a popular hacking forum. The data contained almost 2.7 billion records including 773 million unique email addresses alongside passwords those addresses had used on other breached services.",
                      "description_fr": "En janvier 2019, une grande collection de listes de bourrage d'identifiants (combinaisons d'adresses \u00e9lectroniques et de mots de passe utilis\u00e9s pour prendre contr\u00f4le de comptes sur d'autres services) a \u00e9t\u00e9 diffus\u00e9e sur un forum de piratage populaire. Les donn\u00e9es contenaient pr\u00e8s de 2,7 milliards d'enregistrements, dont 773 millions d'adresses \u00e9lectroniques uniques aux c\u00f4t\u00e9s de mots de passe que ces adresses avaient utilis\u00e9s sur d'autres services ayant subi des br\u00e8ches de donn\u00e9es.",
                      "hash_description": "plaintext",
                      "hash_type": "Plaintext",
                      "id": "collection-1",
                      "is_alerts_enabled": false,
                      "leaked_at": "2019-01-07T21:59:00+00:00",
                      "name": "Collection-1",
                      "related_urls": [
                          "https://example.com/leaks-source"
                      ],
                      "url": null
                  },
                  "source_id": "collection-1",
                  "source_params": null
              }
          ]
      }
  ]
  ```
</ResponseExample>

## Paging

By using the id of the last item from a request as the value for the query parameter from of the following request, you will be able to scroll through results.
When the result contains an empty list, you know that you received all results

## Path Parameters

<ParamField type="string">
  The domain to look up.
</ParamField>

## Query Parameters

<ParamField type="number">
  Maximum size of the JSON object that will be returned (maximum 10 000)
</ParamField>

<ParamField type="number">
  Id of the database entry you want to start from (excluding this id).
</ParamField>


# List by Keyword
Source: https://api.docs.flare.io/api-reference/astp/endpoints/get-by-keyword

GET https://api.flare.io/leaksdb/identities/by_keyword/{keyword}

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/astp/v2/credentials/\_search <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search)
</Warning>

<Info>
  Access to  is required for this feature.
  Please contact your Customer Success Manager for more details.
</Info>

Returns a list of identities with a matching keyword.

Results are returned in ascending order by id.

<ResponseExample>
  ```json Response Example theme={null}
  [
      {
          "links": {},
          "name": "johndoe@john.com",
          "passwords": [
              {
                  "credential_hash": "e83ce345e87b6ab1c325b1046a031808",
                  "domain": "john.com",
                  "extra": {},
                  "hash": "johndoe",
                  "hash_type": "unknown",
                  "id": 262028,
                  "imported_at": "2019-06-03T14:20:25.132662+00:00",
                  "source": {
                      "breached_at": "2019-01-07T21:59:00+00:00",
                      "description": "In January 2019, a large collection of credential stuffing lists (combinations of email addresses and passwords used to hijack accounts on other services) was discovered being distributed on a popular hacking forum. The data contained almost 2.7 billion records including 773 million unique email addresses alongside passwords those addresses had used on other breached services.",
                      "description_fr": "En janvier 2019, une grande collection de listes de bourrage d'identifiants (combinaisons d'adresses \u00e9lectroniques et de mots de passe utilis\u00e9s pour prendre contr\u00f4le de comptes sur d'autres services) a \u00e9t\u00e9 diffus\u00e9e sur un forum de piratage populaire. Les donn\u00e9es contenaient pr\u00e8s de 2,7 milliards d'enregistrements, dont 773 millions d'adresses \u00e9lectroniques uniques aux c\u00f4t\u00e9s de mots de passe que ces adresses avaient utilis\u00e9s sur d'autres services ayant subi des br\u00e8ches de donn\u00e9es.",
                      "hash_description": "plaintext",
                      "hash_type": "Plaintext",
                      "id": "collection-1",
                      "is_alerts_enabled": false,
                      "leaked_at": "2019-01-07T21:59:00+00:00",
                      "name": "Collection-1",
                      "related_urls": [
                          "https://example.com/leaks-source"
                      ],
                      "url": null
                  },
                  "source_id": "collection-1",
                  "source_params": null
              }
          ]
      }
  ]
  ```
</ResponseExample>

## Paging

By using the id of the last item from a request as the value for the query parameter `from` of the following request, you will be able to scroll through results.
When the result contains an empty list, you know that you received all results.

## Wildcards

The keyword may contain a wildcard.
Wildcards should either be at the start or at the end of your query.

Example keywords:

* `johndoe*` will match an identity with the name johndoe and any string that follows(e.g. `johndoe@test.com`).
* `*acme.com` will match any identity that finishes with acme.com (e.g. `myuser@acme.com`).
* `johndoe` will match either johndoe or JOHNdoe.

## Path Parameters

<ParamField type="string">
  The keyword to search for.
</ParamField>

## Query Parameters

<ParamField type="number">
  Maximum size of the JSON object that will be returned (maximum 10 000).
</ParamField>

<ParamField type="number" />


# List by Password
Source: https://api.docs.flare.io/api-reference/astp/endpoints/get-by-password

GET https://api.flare.io/leaksdb/identities/by_password/{password}

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/astp/v2/credentials/\_search <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search)
</Warning>

<Info>
  Access to  is required for this feature.
  Please contact your Customer Success Manager for more details.
</Info>

This endpoint allow to search by passwords.
It will return a list of JSON objects containing identities that have been associated seen using this password.

Results are returned in ascending order by id.

<ResponseExample>
  ```json Response Example theme={null}
  [
    {
      "links": {},
      "name": "areqwt@gmail.com",
      "passwords": [
        {
          "credential_hash": "b3b09e44e625a30daa482e008f4dfe6f",
          "domain": "gmail.com",
          "extra": {},
          "hash": "password123",
          "hash_type": "unknown",
          "id": 4703,
          "imported_at": "2019-06-03T14:20:25.132662+00:00",
          "source": {
            "breached_at": "2019-01-07T21:59:00+00:00",
            "description": "In January 2019, a large collection of credential stuffing lists (combinations of email addresses and passwords used to hijack accounts on other services) was discovered being distributed on a popular hacking forum. The data contained almost 2.7 billion records including 773 million unique email addresses alongside passwords those addresses had used on other breached services.",
            "description_fr": "En janvier 2019, une grande collection de listes de bourrage d'identifiants (combinaisons d'adresses électroniques et de mots de passe utilisés pour prendre contrôle de comptes sur d'autres services) a été diffusée sur un forum de piratage populaire. Les données contenaient près de 2,7 milliards d'enregistrements, dont 773 millions d'adresses électroniques uniques aux côtés de mots de passe que ces adresses avaient utilisés sur d'autres services ayant subi des brèches de données.",
            "hash_description": "plaintext",
            "hash_type": "Plaintext",
            "id": "collection-1",
            "is_alerts_enabled": false,
            "leaked_at": "2019-01-07T21:59:00+00:00",
            "name": "Collection-1",
            "related_urls": [
              "https://example.com/leaks-source"
            ],
            "url": null
          },
          "source_id": "collection-1",
          "source_params": null
        }
      ]
    }
  ]
  ```
</ResponseExample>

## Path Parameters

<ParamField type="string" />

## Query Parameters

<ParamField type="number">
  Maximum size of the JSON object that will be returned (maximum 10 000)
</ParamField>

<ParamField type="number">
  Id of the database entry you want to start from (excluding this id).
</ParamField>


# Retrieve Source
Source: https://api.docs.flare.io/api-reference/astp/endpoints/get-source

GET https://api.flare.io/astp/sources/{source_id}

<Info>
  Access to  is required for this feature.
  Please contact your Customer Success Manager for more details.
</Info>

This endpoint will return a source object for a given `source_id` if it exists.

<ResponseExample>
  ```json Response Example theme={null}
  {
      "breached_at": "2019-01-07T21:59:00+00:00",
      "description": "In January 2019, a large collection of credential stuffing lists (combinations of email addresses and passwords used to hijack accounts on other services) was discovered being distributed on a popular hacking forum. The data contained almost 2.7 billion records including 773 million unique email addresses alongside passwords those addresses had used on other breached services.",
      "description_fr": "En janvier 2019, une grande collection de listes de bourrage d'identifiants (combinaisons d'adresses \u00e9lectroniques et de mots de passe utilis\u00e9s pour prendre contr\u00f4le de comptes sur d'autres services) a \u00e9t\u00e9 diffus\u00e9e sur un forum de piratage populaire. Les donn\u00e9es contenaient pr\u00e8s de 2,7 milliards d'enregistrements, dont 773 millions d'adresses \u00e9lectroniques uniques aux c\u00f4t\u00e9s de mots de passe que ces adresses avaient utilis\u00e9s sur d'autres services ayant subi des br\u00e8ches de donn\u00e9es.",
      "hash_description": "plaintext",
      "hash_type": "Plaintext",
      "id": "collection-1",
      "is_alerts_enabled": false,
      "leaked_at": "2019-01-07T21:59:00+00:00",
      "name": "Collection-1",
      "related_urls": [
          "https://example.com/leaks-source"
      ],
      "url": null
  }
  ```
</ResponseExample>

## Path Parameters

<ParamField type="string">
  The ID of the source.
  For example `collection-1`.
</ParamField>


# List All Sources
Source: https://api.docs.flare.io/api-reference/astp/endpoints/get-sources

GET https://api.flare.io/astp/v2/sources

<Info>
  Access to  is required for this feature.
  Please contact your Customer Success Manager for more details.
</Info>

This endpoint will return all sources, paginated and in ascending order from least recently added to most recently added.

<ResponseExample>
  ```json Response Example theme={null}
  {
      "cursors": [],
      "items": [
          {
              "breached_at": "2007-07-12T17:03:00+00:00",
              "description": "In July 2007, the multiplayer game portal known as gPotato suffered a data breach and over 2 million user accounts were exposed. The site later merged into the Webzen portal where the original accounts still exist today. The exposed data included usernames, email and IP addresses, passwords and personal attributes such as gender, birth date, physical address and security questions and answers.",
              "description_fr": "En juillet 2007, le portail de jeux multijoueurs connu sous le nom de gPotato a subi une fuite de donn\u00e9es qui a expos\u00e9 plus de 2 millions de comptes utilisateurs. Le site a ensuite fusionn\u00e9 avec le portail Webzen, o\u00f9 les comptes originaux existent encore aujourd'hui. Les donn\u00e9es expos\u00e9es comprenaient des noms d'utilisateur, des adresses \u00e9lectroniques, des adresses IP, des mots de passe et des attributs personnels tels que le sexe, la date de naissance, l'adresse physique et les questions et r\u00e9ponses de s\u00e9curit\u00e9.",
              "hash_description": "MD5",
              "hash_type": null,
              "id": "2007_gpotato",
              "is_alerts_enabled": false,
              "leaked_at": "2008-01-01T18:03:00+00:00",
              "name": "gPotato",
              "related_urls": [
                  ""
              ],
              "url": "https://www.webzen.com/"
          }
      ],
      "next": "WzFd",
      "total_count": null
  }
  ```
</ResponseExample>

## Query Parameters

<ParamField type="number">
  Maximum size of the JSON object that will be returned (maximum 10 000).
</ParamField>

<ParamField type="string">
  Cursor from which you want to continue paginating.
  This value comes from the `next` field in the response.
  For example `WzFd` the example response.
</ParamField>


# List by Bulk Accounts
Source: https://api.docs.flare.io/api-reference/astp/endpoints/post-by-accounts

POST https://api.flare.io/astp/identities/by_accounts

<Info>
  Access to  is required for this feature.
  Please contact your Customer Success Manager for more details.
</Info>

Returns a list of identities with leaked passwords given a list of accounts.
This endpoint only matches exact accounts and doesn’t allow wildcard or domain searches.
This is API is useful when doing batch processing.

The list of account is provided through a JSON payload.
An object with an accounts key must contains the list of account names.
The accounts list must contain up to 100 values.

The response is an object with requested account as keys and an identity object as values.
The identity object contains a list of passwords that might be empty if not passwords were found for this account.

<ResponseExample>
  ```json Response Example theme={null}
  {
      "hello": {
          "links": {},
          "name": "hello",
          "passwords": [
              {
                  "credential_hash": "43804850e72d054f3648660557330630",
                  "domain": null,
                  "extra": {},
                  "hash": "hello@bosslist.ru",
                  "hash_type": "unknown",
                  "id": 4987562,
                  "imported_at": "2019-06-03T14:20:25.132662+00:00",
                  "source": {
                      "breached_at": "2019-01-07T21:59:00+00:00",
                      "description": "In January 2019, a large collection of credential stuffing lists (combinations of email addresses and passwords used to hijack accounts on other services) was discovered being distributed on a popular hacking forum. The data contained almost 2.7 billion records including 773 million unique email addresses alongside passwords those addresses had used on other breached services.",
                      "description_fr": "En janvier 2019, une grande collection de listes de bourrage d'identifiants (combinaisons d'adresses \u00e9lectroniques et de mots de passe utilis\u00e9s pour prendre contr\u00f4le de comptes sur d'autres services) a \u00e9t\u00e9 diffus\u00e9e sur un forum de piratage populaire. Les donn\u00e9es contenaient pr\u00e8s de 2,7 milliards d'enregistrements, dont 773 millions d'adresses \u00e9lectroniques uniques aux c\u00f4t\u00e9s de mots de passe que ces adresses avaient utilis\u00e9s sur d'autres services ayant subi des br\u00e8ches de donn\u00e9es.",
                      "hash_description": "plaintext",
                      "hash_type": "Plaintext",
                      "id": "collection-1",
                      "is_alerts_enabled": false,
                      "leaked_at": "2019-01-07T21:59:00+00:00",
                      "name": "Collection-1",
                      "related_urls": [
                          "https://example.com/leaks-source"
                      ],
                      "url": null
                  },
                  "source_id": "collection-1",
                  "source_params": null
              }
          ]
      },
      "test@example.com": {
          "links": {},
          "name": "test@example.com",
          "passwords": [
              {
                  "credential_hash": "360dc75e310b62efc8e19061a6a58ea1",
                  "domain": "example.com",
                  "extra": {},
                  "hash": "shfkfk!",
                  "hash_type": "unknown",
                  "id": 1108602,
                  "imported_at": "2019-06-03T14:20:25.132662+00:00",
                  "source": {
                      "breached_at": "2019-01-07T21:59:00+00:00",
                      "description": "In January 2019, a large collection of credential stuffing lists (combinations of email addresses and passwords used to hijack accounts on other services) was discovered being distributed on a popular hacking forum. The data contained almost 2.7 billion records including 773 million unique email addresses alongside passwords those addresses had used on other breached services.",
                      "description_fr": "En janvier 2019, une grande collection de listes de bourrage d'identifiants (combinaisons d'adresses \u00e9lectroniques et de mots de passe utilis\u00e9s pour prendre contr\u00f4le de comptes sur d'autres services) a \u00e9t\u00e9 diffus\u00e9e sur un forum de piratage populaire. Les donn\u00e9es contenaient pr\u00e8s de 2,7 milliards d'enregistrements, dont 773 millions d'adresses \u00e9lectroniques uniques aux c\u00f4t\u00e9s de mots de passe que ces adresses avaient utilis\u00e9s sur d'autres services ayant subi des br\u00e8ches de donn\u00e9es.",
                      "hash_description": "plaintext",
                      "hash_type": "Plaintext",
                      "id": "collection-1",
                      "is_alerts_enabled": false,
                      "leaked_at": "2019-01-07T21:59:00+00:00",
                      "name": "Collection-1",
                      "related_urls": [
                          "https://example.com/leaks-source"
                      ],
                      "url": null
                  },
                  "source_id": "collection-1",
                  "source_params": null
              },
              {
                  "credential_hash": "cc3f2d0fd6986abfc77797e2143f3dcf",
                  "domain": "example.com",
                  "extra": {},
                  "hash": "test",
                  "hash_type": "unknown",
                  "id": 1473618,
                  "imported_at": "2019-06-03T14:20:25.132662+00:00",
                  "source": {
                      "breached_at": "2019-01-07T21:59:00+00:00",
                      "description": "In January 2019, a large collection of credential stuffing lists (combinations of email addresses and passwords used to hijack accounts on other services) was discovered being distributed on a popular hacking forum. The data contained almost 2.7 billion records including 773 million unique email addresses alongside passwords those addresses had used on other breached services.",
                      "description_fr": "En janvier 2019, une grande collection de listes de bourrage d'identifiants (combinaisons d'adresses \u00e9lectroniques et de mots de passe utilis\u00e9s pour prendre contr\u00f4le de comptes sur d'autres services) a \u00e9t\u00e9 diffus\u00e9e sur un forum de piratage populaire. Les donn\u00e9es contenaient pr\u00e8s de 2,7 milliards d'enregistrements, dont 773 millions d'adresses \u00e9lectroniques uniques aux c\u00f4t\u00e9s de mots de passe que ces adresses avaient utilis\u00e9s sur d'autres services ayant subi des br\u00e8ches de donn\u00e9es.",
                      "hash_description": "plaintext",
                      "hash_type": "Plaintext",
                      "id": "collection-1",
                      "is_alerts_enabled": false,
                      "leaked_at": "2019-01-07T21:59:00+00:00",
                      "name": "Collection-1",
                      "related_urls": [
                          "https://example.com/leaks-source"
                      ],
                      "url": null
                  },
                  "source_id": "collection-1",
                  "source_params": null
              }
          ]
      }
  }
  ```

  ```json Response Schema theme={null}
  {
      "<account_1>": [<credentials>],
      "<account_n>": [<credentials>]
  }
  ```
</ResponseExample>

## Paging

Passwords are listed in the order that they were inserted into the database.
Up to 100 passwords are included in each identity object.
A links attribute is included in each object and may contain a next attribute with an URL that can be followed with a valid Authorization token to get additional results for this specific identity.

## Body Parameters

<ParamField type="string[]">
  The list of accounts to look up.
</ParamField>

## Response Format

The response is an object where the keys is the name of the account, and the value is the first 100 credentials that match.


# Search Cookies
Source: https://api.docs.flare.io/api-reference/astp/endpoints/post-cookies-search

POST https://api.flare.io/astp/v2/cookies/_search

<Info>
  Access to  is required for this feature.
  Please contact your Customer Success Manager for more details.
</Info>

Returns a list of cookies matching the query provided.

<ResponseExample>
  ```json Response Example theme={null}
  {
          "items": [
              {
                  "uuid": "44672461-aca4-4b3b-b192-6bd5429c4c6d",
                  "domain": "scatterholt.com",
                  "expires_at": "2024-10-18T00:00:00+00:00",
                  "imported_at": "2024-01-01T00:00:00+00:00",
                  "name": "session",
                  "path": "/",
                  "event_uid": "stealer_log/stealer_logs_live/12345",
                  "value": "abcdefghijkl",
              },
          ],
          "next": "WzFd",
      }
  }
  ```
</ResponseExample>

## Paging

This endpoint supports the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

## Guides

See the guide for using this endpoint:
[Monitor Leaked Cookies for your Domain <Icon icon="book" />](/guides/cookie-monitoring).

## Body Parameters

<ParamField type="string">
  The exact domain for which you want to search cookies. Subdomains will not be included.
</ParamField>

<ParamField type="string[]">
  A list of exact values for which you want to search cookies. Currently limited to a single value.
</ParamField>

<ParamField type="number">
  The number of results to fetch. (default: 100, max: 2000)
</ParamField>

<ParamField type="string">
  The `next` value from the last response.
</ParamField>

<ParamField type="string[]">
  A list of names to filter for specific cookies, for example `['session', 'PHPSESSID']`. (max: 10)
</ParamField>

<ParamField type="string[]">
  A list of paths to filter for specific cookies, for example `['/', '/login']`. (max: 10)
</ParamField>

<ParamField type="string">
  ISO-formatted datetime string to filter for cookies added to Flare's database after a given date, for example `2024-10-29T17:50:44.237148+00:00`.
</ParamField>

<ParamField type="string">
  ISO-formatted datetime string to filter for cookie expiration, for example `2024-10-29T17:50:44.237148+00:00`.
</ParamField>

<ParamField type="string">
  Order in which you want to browse the cookies. One of `asc` or `desc`.
  It defaults to `asc` which is the recommended way to use the API to obtain newly imported cookies.
</ParamField>


# Search Credentials
Source: https://api.docs.flare.io/api-reference/astp/endpoints/post-credentials-search

POST https://api.flare.io/astp/v2/credentials/_search

<Info>
  Access to  is required for this feature.
  Please contact your Customer Success Manager for more details.
</Info>

<Note>
  Flare supports searching in credentials via two endpoints:

  * The [Global Credentials Search endpoint <Icon icon="code" />](/api-reference/v4/endpoints/credentials-global-search): This endpoint counts towards your global search quota.
  * The [ASTP Credentials Search Endpoint <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search): This endpoint does <b>not</b> count towards your search quota but requires ASTP to be enabled on your account. For more information about ASTP, contact your Customer Success Manager.
</Note>

Returns a list of credentials matching the query provided.

## Guides

See the guide for using this endpoint:
[Exporting a Domain's Credentials <Icon icon="book" />](/guides/credentials-export-domain).

<ResponseExample>
  ```json Response Example theme={null}
  {
      "items": [
          {
              "auth_domains": ["login.live.com"],
              "domain": "scatterholt.com",
              "hash": "B@dPassw0rd",
              "hash_type": null,
              "id": 33880703907,
              "identity_name": "ryan.howard@scatterholt.com",
              "imported_at": "2024-07-22T19:25:52.893439+00:00",
              "known_password_id": null,
              "source": {
                  "breached_at": null,
                  "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
                  "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
                  "id": "combolists",
                  "is_alert_enabled": true,
                  "leaked_at": null,
                  "name": "Combolists"
              },
              "source_id": "combolists"
          },
          {
              "auth_domains": ["www.facebook.com", "discord.com"],
              "domain": "scatterholt.com",
              "hash": "1qaz2wsx",
              "hash_type": "unknown",
              "id": 33880703906,
              "identity_name": "ryan.howard@scatterholt.com",
              "imported_at": "2024-07-22T19:25:52.893439+00:00",
              "known_password_id": null,
              "source": {
                  "breached_at": null,
                  "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
                  "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
                  "id": "combolists",
                  "is_alert_enabled": true,
                  "leaked_at": null,
                  "name": "Combolists"
              },
              "source_id": "combolists"
          }
      ],
      "next": "WyJjb20uc2NhdHRlcmhvbHQiLCAxNjczNjg4ODg4NV0"
  }
  ```
</ResponseExample>

## Paging

This endpoint supports the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

## Body Parameters

<ParamField type="number">
  Maximum size of the JSON object that will be returned (maximum 10 000)
</ParamField>

<ParamField type="string">
  The `next` value from the last response.
</ParamField>

<ParamField type="string">
  The order in which the results will be returned. (`asc` or `desc`)
</ParamField>

<ParamField type="string[]">
  Additional fields to return. Available options:

  * `known_password_id`: ID of the credential's password.
  * `auth_domains`: for each credential, up to 100 hosts (domain only, e.g. `login.example.com`) where the credential was seen being used.
  * `urls`: for each credential, up to 100 full URLs (including scheme and path, e.g. `https://login.example.com/signin`) where the credential was seen being used. These are the complete addresses that `auth_domains` reports the host portion of.
</ParamField>

<ParamField type="object">
  One of the supported queries.

  <Tabs>
    <Tab title="Domain Query">
      This query will match all credentials that contain the specified domain in the email address.

      ```json theme={null}
      {
        "type": "domain",
        "fqdn": "<string>"
      }
      ```
    </Tab>

    <Tab title="Auth Domain Query">
      This query will match the domain of the service that this credential might have been used to log in to.

      ```json theme={null}
      {
        "type": "auth_domain",
        "fqdn": "<string>"
      }
      ```
    </Tab>

    <Tab title="Password Query">
      This query will match all credentials that contain the specified password.

      ```json theme={null}
      {
        "type": "secret",
        "secret": "<string>"
      }
      ```
    </Tab>

    <Tab title="Email Query">
      This query will match all credentials for the exact email address.

      ```json theme={null}
      {
        "type": "email",
        "email": "<string>"
      }
      ```
    </Tab>

    <Tab title="Keyword Query">
      This query will match with the credential's username, which is the portion of the `identity_name` that preceeds `@`.

      ```json theme={null}
      {
        "type": "keyword",
        "keyword": "<string>"
      }
      ```
    </Tab>
  </Tabs>
</ParamField>

<ParamField type="object">
  <Expandable>
    <ParamField type="object">
      <Expandable>
        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values greater than or equal to the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values lesser than or equal to the specified timestamp.

          Format: ISO-8601
        </ParamField>
      </Expandable>
    </ParamField>
  </Expandable>
</ParamField>


# List URLs by Credential Hash
Source: https://api.docs.flare.io/api-reference/astp/endpoints/post-urls-by-credential-hash

POST https://api.flare.io/astp/urls/by_credential_hash

<Info>
  Access to  is required for this feature.
  Please contact your Customer Success Manager for more details.
</Info>

Returns the URLs where a leaked credential was seen being used, for a single credential hash.

Credential hashes are returned in the `credential_hash` field of each credential from the
[Search Credentials <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search)
endpoint.

Each result contains the full `url` (including scheme and path), its host (`domain`), and the
`credential_hash` it belongs to.

<ResponseExample>
  ```json Response Example theme={null}
  {
      "items": [
          {
              "url": "https://login.example.com/signin",
              "domain": "login.example.com",
              "credential_hash": "43804850e72d054f3648660557330630"
          },
          {
              "url": "https://mail.example.com/",
              "domain": "mail.example.com",
              "credential_hash": "43804850e72d054f3648660557330630"
          }
      ],
      "next": "WyJtYWlsLmV4YW1wbGUuY29tIl0"
  }
  ```
</ResponseExample>

## Paging

This endpoint supports the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).
Use the `next` value from the response as the `from` value in the next request to fetch additional URLs.

## Body Parameters

<ParamField type="string">
  The credential hash to look up URLs for, as returned in the `credential_hash` field of a credential.
</ParamField>

<ParamField type="number">
  Maximum number of URLs to return (maximum 5000).
</ParamField>

<ParamField type="string">
  The `next` value from the last response.
</ParamField>


# List All Credentials (v1)
Source: https://api.docs.flare.io/api-reference/leaksdb/endpoints/get-credentials-v1

GET https://api.flare.io/leaksdb/credentials

<Warning>
  **DEPRECATED:** It is no longer possible to access a list of all credentials in Flare's database. This endpoint should be replaced by
  [/astp/v2/credentials/\_search <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search)
</Warning>

This endpoint will return a list of all crendentials in Flare's database, meant to be used as a feed.

Results are returned in ascending order by id, and optional parameters can be added to the query to fetch and filter large amounts (or all) of results.

<ResponseExample>
  ```json Response Example theme={null}
  [
      {
          "credential_hash": "889d9ba6efa420d3dff7822c9119e744",
          "domain": "web.de",
          "extra": {},
          "hash": "password123",
          "hash_type": "unknown",
          "id": 1,
          "identity_name": "bob@example.com",
          "imported_at": "2019-06-03T14:20:25.132662+00:00",
          "source": null,
          "source_id": "collection-1",
          "source_params": null
      },
      {
          "credential_hash": "67033809d2befde723e2cb6893c470ef",
          "domain": "arcor.de",
          "extra": {},
          "hash": "sunshine",
          "hash_type": "unknown",
          "id": 2,
          "identity_name": "sarah@example.net",
          "imported_at": "2019-06-03T14:20:25.132662+00:00",
          "source": null,
          "source_id": "collection-1",
          "source_params": null
      }
  ]
  ```
</ResponseExample>

## Paging

By using the id of the last item from a request as the value for the query parameter `from` of the following request, you will be able to scroll through results.
When the result contains an empty list, you know that you received all results.

## Query Parameters

<ParamField type="number">
  Maximum size of the JSON object that will be returned (maximum 5 000)
</ParamField>

<ParamField type="number">
  Id of the database entry you want to start from (excluding this id).
</ParamField>

<ParamField type="string">
  Order in which you want to browse the credentials. One of `asc` or `desc`.
  It defaults to `asc` which is the recommended way to use the API to obtain newly imported passwords.
</ParamField>

<ParamField type="string">
  Return only credentials that belong to the specified source.
</ParamField>


# List All Credentials (v2)
Source: https://api.docs.flare.io/api-reference/leaksdb/endpoints/get-credentials-v2

GET https://api.flare.io/leaksdb/v2/credentials

<Warning>
  **DEPRECATED:** It is no longer possible to access a list of all credentials in Flare's database. This endpoint should be replaced by
  [/astp/v2/credentials/\_search <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search)
</Warning>

This endpoint will return a list of all crendentials in Flare's database, meant to be used as a feed.

Results are returned in ascending order by id, and optional parameters can be added to the query to fetch and filter large amounts (or all) of results.

<ResponseExample>
  ```json Response Example theme={null}
  {
    "items": [
      {
        "credential_hash": "889d9ba6efa420d3dff7822c9119e744",
          "domain": "web.de",
          "extra": {},
          "hash": "password123",
          "hash_type": "unknown",
          "id": 1,
          "identity_name": "bob@example.com",
          "imported_at": "2019-06-03T14:20:25.132662+00:00",
          "source": null,
          "source_id": "collection-1",
          "source_params": null
      },
      {
        "credential_hash": "67033809d2befde723e2cb6893c470ef",
        "domain": "arcor.de",
        "extra": {},
        "hash": "sunshine",
        "hash_type": "unknown",
        "id": 2,
        "identity_name": "sarah@example.net",
        "imported_at": "2019-06-03T14:20:25.132662+00:00",
        "source": null,
        "source_id": "collection-1",
        "source_params": null
      }
    ],
    "next": "WyJ7XCJjXCI6Mn0iXQ"
  }
  ```
</ResponseExample>

## Paging

This endpoint supports the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

## Query Parameters

<ParamField type="number">
  Maximum size of the JSON object that will be returned (maximum 5 000)
</ParamField>

<ParamField type="number">
  The `next` value from the last response.
</ParamField>

<ParamField type="string">
  Order in which you want to browse the credentials. One of `asc` or `desc`.
  It defaults to `asc` which is the recommended way to use the API to obtain newly imported passwords.
</ParamField>

<ParamField type="string">
  Return only credentials that belong to the specified source.
</ParamField>


# Generate an API Token
Source: https://api.docs.flare.io/api-reference/tokens/endpoints/generate

POST https://api.flare.io/tokens/generate

Tokens are used to interact with the Flare API.
They can be generated using an API key provided via the Authorization header.

API tokens expire after 1 hour.

The endpoint returns an API token via the response body, but also via cookies which can then be used in future HTTP requests.

For more information about authentication, see the
[API Authentication Guide <Icon icon="book" />](/concepts/authentication/).

<ResponseExample>
  ```json Response Example theme={null}
  {
    "refresh_token_exp": 1723673997,
    "token": "i-am-an-example-api-token"
  }
  ```

  ```json Response Schema theme={null}
  {
    "refresh_token_exp": <number (unix timestamp)>,
    "token": "<string>"
  }
  ```
</ResponseExample>

## Auth Headers

<ParamField type="string">
  Your Flare API key.
</ParamField>

## Body Parameters

<ParamField type="number">
  The tenant you want to authenticate to.

  <Note>
    When unspecified, the API token will be generated for your default tenant.
  </Note>
</ParamField>

## Response Fields

<ResponseField name="token" type="string">
  The generated API token.
</ResponseField>

<ResponseField name="refresh_token_exp" type="number">
  Unix timestamp of the expiration of the refresh token.

  (The refresh token is returned in cookies).
</ResponseField>


# Test an API Token
Source: https://api.docs.flare.io/api-reference/tokens/endpoints/test

GET https://api.flare.io/tokens/test

This endpoint can be used to test the validity of an API token.

For more information about authentication, see the
[API Authentication Guide <Icon icon="book" />](/concepts/authentication/).

<ResponseExample>
  ```json Response Example theme={null}
  {
    "api_key_id": 123,
    "organization_id": 456,
    "scopes": [
      "authenticated",
      "apikey",
      "firework",
    ],
    "tenant_id": 789,
    "user_email": "user@example.com",
    "user_id": 42
  }
  ```
</ResponseExample>

## Response Fields

<ResponseField name="tenant_id" type="number">
  The currently authenticated tenant id.
</ResponseField>

<ResponseField name="api_key_id" type="number">
  The ID of the API Key that was used to generate this tenant.
</ResponseField>


# Retrieve Event
Source: https://api.docs.flare.io/api-reference/v2/endpoints/activities/get-fireworkv2activities-

firework-v2-openapi get /firework/v2/activities/

This response changes based on the event type, for more information the various possible responses, see
[Event Types <Icon icon="book" />](/event-types/overview).

<Note>
  For backwards compatibility, this endpoint is also available as `/firework/v2/activities/{index}/{source}/{id}`.
</Note>

<ResponseExample>
  ```plaintext Response Example theme={null}
  This response changes based on the event type.
  ```
</ResponseExample>


# Retrieve Event AI Assistance
Source: https://api.docs.flare.io/api-reference/v2/endpoints/activities/get-fireworkv2activities--ai_assistance

firework-v2-openapi get /firework/v2/activities/{index}/{source}/{id}/ai_assistance



# Delete Identifier
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/delete-fireworkv2assets

firework-v2-openapi delete /firework/v2/assets/{asset_id}

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/firework/v4/identifiers/\{identifier\_id} <Icon icon="code" />](/api-reference/v4/endpoints/delete-identifier)
</Warning>


# Delete Identifier Alerts
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/delete-fireworkv2assets-alerts

firework-v2-openapi delete /firework/v2/assets/{asset_id}/alerts/{alert_id}



# Delete Identifier Group
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/delete-fireworkv2assetsgroups

firework-v2-openapi delete /firework/v2/assets/groups/{assets_group_id}



# Delete Identifier Group Alert
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/delete-fireworkv2assetsgroups-alerts

firework-v2-openapi delete /firework/v2/assets/groups/{assets_group_id}/alerts/{alert_id}



# List Identifier Alerts
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/get-fireworkv2assets-alerts

firework-v2-openapi get /firework/v2/assets/{asset_id}/alerts



# List Identifier Events
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/get-fireworkv2assets-feed

firework-v2-openapi get /firework/v2/assets/{asset_id}/feed

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/firework/v4/events/identifiers/\{identifier\_id}/\_search <Icon icon="code" />](/api-reference/v4/endpoints/identifier-feed)
</Warning>


# List Identifier Groups
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/get-fireworkv2assetsgroups

firework-v2-openapi get /firework/v2/assets/groups/



# Retrieve Identifier Group
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/get-fireworkv2assetsgroups-1

firework-v2-openapi get /firework/v2/assets/groups/{assets_group_id}



# List Identifier Group Alerts
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/get-fireworkv2assetsgroups-alerts

firework-v2-openapi get /firework/v2/assets/groups/{assets_group_id}/alerts



# List Identifier Groups Events
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/get-fireworkv2assetsgroups-feed

firework-v2-openapi get /firework/v2/assets/groups/{assets_group_id}/feed

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/firework/v4/events/identifier\_groups/\{identifier\_group\_id}/\_search <Icon icon="code" />](/api-reference/v4/endpoints/identifier-group-feed)
</Warning>


# Create Identifier
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/post-fireworkv2assets

firework-v2-openapi post /firework/v2/assets/

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/firework/v4/identifiers/ <Icon icon="code" />](/api-reference/v4/endpoints/create-identifier)
</Warning>


# Create Identifier Alert
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/post-fireworkv2assets-alerts

firework-v2-openapi post /firework/v2/assets/{asset_id}/alerts



# Enable/Disable Identifier
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/post-fireworkv2assets-toggle

firework-v2-openapi post /firework/v2/assets/{asset_id}/toggle

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/firework/v4/identifiers/\{identifier\_id} <Icon icon="code" />](/api-reference/v4/endpoints/update-identifier)
</Warning>


# Create Identifier Groups
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/post-fireworkv2assetsgroups

firework-v2-openapi post /firework/v2/assets/groups/



# Create Identifier Group Alerts
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/post-fireworkv2assetsgroups-alerts

firework-v2-openapi post /firework/v2/assets/groups/{assets_group_id}/alerts



# Update Identifier
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/put-fireworkv2assets

firework-v2-openapi put /firework/v2/assets/{asset_id}

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/firework/v4/identifiers/\{identifier\_id} <Icon icon="code" />](/api-reference/v4/endpoints/update-identifier)
</Warning>


# Update Identifier Alert
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/put-fireworkv2assets-alerts

firework-v2-openapi put /firework/v2/assets/{asset_id}/alerts/{alert_id}



# Update Identifier Group Alert
Source: https://api.docs.flare.io/api-reference/v2/endpoints/identifiers/put-fireworkv2assetsgroups-alerts

firework-v2-openapi put /firework/v2/assets/groups/{assets_group_id}/alerts/{alert_id}



# List Tenant Events
Source: https://api.docs.flare.io/api-reference/v2/endpoints/me/get-fireworkv2mefeed

firework-v2-openapi get /firework/v2/me/feed

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/firework/v4/events/tenant/\_search <Icon icon="code" />](/api-reference/v4/endpoints/current-tenant-feed)
</Warning>


# List Tenant Credentials
Source: https://api.docs.flare.io/api-reference/v2/endpoints/me/get-fireworkv2mefeedcredentials

firework-v2-openapi get /firework/v2/me/feed/credentials

This endpoint will list all credentials that match the current tenant's monitored identifiers.


# Retrieve User Profile
Source: https://api.docs.flare.io/api-reference/v2/endpoints/me/get-fireworkv2meprofile

firework-v2-openapi get /firework/v2/me/profile



# List User Tenants
Source: https://api.docs.flare.io/api-reference/v2/endpoints/me/get-fireworkv2metenants

firework-v2-openapi get /firework/v2/me/tenants



# Update User Profile
Source: https://api.docs.flare.io/api-reference/v2/endpoints/me/put-fireworkv2meprofile

firework-v2-openapi put /firework/v2/me/profile



# List Organization Members
Source: https://api.docs.flare.io/api-reference/v2/endpoints/organizations/get-fireworkv2organizations-members

firework-v2-openapi get /firework/v2/organizations/{organization_id}/members



# Retrieve Organization Member
Source: https://api.docs.flare.io/api-reference/v2/endpoints/organizations/get-fireworkv2organizations-members-1

firework-v2-openapi get /firework/v2/organizations/{organization_id}/members/{user_id}



# List Organization Member Tenants
Source: https://api.docs.flare.io/api-reference/v2/endpoints/organizations/get-fireworkv2organizations-members-tenants

firework-v2-openapi get /firework/v2/organizations/{organization_id}/members/{user_id}/tenants



# List Organization Tenants
Source: https://api.docs.flare.io/api-reference/v2/endpoints/organizations/get-fireworkv2organizations-tenants

firework-v2-openapi get /firework/v2/organizations/{organization_id}/tenants



# Create Organization Member
Source: https://api.docs.flare.io/api-reference/v2/endpoints/organizations/post-fireworkv2organizations-members

firework-v2-openapi post /firework/v2/organizations/{organization_id}/members



# Disable Organization Member
Source: https://api.docs.flare.io/api-reference/v2/endpoints/organizations/post-fireworkv2organizations-members-disable

firework-v2-openapi post /firework/v2/organizations/{organization_id}/members/{user_id}/disable



# Enable Organization Member
Source: https://api.docs.flare.io/api-reference/v2/endpoints/organizations/post-fireworkv2organizations-members-enable

firework-v2-openapi post /firework/v2/organizations/{organization_id}/members/{user_id}/enable



# Update Organization Member Permissions
Source: https://api.docs.flare.io/api-reference/v2/endpoints/organizations/post-fireworkv2organizations-members-permissions

firework-v2-openapi post /firework/v2/organizations/{organization_id}/members/{user_id}/permissions



# Create Organization Tenant
Source: https://api.docs.flare.io/api-reference/v2/endpoints/organizations/post-fireworkv2organizations-tenants

firework-v2-openapi post /firework/v2/organizations/{organization_id}/tenants



# Update Organization Member
Source: https://api.docs.flare.io/api-reference/v2/endpoints/organizations/put-fireworkv2organizations-members

firework-v2-openapi put /firework/v2/organizations/{organization_id}/members/{user_id}



# Delete Report
Source: https://api.docs.flare.io/api-reference/v2/endpoints/reporting/delete-fireworkv2reportingreports

firework-v2-openapi delete /firework/v2/reporting/reports/{report_id}



# List Reports
Source: https://api.docs.flare.io/api-reference/v2/endpoints/reporting/get-fireworkv2reportingreports

firework-v2-openapi get /firework/v2/reporting/reports



# Retrieve Report
Source: https://api.docs.flare.io/api-reference/v2/endpoints/reporting/get-fireworkv2reportingreports-1

firework-v2-openapi get /firework/v2/reporting/reports/{report_id}



# Download Report
Source: https://api.docs.flare.io/api-reference/v2/endpoints/reporting/get-fireworkv2reportingreports-download

firework-v2-openapi get /firework/v2/reporting/reports/{report_id}/download



# Update Report
Source: https://api.docs.flare.io/api-reference/v2/endpoints/reporting/patch-fireworkv2reportingreports

firework-v2-openapi patch /firework/v2/reporting/reports/{report_id}



# Create Report
Source: https://api.docs.flare.io/api-reference/v2/endpoints/reporting/post-fireworkv2reportingreports

firework-v2-openapi post /firework/v2/reporting/reports



# Archive Report
Source: https://api.docs.flare.io/api-reference/v2/endpoints/reporting/post-fireworkv2reportingreports-archive

firework-v2-openapi post /firework/v2/reporting/reports/{report_id}/archive



# Search
Source: https://api.docs.flare.io/api-reference/v2/endpoints/search/get-fireworkv2search

firework-v2-openapi get /firework/v2/search/

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/firework/v4/events/global/\_search <Icon icon="code" />](/api-reference/v4/endpoints/global-search)
</Warning>

<Note>
  This endpoint is subject to quotas and is subject to the `Search` ratelimiting tier.
  See
  [Rate Limits and Quotas <Icon icon="book" />](/concepts/rate-limits-and-quotas).
</Note>


# Search
Source: https://api.docs.flare.io/api-reference/v2/endpoints/search/post-fireworkv2search

firework-v2-openapi post /firework/v2/search/

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/firework/v4/events/global/\_search <Icon icon="code" />](/api-reference/v4/endpoints/global-search)
</Warning>

<Note>
  This endpoint is subject to quotas and is subject to the `Search` ratelimiting tier.
  See
  [Rate Limits and Quotas <Icon icon="book" />](/concepts/rate-limits-and-quotas).
</Note>


# Delete Tenant Membership
Source: https://api.docs.flare.io/api-reference/v2/endpoints/tenants/delete-fireworkv2tenants-users

firework-v2-openapi delete /firework/v2/tenants/{tenant_id}/users/{user_id}



# Retrieve Tenant
Source: https://api.docs.flare.io/api-reference/v2/endpoints/tenants/get-fireworkv2tenants

firework-v2-openapi get /firework/v2/tenants/{tenant_id}



# List Tenant Memberships
Source: https://api.docs.flare.io/api-reference/v2/endpoints/tenants/get-fireworkv2tenants-users

firework-v2-openapi get /firework/v2/tenants/{tenant_id}/users



# Archive Organization Tenant
Source: https://api.docs.flare.io/api-reference/v2/endpoints/tenants/post-fireworkv2tenants-archive

firework-v2-openapi post /firework/v2/tenants/{tenant_id}/archive



# Create Tenant Membership
Source: https://api.docs.flare.io/api-reference/v2/endpoints/tenants/post-fireworkv2tenants-users

firework-v2-openapi post /firework/v2/tenants/{tenant_id}/users



# Update Tenant
Source: https://api.docs.flare.io/api-reference/v2/endpoints/tenants/put-fireworkv2tenants

firework-v2-openapi put /firework/v2/tenants/{tenant_id}



# List Identifiers
Source: https://api.docs.flare.io/api-reference/v3/endpoints/identifiers/get-fireworkv3identifiers

firework-v3-openapi get /firework/v3/identifiers/

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/firework/v4/identifiers/ <Icon icon="code" />](/api-reference/v4/endpoints/list-identifiers)
</Warning>


# Retrieve Identifier
Source: https://api.docs.flare.io/api-reference/v3/endpoints/identifiers/get-fireworkv3identifiers-1

firework-v3-openapi get /firework/v3/identifiers/{identifier_id}

<Warning>
  **DEPRECATED:** This endpoint should be replaced by
  [/firework/v4/identifiers/\{identifier\_id} <Icon icon="code" />](/api-reference/v4/endpoints/retrieve-identifier)
</Warning>


# List Identifier Credentials
Source: https://api.docs.flare.io/api-reference/v3/endpoints/identifiers/get-fireworkv3identifiers-feedcredentials

firework-v3-openapi get /firework/v3/identifiers/{identifier_id}/feed/credentials



# Assign Policy (Beta)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/assign-policy

firework-v4-openapi post /firework/v4/matching-policies/{policy_uuid}/assignments

<Note>
  The  endpoint is still in beta and is subject to change.
</Note>


# Identifier Recommendation Actions (accept, reject)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/create-action-for-identifier-recommendations

firework-v4-openapi post /firework/v4/identifier-recommendations/actions



# Create Identifier
Source: https://api.docs.flare.io/api-reference/v4/endpoints/create-identifier

firework-v4-openapi post /firework/v4/identifiers/



# Create Matching Policy (Beta)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/create-matching-policy

firework-v4-openapi post /firework/v4/matching-policies

<Note>
  The  endpoint is still in beta and is subject to change.
</Note>


# Create Report Request
Source: https://api.docs.flare.io/api-reference/v4/endpoints/create-report-request

firework-v4-openapi post /firework/v4/threat_flow/reports/requests

## Guides

See the guide for using this endpoint:
[Generate a Threat Flow Report <Icon icon="book" />](/guides/threat-flow-report).


# Credential actions (ignore, remediate, etc.)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/credential-actions

POST https://api.flare.io/firework/v4/credentials/actions

Apply an action to a list of credentials (ignore, remediate, etc.).

## Body parameters

<ParamField type="object">
  The action applied to Credentials.

  <Expandable>
    <ParamField type="string">
      <Expandable title="valid types">
        `ignore`
        `remediate`
        `unignore`
        `unremediate`
      </Expandable>
    </ParamField>
  </Expandable>
</ParamField>

<ParamField type="object[]">
  List of targets where the action applied (max 100).

  <Expandable>
    <ParamField type="string" />
  </Expandable>
</ParamField>


# Search Credentials
Source: https://api.docs.flare.io/api-reference/v4/endpoints/credentials-global-search

firework-v4-openapi post /firework/v4/credentials/global/_search

<Note>
  This endpoint is subject to quotas and is subject to the `Search` ratelimiting tier.
  See
  [Rate Limits and Quotas <Icon icon="book" />](/concepts/rate-limits-and-quotas).
</Note>

<Note>
  Flare supports searching in credentials via two endpoints:

  * The [Global Credentials Search endpoint <Icon icon="code" />](/api-reference/v4/endpoints/credentials-global-search): This endpoint counts towards your global search quota.
  * The [ASTP Credentials Search Endpoint <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search): This endpoint does <b>not</b> count towards your search quota but requires ASTP to be enabled on your account. For more information about ASTP, contact your Customer Success Manager.
</Note>

Returns a list of credentials matching the query provided.

<ResponseExample>
  ```json Response Example theme={null}
  {
      "items": [
          {
              "auth_domains": ["login.live.com"],
              "domain": "scatterholt.com",
              "hash": "B@dPassw0rd",
              "hash_type": null,
              "id": 33880703907,
              "identity_name": "ryan.howard@scatterholt.com",
              "imported_at": "2024-07-22T19:25:52.893439+00:00",
              "known_password_id": null,
              "source": {
                  "breached_at": null,
                  "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
                  "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
                  "id": "combolists",
                  "is_alert_enabled": true,
                  "leaked_at": null,
                  "name": "Combolists"
              },
              "source_id": "combolists"
          },
          {
              "auth_domains": ["www.facebook.com", "discord.com"],
              "domain": "scatterholt.com",
              "hash": "1qaz2wsx",
              "hash_type": "unknown",
              "id": 33880703906,
              "identity_name": "ryan.howard@scatterholt.com",
              "imported_at": "2024-07-22T19:25:52.893439+00:00",
              "known_password_id": null,
              "source": {
                  "breached_at": null,
                  "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
                  "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
                  "id": "combolists",
                  "is_alert_enabled": true,
                  "leaked_at": null,
                  "name": "Combolists"
              },
              "source_id": "combolists"
          }
      ],
      "next": "WyJjb20uc2NhdHRlcmhvbHQiLCAxNjczNjg4ODg4NV0"
  }
  ```
</ResponseExample>

## Paging

This endpoint supports the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

## Body Parameters

<ParamField type="number">
  Maximum size of the JSON object that will be returned (maximum 10 000)
</ParamField>

<ParamField type="string">
  The `next` value from the last response.
</ParamField>

<ParamField type="string">
  The order in which the results will be returned. (`asc` or `desc`)
</ParamField>

<ParamField type="string[]">
  Additional fields to return. Available options:

  * `known_password_id`: ID of the credential's password.
  * `auth_domains`: for each credential, up to 100 hosts (domain only, e.g. `login.example.com`) where the credential was seen being used.
</ParamField>

<ParamField type="object">
  One of the supported queries.

  <Tabs>
    <Tab title="Domain Query">
      This query will match all credentials that contain the specified domain in the email address.

      ```json theme={null}
      {
        "type": "domain",
        "fqdn": "<string>"
      }
      ```
    </Tab>

    <Tab title="Auth Domain Query">
      This query will match the domain of the service that this credential might have been used to log in to.

      ```json theme={null}
      {
        "type": "auth_domain",
        "fqdn": "<string>"
      }
      ```
    </Tab>

    <Tab title="Password Query">
      This query will match all credentials that contain the specified password.

      ```json theme={null}
      {
        "type": "secret",
        "secret": "<string>"
      }
      ```
    </Tab>

    <Tab title="Email Query">
      This query will match all credentials for the exact email address.

      ```json theme={null}
      {
        "type": "email",
        "email": "<string>"
      }
      ```
    </Tab>

    <Tab title="Keyword Query">
      This query will match with the credential's username, which is the portion of the `identity_name` that preceeds `@`.

      ```json theme={null}
      {
        "type": "keyword",
        "keyword": "<string>"
      }
      ```
    </Tab>
  </Tabs>
</ParamField>

<ParamField type="object">
  <Expandable>
    <ParamField type="object">
      <Expandable>
        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values greater than or equal to the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values lesser than or equal to the specified timestamp.

          Format: ISO-8601
        </ParamField>
      </Expandable>
    </ParamField>
  </Expandable>
</ParamField>


# List Tenant Events
Source: https://api.docs.flare.io/api-reference/v4/endpoints/current-tenant-feed

POST https://api.flare.io/firework/v4/events/tenant/_search

Returns a list of events matching the identifiers of the current tenant.

## Guides

See the guide for using this endpoint:
[Exporting a Tenant's Events <Icon icon="book" />](/guides/tenant-events).

<ResponseExample>
  ```json Response Example theme={null}
  {
      "items": [
          {
              "metadata": {
                  "estimated_created_at": "2019-09-20T16:30:37.589388Z",
                  "matched_at": "2019-09-21T10:15:22.123456Z",
                  "type": "listing",
                  "uid": "listing/apollon_market/9861",
                  "severity": "critical"
              },
              "tenant_metadata": {
                  "severity": {
                      "original": "low",
                      "override": "critical"
                  },
                  "tags": [
                      "important",
                  ],
                  "notes": "This reason why this is tagged as 'important' is: ..."
              },
              "identifiers": [
                  {
                      "id": 1,
                      "name": "An identifier"
                  }
              ],
              "highlights": {
                  "description": [
                      "Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
                  ],
                  "title": [
                      "Bank Statement PSD <mark>Template</mark>"
                  ]
              }
          }
      ],
      "next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
  }
  ```
</ResponseExample>

## Paging

This endpoint supports the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

## Body Parameters

<ParamField type="object">
  One of the supported queries.&#x20;

  <CodeGroup>
    ```json Domain theme={null}
    {
      "type": "domain",
      "fqdn": "<string>"
    }
    ```

    ```json Email theme={null}
    {
      "type": "email",
      "email": "<string>"
    }
    ```

    ```json Keyword theme={null}
    {
      "type": "keyword",
      "keyword": "<string>"
    }
    ```

    ```json Query String theme={null}
    {
      "type": "query_string",
      "query_string": "<string>"
    }
    ```

    ```json Username theme={null}
    {
      "type": "username",
      "username": "<string>"
    }
    ```

    ```json GitHub Repository theme={null}
    {
      "type": "github_repository",
      "repo_owner": "<string>"
      "repo_name": "<string>"
    }
    ```

    ```json Brand theme={null}
    {
      "type": "brand",
      "name": "<string>"
    }
    ```

    ```json Name theme={null}
    {
      "type": "name",
      "first_name": "<string>"
      "last_name": "<string>"
      "is_strict": "<boolean>"
    }
    ```

    ```json CC Bin theme={null}
    {
      "type": "bin",
      "bin": "<string>"
    }
    ```

    ```json IP theme={null}
    {
      "type": "ip",
      "ip": "<string>"
    }
    ```

    ```json Credentials theme={null}
    {
      "type": "credentials",
      "username": "<string>"
      "password": "<string>"
    }
    ```

    ```json Secret theme={null}
    {
      "type": "secret",
      "secret": "<string>"
    }
    ```

    ```json Azure Tenant theme={null}
    {
      "type": "azure_tenant",
      "tenant_id": "<string>"
    }
    ```
  </CodeGroup>
</ParamField>

<ParamField type="number">
  Limit number of events that will be returned. (Max 10)
</ParamField>

<ParamField type="string">
  The `next` value from the last response.
</ParamField>

<ParamField type="string">
  The order in which the results will be returned.

  <Expandable title="valid order values">
    `asc`
    `desc`
  </Expandable>
</ParamField>

<ParamField type="object">
  <Expandable>
    <ParamField type="string[]">
      If a string value is specified, results will contain events that have a greater than or equal severity. Otherwise, if an array of severities is specified, results will only contain events that exactly match one of them.

      <Expandable title="valid severity values">
        `info`
        `low`
        `medium`
        `high`
        `critical`
      </Expandable>
    </ParamField>

    <ParamField type="string[]">
      <Expandable title="valid type values">
        `illicit_networks`
        `open_web`
        `leak`
        `domain`
        `listing`
        `forum_content`
        `blog_content`
        `profile`
        `chat_message`
        `ransomleak`
        `infected_devices`
        `financial_data`
        `paste`
        `social_media`
        `source_code`
        `google`
        `service`
        `buckets`
      </Expandable>

      Learn more about [Event Source Filters <Icon icon="book" />](/advanced/event-source-filters).
    </ParamField>

    <ParamField type="object">
      <Expandable>
        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values greater than the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values greater than or equal to the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values lesser than the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values lesser than or equal to the specified timestamp.

          Format: ISO-8601
        </ParamField>
      </Expandable>
    </ParamField>

    <ParamField type="string[]">
      If provided, results will be filtered on the tags.
    </ParamField>

    <ParamField type="string[]">
      If provided, results will only contain events that match one of the specified statuses.

      <Expandable title="valid status values">
        `open`
        `ignored`
        `remediated`
      </Expandable>
    </ParamField>

    <ParamField type="bool">
      If set to true, results will be filtered to be events that have been ignored.
    </ParamField>

    <ParamField type="bool">
      If set to true, results will be filtered to be events that have been remediated.
    </ParamField>
  </Expandable>
</ParamField>


# Delete Identifier
Source: https://api.docs.flare.io/api-reference/v4/endpoints/delete-identifier

firework-v4-openapi delete /firework/v4/identifiers/{identifier_id}

<Note>
  The deletion process for an identifier and its related resources may require up to one hour to complete.
</Note>


# Delete Matching Policy (Beta)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/delete-matching-policy

firework-v4-openapi delete /firework/v4/matching-policies/{policy_uuid}

<Note>
  The  endpoint is still in beta and is subject to change.
</Note>


# Event actions (ignore, remediate, etc.)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/event-actions

POST https://api.flare.io/firework/v4/events/actions

Apply an action to a list of events (ignore, remediate, etc.).

## Body parameters

<ParamField type="object">
  The action applied to events.

  <Expandable>
    <ParamField type="string">
      <Expandable title="valid types">
        `ignore`
        `remediate`
        `unignore`
        `unremediate`
      </Expandable>
    </ParamField>
  </Expandable>
</ParamField>

<ParamField type="object[]">
  List of targets where the action will be applied (max 10).

  <Expandable>
    <ParamField type="string" />
  </Expandable>
</ParamField>


# Expand Event V2 Field (Beta)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/expand-event-field

firework-v4-openapi get /firework/v4/events/_expand

Returns a page of items for a particular expanded field in a specified event.

<Panel>
  <ResponseExample>
    ```json StealerLogCookies theme={null}
    {
        "items": [
            {
                "host_key": "example.com",
                "path": "/",
                "expires_utc": "2025-01-01T00:00:00",
                "name": "example",
                "value": "🍪"
            }
        ],
        "next": null
    }
    ```

    ```json StealerLogCredentials theme={null}
    {
        "items": [
            {
                "url": "https://example.com",
                "username": "john_doe",
                "password": "hunter2",
                "application": "application"
            }
        ],
        "next": null
    }
    ```
  </ResponseExample>
</Panel>

### Expandable fields

The following fields can be expanded for the given event type.

<Tabs>
  <Tab title="Stealer Log">`cookies` `credentials`</Tab>
</Tabs>


# List Identifier Recommendations
Source: https://api.docs.flare.io/api-reference/v4/endpoints/fetch-identifier-recommendations

firework-v4-openapi get /firework/v4/identifier-recommendations/



# Retrieve Event V2 (Beta)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/get-event

firework-v4-openapi get /firework/v4/events/

<Panel>
  <ResponseExample>
    ```json Blog Post theme={null}
    {
        "event_type": "blog_post",
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        },
        "data": {
            "url": "https://www.blog_name.com/post_slug",
            "content": "Post content",
            "description": "Post description",
            "posted_at": "2025-01-01T00:00:00"
        }
    }
    ```

    ```json Bot theme={null}
    {
        "event_type": "bot",
        "data": {
            "name": "Hacker Market - Bots",
            "url": "https://bot.market.com/market/bot/1234",
            "actor": {
                "id": "A1B2C3"
            },
            "victim_information": {
                "country_code": "CA",
                "location": "City, Country",
                "isp": "Internet Service Provider",
                "installed_at": "2026-07-22T00:00:00",
                "os": "Windows 7"
            },
            "price": "19.99",
            "currency": "usd"
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Bucket theme={null}
    {
        "event_type": "bucket",
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        },
        "data": {
            "url": "https://bucket.public.com/file.txt",
            "bucket": {
                "host": "bucket.public.com",
                "provider": "s3"
            }
        }
    }
    ```

    ```json Bucket Object theme={null}
    {
        "event_type": "bucket_object",
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        },
        "data": {
            "url": "https://bucket.public.com/file.txt",
            "bucket": {
                "host": "bucket.public.com",
                "provider": "s3"
            }
        }
    }
    ```

    ```json Chat Message theme={null}
    {
        "event_type": "chat_message",
        "data": {
            "posted_at": "2025-01-01T00:00:00",
            "actor": {
                "id": "7432892726",
                "name": "chatty_cathy"
            },
            "context": {
                "conversation_id": "end_index",
                "conversation_name": "interesting chat"
            },
            "content": "This is the content of the message",
            "parent_context": {
                "parent_uid": "parent_uid",
                "parent_type": "parent_type"
            },
            "forward_info": {
                "forwarded_from": "forwarded_from",
                "forwarded_from_author_id": "forwarded_from_author_id",
                "forwarded_from_chat_id": 1,
                "forwarded_from_conversation_id": "forwarded_from_conversation_id",
                "forwarded_from_user_id": 1,
                "forwarded_from_username": "forwarded_from_username",
                "forwarded_message_time": "2025-01-01T00:00:00"
            },
            "was_forwarded": false
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Credit Card theme={null}
    {
        "event_type": "cc",
        "data": {
            "bank": "Bank of the North",
            "bin": "12345",
            "brand": "VISA",
            "country": "NP",
            "expiration": "2030-05-01T00:00:00",
            "owner": "BOW",
            "state_code": "SW",
            "zip": "H0H0H0",
            "has_cvv": true,
            "has_date_of_birth": false,
            "has_mother_maiden_name": false,
            "has_phone": true,
            "has_pin": null,
            "has_ssn": false,
            "has_track_1": null,
            "has_vbv": null
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Docker Image theme={null}
    {
        "event_type": "docker_image",
        "data": {
            "content": "Docker image description",
            "digest": "sha256:e4b991038fd226016a60046db2109bf634f7f4b4ea9a2c548b559d3652e4cc38",
            "architecture": "amd64",
            "os": "linux",
            "last_pushed_at": "2025-01-01T00:00:00",
            "last_pulled_at": "2025-01-01T00:00:00",
            "tags": [
                {
                    "name": "latest",
                    "repository_name": "flared/docker"
                }
            ]
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Docker Repository theme={null}
    {
        "event_type": "docker_repository",
        "data": {
            "url": "https://hub.docker.com/r/flared/docker",
            "star_count": 5,
            "pull_count": 10000,
            "collaborator_count": 2,
            "last_updated_at": "2026-01-01T00:00:00",
            "last_modified_at": "2025-01-01T00:00:00",
            "registered_at": "2024-01-01T00:00:00"
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Forum Post theme={null}
    {
        "event_type": "forum_post",
        "data": {
            "actor": {
                "id": "123456",
                "name": "John Doe"
            },
            "context": {
                "category_name": "Food & Drink",
                "topic_id": "1010",
                "topic_title": "Top 10 Pasta Recipes"
            },
            "posted_at": "2025-01-01T00:00:00",
            "content": "These are my favourite recipes for pasta!",
            "url": "https://forum.com/post/1010"
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Invalid Credential theme={null}
    {
        "event_type": "invalid_credential",
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        },
        "data": {
            "identity_name": "john.doe@example.com",
            "credential_hash": "a1b2c3d4e5f67890",
            "tenant_integration_id": "00000000-0000-0000-0000-000000000001"
        }
    }
    ```

    ```json Leak theme={null}
    {
        "event_type": "leak",
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        },
        "data": {
            "term": "leakforum",
            "site_url": "leakforum.com",
            "leaked_at": "2024-01-10T00:00:00",
            "breached_at": "2024-01-10T00:00:00",
            "leaked_credential_count": 2,
            "pii_tags": [
                "Emails"
            ],
            "source": {
                "id": "leak_forum",
                "name": "Leak Forum"
            }
        }
    }
    ```

    ```json Leaked Credential theme={null}
    {
        "event_type": "leaked_credential",
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        },
        "data": {
            "identity_name": "identity_name",
            "imported_at": "2025-01-01T00:00:00",
            "password": "password",
            "source": {
                "id": "url_login_pass",
                "name": "URL Login Pass"
            }
        }
    }
    ```

    ```json Listing theme={null}
    {
        "event_type": "listing",
        "data": {
            "url": "http://b14ckm4rk3t.onion/product/123456789",
            "title": "Something for sale",
            "content": "Long item description",
            "currency": "eur",
            "escrow": true,
            "price": 38.0,
            "ship_to": [
                "Europe"
            ],
            "ship_from": [
                "Spain"
            ],
            "stock_count": 5,
            "actor": {
                "id": "ddc591f1257ab24eee28435286945abc0520",
                "name": "goodie_seller"
            },
            "classification": {
                "classes": {
                    "is_carding": false,
                    "is_bypass": true,
                    "is_ident_fraud": false,
                    "is_doc_fraud": true,
                    "is_phishing": true,
                    "is_money_xfer": true,
                    "is_cashout": false,
                    "is_virt_currency": false,
                    "is_hacking": false,
                    "is_misc_financial": false
                },
                "types": {
                    "is_guide": false,
                    "is_service": false,
                    "is_software": true,
                    "is_hardware": false,
                    "is_data": false
                }
            },
            "context": {
                "category_name": "Goodies"
            }
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Lookalike Domain theme={null}
    {
        "event_type": "lookalike",
        "data": {
            "domain": "importante.com",
            "registered_at": "2025-01-01T00:00:00",
            "identifier_domains": [
                "important.co"
            ],
            "feed": null,
            "cert_data": null,
            "subject": null,
            "issuer": "/C=US/CN=R3/O=Let's Encrypt"
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Mitigated Credential theme={null}
    {
        "event_type": "mitigated_credential",
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        },
        "data": {
            "identity_name": "john.doe@example.com",
            "credential_hash": "a1b2c3d4e5f67890",
            "tenant_integration_id": "00000000-0000-0000-0000-000000000001",
            "mitigation_action": "disable_account"
        }
    }
    ```

    ```json Paste theme={null}
    {
        "event_type": "paste",
        "data": {
            "url": "https://www.scribd.com/document/244878934/Final-Research",
            "title": "Final Research",
            "content": "a very long and passionate text",
            "actor": {
                "id": "Whydontweknowper",
                "name": "Marcelo"
            },
            "expires_at": "2023-01-01T00:00:00Z",
            "syntax": "python"
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Ransom Leak theme={null}
    {
        "event_type": "ransomleak",
        "data": {
            "url": "http://payupnow.onion/leaks.php",
            "response_url": "http://payupnow.onion/leaks.php",
            "title": "Leak Name - Victim Name",
            "content": "Ransom Leak Listing Content",
            "body": "Ransom Leak Listing Body",
            "victim_information": {
                "name": "Victim Name",
                "display_name": "Victim Name",
                "domain": "victim-domain.com",
                "alternative_domains": [
                    "victim.co"
                ],
                "industry": "Non-Profit",
                "employee_count": 1,
                "city": "New York",
                "state": "New York",
                "country": "USA",
                "latitude": 123.456,
                "longitude": 123.456
            }
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Service theme={null}
    {
        "event_type": "service",
        "data": {
            "url": "https://www.example.com",
            "asn": "AS64496",
            "content": "<!DOCTYPE html>\n<html>\n<head>\n    <title>Example Domain</title>\n</head>\n<body>\n    <h1>Example Domain</h1>\n</body>\n</html>",
            "service": "https",
            "product": "Apache httpd",
            "port": 443,
            "ip_address": "192.0.2.10",
            "organization": "Example Hosting Inc.",
            "hostname": "www.example.com",
            "country_code": "US",
            "vulnerabilities": [
                "CVE-2021-41773"
            ]
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Social Media Account theme={null}
    {
        "event_type": "social_media_account",
        "data": {
            "url": "https://social.net/user/coolgi",
            "site": "SocialNet",
            "username": "john_nolan"
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Stealer Log theme={null}
    {
        "event_type": "stealer_log",
        "data": {
            "victim_information": {
                "ip_address": "127.0.0.1",
                "ip_network": "127.0.0.0/8",
                "username": "admin",
                "country_code": "USA",
                "zip_code": null,
                "location": null,
                "hwid": null,
                "current_language": "en-US",
                "screensize_width": 1920,
                "screensize_height": 1080,
                "timezone": "UTC+7",
                "os": "Windows 10 22H2 Pro (Build 19045) (64 Bit)",
                "uac": null,
                "process_elevation": false,
                "available_keyboards": [
                    "en-US"
                ],
                "hardware": [
                    "CPU: Intel(R) Core(TM) i3-10105F CPU @ 3.70GHz (4 cores, 8 threads)",
                    "RAM: 31.92 GB",
                    "HOSTNAME: DESKTOP-123456"
                ],
                "anti_viruses": [
                    "Windows Defender",
                    "Avast Antivirus"
                ]
            },
            "malware_information": {
                "malware_family": "Lumastealer",
                "build_id": "1234567890",
                "file_location": "C:\\Windows\\System32\\malware.exe",
                "infected_at": "2025-01-01T00:00:00"
            }
        },
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        }
    }
    ```

    ```json Valid Credential theme={null}
    {
        "event_type": "valid_credential",
        "metadata": {
            "estimated_created_at": "2025-01-01T00:00:00",
            "flare_url": "https://app.flare.io/#/uid",
            "matched_at": null,
            "severity": "info",
            "uid": "index/source/id"
        },
        "data": {
            "identity_name": "john.doe@example.com",
            "credential_hash": "a1b2c3d4e5f67890",
            "tenant_integration_id": "00000000-0000-0000-0000-000000000001"
        }
    }
    ```
  </ResponseExample>
</Panel>

<Note>
  The  endpoint is still in beta and is subject to change.
</Note>


# Retrieve Matching Policy (Beta)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/get-matching-policy

firework-v4-openapi get /firework/v4/matching-policies/{policy_uuid}

<Note>
  The  endpoint is still in beta and is subject to change.
</Note>


# Get Report Request
Source: https://api.docs.flare.io/api-reference/v4/endpoints/get-report-request

firework-v4-openapi get /firework/v4/threat_flow/reports/requests/{request_info_id}

## Guides

See the guide for using this endpoint:
[Generate a Threat Flow Report <Icon icon="book" />](/guides/threat-flow-report).


# Search Events
Source: https://api.docs.flare.io/api-reference/v4/endpoints/global-search

POST https://api.flare.io/firework/v4/events/global/_search

<Note>
  This endpoint is subject to quotas and is subject to the `Search` ratelimiting tier.
  See
  [Rate Limits and Quotas <Icon icon="book" />](/concepts/rate-limits-and-quotas).
</Note>

## Guides

See the guide for using this endpoint:
[Search in All of Flare's Events <Icon icon="book" />](/guides/global-search).

<ResponseExample>
  ```json Response Example theme={null}
  {
      "items": [
          {
              "metadata": {
                  "estimated_created_at": "2019-09-20T16:30:37.589388Z",
                  "matched_at": "2019-09-21T10:15:22.123456Z",
                  "type": "listing",
                  "uid": "listing/apollon_market/9861",
                  "severity": "critical"
              },
              "tenant_metadata": {
                  "severity": {
                      "original": "low",
                      "override": "critical"
                  },
                  "tags": [
                      "important",
                  ],
                  "notes": "This reason why this is tagged as 'important' is: ..."
              },
              "highlights": {
                  "description": [
                      "Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
                  ],
                  "title": [
                      "Bank Statement PSD <mark>Template</mark>"
                  ]
              }
          }
      ],
      "next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
  }
  ```
</ResponseExample>

## Paging

This endpoint supports the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

## Body Parameters

<ParamField type="object">
  One of the supported queries.&#x20;

  <CodeGroup>
    ```json Domain theme={null}
    {
      "type": "domain",
      "fqdn": "<string>"
    }
    ```

    ```json Email theme={null}
    {
      "type": "email",
      "email": "<string>"
    }
    ```

    ```json Keyword theme={null}
    {
      "type": "keyword",
      "keyword": "<string>"
    }
    ```

    ```json Query String theme={null}
    {
      "type": "query_string",
      "query_string": "<string>"
    }
    ```

    ```json Username theme={null}
    {
      "type": "username",
      "username": "<string>"
    }
    ```

    ```json GitHub Repository theme={null}
    {
      "type": "github_repository",
      "repo_owner": "<string>"
      "repo_name": "<string>"
    }
    ```

    ```json Brand theme={null}
    {
      "type": "brand",
      "name": "<string>"
    }
    ```

    ```json Name theme={null}
    {
      "type": "name",
      "first_name": "<string>"
      "last_name": "<string>"
      "is_strict": "<boolean>"
    }
    ```

    ```json CC Bin theme={null}
    {
      "type": "bin",
      "bin": "<string>"
    }
    ```

    ```json IP theme={null}
    {
      "type": "ip",
      "ip": "<string>"
    }
    ```

    ```json Credentials theme={null}
    {
      "type": "credentials",
      "username": "<string>"
      "password": "<string>"
    }
    ```

    ```json Secret theme={null}
    {
      "type": "secret",
      "secret": "<string>"
    }
    ```

    ```json Azure Tenant theme={null}
    {
      "type": "azure_tenant",
      "tenant_id": "<string>"
    }
    ```
  </CodeGroup>
</ParamField>

<ParamField type="number">
  Limit number of events that will be returned. (Max 10)
</ParamField>

<ParamField type="string">
  The `next` value from the last response.
</ParamField>

<ParamField type="string">
  The order in which the results will be returned.

  <Expandable title="valid order values">
    `asc`
    `desc`
  </Expandable>
</ParamField>

<ParamField type="object">
  <Expandable>
    <ParamField type="string[]">
      If a string value is specified, results will contain events that have a greater than or equal severity. Otherwise, if an array of severities is specified, results will only contain events that exactly match one of them.

      <Expandable title="valid severity values">
        `info`
        `low`
        `medium`
        `high`
        `critical`
      </Expandable>
    </ParamField>

    <ParamField type="string[]">
      <Expandable title="valid type values">
        `illicit_networks`
        `open_web`
        `leak`
        `domain`
        `listing`
        `forum_content`
        `blog_content`
        `blog_post`
        `profile`
        `chat_message`
        `ransomleak`
        `infected_devices`
        `financial_data`
        `bot`
        `stealer_log`
        `paste`
        `social_media`
        `source_code`
        `source_code_files`
        `stack_exchange`
        `google`
        `service`
        `buckets`
        `bucket`
        `bucket_object`
      </Expandable>

      Learn more about [Event Source Filters <Icon icon="book" />](/advanced/event-source-filters).
    </ParamField>

    <ParamField type="object">
      <Expandable>
        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values greater than the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values greater than or equal to the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values lesser than the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values lesser than or equal to the specified timestamp.

          Format: ISO-8601
        </ParamField>
      </Expandable>
    </ParamField>
  </Expandable>
</ParamField>


# List Identifier Events
Source: https://api.docs.flare.io/api-reference/v4/endpoints/identifier-feed

POST https://api.flare.io/firework/v4/events/identifiers/{identifier_id}/_search

Returns a list of events matching an identifier.

## Guides

See the guide for using this endpoint:
[Exporting a Tenant's Events <Icon icon="book" />](/guides/tenant-events).

<ResponseExample>
  ```json Response Example theme={null}
  {
      "items": [
          {
              "metadata": {
                  "estimated_created_at": "2019-09-20T16:30:37.589388Z",
                  "matched_at": "2019-09-21T10:15:22.123456Z",
                  "type": "listing",
                  "uid": "listing/apollon_market/9861",
                  "severity": "critical"
              },
              "tenant_metadata": {
                  "severity": {
                      "original": "low",
                      "override": "critical"
                  },
                  "tags": [
                      "important",
                  ],
                  "notes": "This reason why this is tagged as 'important' is: ..."
              },
              "identifiers": [
                  {
                      "id": 1,
                      "name": "An identifier"
                  }
              ],
              "highlights": {
                  "description": [
                      "Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
                  ],
                  "title": [
                      "Bank Statement PSD <mark>Template</mark>"
                  ]
              }
          }
      ],
      "next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
  }
  ```
</ResponseExample>

## Paging

This endpoint supports the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

## Body Parameters

<ParamField type="object">
  One of the supported queries.&#x20;

  <CodeGroup>
    ```json Domain theme={null}
    {
      "type": "domain",
      "fqdn": "<string>"
    }
    ```

    ```json Email theme={null}
    {
      "type": "email",
      "email": "<string>"
    }
    ```

    ```json Keyword theme={null}
    {
      "type": "keyword",
      "keyword": "<string>"
    }
    ```

    ```json Query String theme={null}
    {
      "type": "query_string",
      "query_string": "<string>"
    }
    ```

    ```json Username theme={null}
    {
      "type": "username",
      "username": "<string>"
    }
    ```

    ```json GitHub Repository theme={null}
    {
      "type": "github_repository",
      "repo_owner": "<string>"
      "repo_name": "<string>"
    }
    ```

    ```json Brand theme={null}
    {
      "type": "brand",
      "name": "<string>"
    }
    ```

    ```json Name theme={null}
    {
      "type": "name",
      "first_name": "<string>"
      "last_name": "<string>"
      "is_strict": "<boolean>"
    }
    ```

    ```json CC Bin theme={null}
    {
      "type": "bin",
      "bin": "<string>"
    }
    ```

    ```json IP theme={null}
    {
      "type": "ip",
      "ip": "<string>"
    }
    ```

    ```json Credentials theme={null}
    {
      "type": "credentials",
      "username": "<string>"
      "password": "<string>"
    }
    ```

    ```json Secret theme={null}
    {
      "type": "secret",
      "secret": "<string>"
    }
    ```

    ```json Azure Tenant theme={null}
    {
      "type": "azure_tenant",
      "tenant_id": "<string>"
    }
    ```
  </CodeGroup>
</ParamField>

<ParamField type="number">
  Limit number of events that will be returned. (Max 10)
</ParamField>

<ParamField type="string">
  The `next` value from the last response.
</ParamField>

<ParamField type="string">
  The order in which the results will be returned.

  <Expandable title="valid order values">
    `asc`
    `desc`
  </Expandable>
</ParamField>

<ParamField type="object">
  <Expandable>
    <ParamField type="string[]">
      If a string value is specified, results will contain events that have a greater than or equal severity. Otherwise, if an array of severities is specified, results will only contain events that exactly match one of them.

      <Expandable title="valid severity values">
        `info`
        `low`
        `medium`
        `high`
        `critical`
      </Expandable>
    </ParamField>

    <ParamField type="string[]">
      <Expandable title="valid type values">
        `illicit_networks`
        `open_web`
        `leak`
        `domain`
        `listing`
        `forum_content`
        `blog_content`
        `profile`
        `chat_message`
        `ransomleak`
        `infected_devices`
        `financial_data`
        `paste`
        `social_media`
        `source_code`
        `google`
        `service`
        `buckets`
      </Expandable>

      Learn more about [Event Source Filters <Icon icon="book" />](/advanced/event-source-filters).
    </ParamField>

    <ParamField type="object">
      <Expandable>
        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values greater than the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values greater than or equal to the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values lesser than the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values lesser than or equal to the specified timestamp.

          Format: ISO-8601
        </ParamField>
      </Expandable>
    </ParamField>

    <ParamField type="string[]">
      If provided, results will be filtered on the tags.
    </ParamField>

    <ParamField type="string[]">
      If provided, results will only contain events that match one of the specified statuses.

      <Expandable title="valid status values">
        `open`
        `ignored`
        `remediated`
      </Expandable>
    </ParamField>

    <ParamField type="bool">
      If set to true, results will be filtered to be events that have been ignored.
    </ParamField>

    <ParamField type="bool">
      If set to true, results will be filtered to be events that have been remediated.
    </ParamField>
  </Expandable>
</ParamField>

## Path Parameters

<ParamField type="int">
  The ID of the identifier.
</ParamField>


# List Identifier Group's Events
Source: https://api.docs.flare.io/api-reference/v4/endpoints/identifier-group-feed

POST https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search

Returns a list of events matching the identifiers of an identifier group.

## Guides

See the guide for using this endpoint:
[Exporting a Tenant's Events <Icon icon="book" />](/guides/tenant-events).

<ResponseExample>
  ```json Response Example theme={null}
  {
      "items": [
          {
              "metadata": {
                  "estimated_created_at": "2019-09-20T16:30:37.589388Z",
                  "matched_at": "2019-09-21T10:15:22.123456Z",
                  "type": "listing",
                  "uid": "listing/apollon_market/9861",
                  "severity": "critical"
              },
              "tenant_metadata": {
                  "severity": {
                      "original": "low",
                      "override": "critical"
                  },
                  "tags": [
                      "important",
                  ],
                  "notes": "This reason why this is tagged as 'important' is: ..."
              },
              "identifiers": [
                  {
                      "id": 1,
                      "name": "An identifier"
                  }
              ],
              "highlights": {
                  "description": [
                      "Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
                  ],
                  "title": [
                      "Bank Statement PSD <mark>Template</mark>"
                  ]
              }
          }
      ],
      "next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
  }
  ```
</ResponseExample>

## Paging

This endpoint supports the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

## Body Parameters

<ParamField type="object">
  One of the supported queries.&#x20;

  <CodeGroup>
    ```json Domain theme={null}
    {
      "type": "domain",
      "fqdn": "<string>"
    }
    ```

    ```json Email theme={null}
    {
      "type": "email",
      "email": "<string>"
    }
    ```

    ```json Keyword theme={null}
    {
      "type": "keyword",
      "keyword": "<string>"
    }
    ```

    ```json Query String theme={null}
    {
      "type": "query_string",
      "query_string": "<string>"
    }
    ```

    ```json Username theme={null}
    {
      "type": "username",
      "username": "<string>"
    }
    ```

    ```json GitHub Repository theme={null}
    {
      "type": "github_repository",
      "repo_owner": "<string>"
      "repo_name": "<string>"
    }
    ```

    ```json Brand theme={null}
    {
      "type": "brand",
      "name": "<string>"
    }
    ```

    ```json Name theme={null}
    {
      "type": "name",
      "first_name": "<string>"
      "last_name": "<string>"
      "is_strict": "<boolean>"
    }
    ```

    ```json CC Bin theme={null}
    {
      "type": "bin",
      "bin": "<string>"
    }
    ```

    ```json IP theme={null}
    {
      "type": "ip",
      "ip": "<string>"
    }
    ```

    ```json Credentials theme={null}
    {
      "type": "credentials",
      "username": "<string>"
      "password": "<string>"
    }
    ```

    ```json Secret theme={null}
    {
      "type": "secret",
      "secret": "<string>"
    }
    ```

    ```json Azure Tenant theme={null}
    {
      "type": "azure_tenant",
      "tenant_id": "<string>"
    }
    ```
  </CodeGroup>
</ParamField>

<ParamField type="number">
  Limit number of events that will be returned. (Max 10)
</ParamField>

<ParamField type="string">
  The `next` value from the last response.
</ParamField>

<ParamField type="string">
  The order in which the results will be returned.

  <Expandable title="valid order values">
    `asc`
    `desc`
  </Expandable>
</ParamField>

<ParamField type="object">
  <Expandable>
    <ParamField type="string[]">
      If a string value is specified, results will contain events that have a greater than or equal severity. Otherwise, if an array of severities is specified, results will only contain events that exactly match one of them.

      <Expandable title="valid severity values">
        `info`
        `low`
        `medium`
        `high`
        `critical`
      </Expandable>
    </ParamField>

    <ParamField type="string[]">
      <Expandable title="valid type values">
        `illicit_networks`
        `open_web`
        `leak`
        `domain`
        `listing`
        `forum_content`
        `blog_content`
        `profile`
        `chat_message`
        `ransomleak`
        `infected_devices`
        `financial_data`
        `paste`
        `social_media`
        `source_code`
        `google`
        `service`
        `buckets`
      </Expandable>

      Learn more about [Event Source Filters <Icon icon="book" />](/advanced/event-source-filters).
    </ParamField>

    <ParamField type="object">
      <Expandable>
        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values greater than the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values greater than or equal to the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values lesser than the specified timestamp.

          Format: ISO-8601
        </ParamField>

        <ParamField type="string" placeholder="Example: 2024-01-01T00:00:00+00:00">
          Matches values lesser than or equal to the specified timestamp.

          Format: ISO-8601
        </ParamField>
      </Expandable>
    </ParamField>

    <ParamField type="string[]">
      If provided, results will be filtered on the tags.
    </ParamField>

    <ParamField type="string[]">
      If provided, results will only contain events that match one of the specified statuses.

      <Expandable title="valid status values">
        `open`
        `ignored`
        `remediated`
      </Expandable>
    </ParamField>

    <ParamField type="bool">
      If set to true, results will be filtered to be events that have been ignored.
    </ParamField>

    <ParamField type="bool">
      If set to true, results will be filtered to be events that have been remediated.
    </ParamField>
  </Expandable>
</ParamField>

## Path Parameters

<ParamField type="int">
  The ID of the group.
</ParamField>


# List Identifiers
Source: https://api.docs.flare.io/api-reference/v4/endpoints/list-identifiers

firework-v4-openapi get /firework/v4/identifiers/



# List Matching Policies (Beta)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/list-matching-policies

firework-v4-openapi get /firework/v4/matching-policies

<Note>
  The  endpoint is still in beta and is subject to change.
</Note>


# List Matching Policies By Identifier Id (Beta)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/list-matching-policies-by-identifier-id

firework-v4-openapi get /firework/v4/matching-policies/by_identifier_id/{identifier_id}

<Note>
  The  endpoint is still in beta and is subject to change.
</Note>


# List Policy Assignments (Beta)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/list-policy-assignments

firework-v4-openapi get /firework/v4/matching-policies/{policy_uuid}/assignments

<Note>
  The  endpoint is still in beta and is subject to change.
</Note>


# Get Entity
Source: https://api.docs.flare.io/api-reference/v4/endpoints/public/get-entity

firework-v4-openapi get /firework/v4/entities/{id}



# List Entities
Source: https://api.docs.flare.io/api-reference/v4/endpoints/public/list-entities

firework-v4-openapi post /firework/v4/entities/global/_search



# List Entity Relations
Source: https://api.docs.flare.io/api-reference/v4/endpoints/public/list-entity-relations

firework-v4-openapi get /firework/v4/entities/{id}/relations



# Update Tenant Metadata
Source: https://api.docs.flare.io/api-reference/v4/endpoints/public/update-tenant-metadata

firework-v4-openapi patch /firework/v4/events/tenant/metadata



# Retrieve Identifier
Source: https://api.docs.flare.io/api-reference/v4/endpoints/retrieve-identifier

firework-v4-openapi get /firework/v4/identifiers/{identifier_id}



# Unassign Policy (Beta)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/unassign-policy

firework-v4-openapi delete /firework/v4/matching-policies/{policy_uuid}/assignments

<Note>
  The  endpoint is still in beta and is subject to change.
</Note>


# Update Identifier
Source: https://api.docs.flare.io/api-reference/v4/endpoints/update-identifier

firework-v4-openapi put /firework/v4/identifiers/{identifier_id}



# Update Matching Policy (Beta)
Source: https://api.docs.flare.io/api-reference/v4/endpoints/update-matching-policy

firework-v4-openapi put /firework/v4/matching-policies/{policy_uuid}

<Note>
  The  endpoint is still in beta and is subject to change.
</Note>


# Flare API Updates
Source: https://api.docs.flare.io/changelog/overview

New updates and improvements

<Note>
  This page lists changes to Flare's API.
  Release notes for the Flare Platform can be found on the [product documentation website](https://docs.flare.io/releases).
</Note>

<Update label="2026-07" description="API - July 2026">
  Released the [Flare API MCP server (beta) <Icon icon="book" />](/sdk/api-mcp).

  Added the `urls` value to the `include` parameter in the [ASTP Search Credentials Endpoint <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search).

  Added the [ASTP List URLs by Credential Hash Endpoint <Icon icon="code" />](/api-reference/astp/endpoints/post-urls-by-credential-hash) to list the URLs where a leaked credential was seen.
</Update>

<Update label="2026-05" description="API - May 2026">
  The `imported_at` filter now works for all query types in the [Global Search Credentials Endpoint <Icon icon="code" />](/api-reference/v4/endpoints/credentials-global-search)
  and the [ASTP Search Credentials Endpoint <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search).
</Update>

<Update label="2026-04" description="API - April 2026">
  Added new endpoints to manage [Matching Policies <Icon icon="code" />](/api-reference/v4/endpoints/list-matching-policies).

  This is useful for customers who want precise control over which events appear in an Identifier’s feed, either by including or excluding events based on keywords, or by scoping results with a specific search query.

  The guide
  [Create And Assign Matching Policies to Identifiers <Icon icon="book" />](/guides/create-identifiers-with-matching-policies)
  was added with an example usage.

  <Icon icon="warning" /> This deprecates the use of the 'blacklist' parameter (Ignored Terms) in identifiers. It will continue to work, but could be removed in the future.
</Update>

<Update label="2026-03" description="API - March 2026">
  Added new value for the `include` parameter in the [Global Search Credentials Endpoint <Icon icon="code" />](/api-reference/v4/endpoints/credentials-global-search).

  Added documentation for the `include` parameter in the [ASTP Search Credentials Endpoint <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search).

  Replaced the `leak` event type for individual `leaked_credential` events. See [Leaked Credentials <Icon icon="book" />](/event-types/leaked-credential)
</Update>

<Update label="2026-02-08" description="Python SDK - v2.0.0">
  Released version 2.0.0 of the
  [Python SDK <Icon icon="book" />](/sdk/python).

  This release changes the API of `scroll_events` to yield `ScrollEventsResult` objects.
  This new object exposes `metadata`, `event` and `next` fields.

  The previous API for this method wouldn't expose the `metadata` and forced users of the library
  to implement their own pagination logic.
  This new API ensures all data is available to the caller.
</Update>

<Update label="2026-02" description="CLI - February 2026">
  Released the beta of the
  [Flare API CLI <Icon icon="book" />](/sdk/cli)
  utility.

  This new command line interface (CLI) program provides Flare API automations such as
  exporting tenant events or credentials to CSV files.
</Update>

<Update label="2026-02" description="API - February 2026">
  Published a new
  [List and Update Identifiers <Icon icon="book" />](/guides/update-identifiers)
  guide.
</Update>

<Update label="2025-11-19" description="Python SDK - v1.2.0">
  Released version 1.2.0 of the
  [Python SDK <Icon icon="book" />](/sdk/python).

  This release adds a new `scroll_events` method that can be used to retrieve events from the feed APIs
  without having to manage fetching events individually.

  More information, including full examples, can be found in the
  [Python SDK documentation <Icon icon="book" />](/sdk/python).
</Update>

<Update label="2025-11" description="API - November 2025">
  Added a [Global Search Credentials Endpoint <Icon icon="code" />](/api-reference/v4/endpoints/credentials-global-search).
  This new endpoint allows for searching in all of Flare's credentials and counts towards the Global Search quota.
  This is useful for customers that don't have ASTP access.
</Update>

<Update label="2025-10" description="API - October 2025">
  Added documentation for
  [Flare API Event Types <Icon icon="book" />](/event-types/overview).
</Update>

<Update label="2025-08" description="API - August 2025">
  API endpoints using the `/leaksdb/` prefix were changed to `/astp/`.
  The old prefix remains available as an alias and there are no plans to deprecate it.
</Update>

<Update label="2025-07" description="MCP - July 2025">
  Released the
  [Flare API Documentation MCP Server <Icon icon="book" />](/sdk/docs-mcp).

  This is useful for developers building Flare API automations with AI-powered integrated development environments (IDE).
</Update>

<Update label="2025-07" description="API - July 2025">
  The [/leaksdb/credentials <Icon icon="code" />](/api-reference/leaksdb/endpoints/get-credentials-v1)
  and [/leaksdb/v2/credentials <Icon icon="code" />](/api-reference/leaksdb/endpoints/get-credentials-v2)
  endpoints were marked as deprecated and should be replaced by
  [/astp/v2/credentials/\_search <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search).
</Update>

<Update label="2025-05-15" description="Python SDK - v1.0.0">
  Released version 1.0.0 of the
  [Python SDK <Icon icon="book" />](/sdk/python).

  This release contains no changes, it simply marks 1.0.0 so that future
  breaking changes can be communicated using semantic versioning.
</Update>

<Update label="2025-05" description="API - May 2025">
  Added a new
  [List Credentials Within a Tenant <Icon icon="book" />](/guides/tenant-credentials)
  guide.
</Update>

<Update label="2025-04" description="API - April 2025">
  Released a new version of the List All Credentials endpoint,
  [List All Credentials V2 <Icon icon="code" />](/api-reference/leaksdb/endpoints/get-credentials-v2),
  which supports the
  [Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

  The old endpoint is still supported and was marked as deprecated:
  [List All Credentials V1 <Icon icon="code" />](/api-reference/leaksdb/endpoints/get-credentials-v1).
</Update>

<Update label="2025-02-18" description="Python SDK - v0.2.1">
  Released version 0.2.1 of the
  [Python SDK <Icon icon="book" />](/sdk/python).

  This release adds a `from_env` method to `FlareApiClient`.

  This allows the creation of a client from the following environment variables:

  * `FLARE_API_KEY="<key>"`
  * `FLARE_TENANT_ID="<tenant_id>"`

  Then, the client can be created using:

  ```python theme={null}
  from flareio import FlareApiClient


  client = FlareApiClient.from_env()
  ```

  The following command can be used to upgrade:

  ```shell theme={null}
  pip install flareio>=0.2.1
  ```
</Update>

<Update label="2025-01" description="API - January 2025">
  Modified the
  [retrieve event <Icon icon="code" />](/api-reference/v2/endpoints/activities/get-activities-)
  endpoint to accept the UID as a query parameter instead of as path parameters.
  This avoids confusion that some users had when using uids that have multiple slashes.
  The old endpoint with path parameters was kept for backwards compatibility.

  Increased
  [basic rate limiting <Icon icon="book" />](/concepts/rate-limits-and-quotas)
  from 2 requests per second to 4 requests per second.
</Update>

<Update label="2024-12" description="API - December 2024">
  The
  [cookies search endpoint <Icon icon="code" />](/api-reference/astp/endpoints/post-cookies-search)
  now returns an `uuid` that can be used to uniquely identify cookies.

  The
  [cookies search endpoint <Icon icon="code" />](/api-reference/astp/endpoints/post-cookies-search)
  now returns an `imported_at` timestamp that indicates when the cookie was imported to
  Flare's database. It also has a new `imported_after` filter that allows for retrieving
  cookies that were imported after a given timestamp. The
  [Cookie Monitoring Guide <Icon icon="book" />](/guides/cookie-monitoring)
  was updated with an example usage.

  Released new
  [event actions endpoint <Icon icon="code" />](/api-reference/v4/endpoints/event-actions).
  It allows ignoring, unignoring, remediating and unremediating events.
</Update>

<Update label="2024-10-22" description="Python SDK - v0.1.25">
  Released version 0.1.25 of the
  [Python SDK <Icon icon="book" />](/sdk/python).

  This release fixes an issue with packaging that caused the Python SDK to
  declare too many Python dependencies, conflicting with libraries installed
  in the environments of some users.

  The following command can be used to upgrade:

  ```shell theme={null}
  pip install flareio>=0.1.25
  ```
</Update>

<Update label="2024-09" description="API - September 2024">
  The API documentation has been revamped for better clarity and structure.

  We’ve added new [use-case guides <Icon icon="book" />](/introduction/getting-started)
  to help you quickly address specific customer needs.

  Released new
  [global search endpoint <Icon icon="code" />](/api-reference/v4/endpoints/global-search)
  with simpler-to-use filters.

  Released new
  [credentials search endpoint <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search)
  with simpler-to-use filters and support for Flare's standard paging pattern.

  Released a [Python SDK <Icon icon="book" />](/sdk/python).

  Released a [Go SDK <Icon icon="book" />](/sdk/go).
</Update>


# Authentication
Source: https://api.docs.flare.io/concepts/authentication



Flare's API is available at `https://api.flare.io`.
Requests are authenticated with **API tokens** which can be obtained using an **API key**.

## Authentication Objects and Purpose

<CardGroup>
  <Card title="API Key" icon="key">
    Used to generate API tokens. Does not expire.
  </Card>

  <Card title="API Token" icon="file-shield">
    Used to access API endpoints. Expires after 1 hour.
  </Card>
</CardGroup>

## Authentication Steps

<CardGroup>
  <Card title="Obtain an API Key" icon="square-1" href="#1-obtaining-an-api-key">
    From the profile page.
  </Card>

  <Card title="Generate a temporary API Token" icon="square-2" href="#2-obtaining-an-api-token">
    Using the API key.
  </Card>

  <Card title="Access API endpoints" icon="square-3" href="#3-access-an-api-endpoint">
    Using the API token.
  </Card>
</CardGroup>

### 1 - Obtaining an API key

Users can generate API keys by visiting the [Profile page](https://app.flare.io/#/profile) under the "API Keys" section.

<Frame>
  <img />
</Frame>

API keys are associated to a user and will have the same permissions as the user that generated them:

* If you can access a tenant, the API key will have access to that tenant.
* If you are an organization administrator, the API key will have organization administrator access.

### 2 - Obtaining an API Token

API tokens are obtained using Flare API keys. They can be generated using the
[tokens/generate <Icon icon="code" />](/api-reference/tokens/endpoints/generate)
endpoint.

<CodeGroup>
  ```bash cURL example theme={null}
  curl --request POST \
    --url https://api.flare.io/tokens/generate \
    --header 'Authorization: <api-key>'
  ```
</CodeGroup>

### 3 - Access an API endpoint

API tokens may then be used by specifying the `Authorization: Bearer <api-token>` header.

API tokens can be tested using the
[tokens/test <Icon icon="code" />](/api-reference/tokens/endpoints/test)
endpoint.

<CodeGroup>
  ```bash cURL example theme={null}
  curl --request GET \
    --url https://api.flare.io/tokens/test \
    --header 'Authorization: Bearer <api-token>'
  ```
</CodeGroup>

## Finding tenant IDs

Users can find the IDs of the tenants they have access to by visiting the
[Profile page](https://app.flare.io/#/profile) under the "Tenants" section.

<Frame>
  <img />
</Frame>

## End-to-End Examples

These are end-to-end examples in various programming languages.

<AccordionGroup>
  <Accordion title="Python Example">
    ```python theme={null}
    import os
    import requests


    api_key = os.environ.get("FLARE_API_KEY")
    if not api_key:
        raise Exception("Please provide an API key")

    # Generate the API token.
    token: str = requests.post(
        "https://api.flare.io/tokens/generate",
        headers={
            "Authorization": api_key,
        },
    ).json()["token"]

    # Now we can use our token to access the testing endpoint.
    resp = requests.get(
        "https://api.flare.io/tokens/test",
        headers={
            "Authorization": f"Bearer {token}",
        },
    )
    print(resp.json())
    ```
  </Accordion>

  <Accordion title="Python SDK Example">
    ```python Python SDK theme={null}
    import os

    from flareio import FlareApiClient


    api_key = os.environ.get("FLARE_API_KEY")
    if not api_key:
        raise Exception("Please provide an API key")

    client = FlareApiClient(api_key=api_key)

    # Generate the API token.
    token: str = client.generate_token()

    # Now we can use our token to access the testing endpoint.
    resp = client.get("/tokens/test")
    print(resp.json())
    ```
  </Accordion>
</AccordionGroup>


# Errors
Source: https://api.docs.flare.io/concepts/errors



Flare APIs return a common error format for HTTP 4XX error codes.

<ResponseExample>
  ```json Example of an Error Response theme={null}
  {
    "error": {
      "code": "INVALID_IDENTIFIER_DATA",
      "message": "fqdn is invalid",
      "data": null
    }
  }
  ```
</ResponseExample>

## Error Fields

<ResponseField name="code" type="string">
  The code of the errors.

  These are stable and could be used programmatically to detect and handle the error type.
</ResponseField>

<ResponseField name="message" type="string">
  Friendly message for the error.

  This is meant to be displayed to users.
</ResponseField>

<ResponseField name="data" type="object">
  Extra information about the error.

  This field may be absent and changes for each API endpoint and error code.
</ResponseField>


# Paging
Source: https://api.docs.flare.io/concepts/paging



Some Flare APIs use a common pattern for paging results.
This pattern pairs the `from` request parameter to the `next` response field.

## Using `from` and `next` paging

<Steps>
  <Step title="First Request">
    Perform the first request without specifying `from`.
    This indicates that you want the first page of results.
  </Step>

  <Step title="Subsequent Requests">
    Use the `next` response field from your last response as the
    value for your following request's `from` parameter.
    This indicates that you want the next page of results.

    All parameters other than `from` must remain the same as the original request.

    If `next` is missing from the last response (or is `null`), this means that you viewed all pages.

    <Note>
      Empty pages (no results) does not mean you viewed all pages.
      Some filters (like ignored events) will cause empty pages.
      This means that you should still request the next page even after receiving an empty page.
    </Note>
  </Step>
</Steps>

## The `from` Request Parameter

<ParamField type="string">
  Used to indicate where to resume paging.

  Should be empty on the first request.
</ParamField>

## The `next` Response field

<ResponseField name="next" type="string">
  The value that should be included in the next request's `from` parameter.

  Most of the time, this is an opaque string.

  The value of the `next` response field can be saved for long periods of time.
  For example if you want to export all results for a given search and then resume
  to fetch new results the next day.
</ResponseField>

## Page size vs number of returned items

Flare APIs can return less results than the requested page size.
This is normal and you should assume that there are still results until you reach a page where `next` is `null`.

## End-to-End Examples

These are end-to-end examples in various programming languages.

<AccordionGroup>
  <Accordion title="Python SDK Example">
    ```python theme={null}
    import os

    from flareio import FlareApiClient
    from flareio.ratelimit import Limiter


    api_key = os.environ.get("FLARE_API_KEY")
    if not api_key:
        raise Exception("Please provide an API key")

    api_client = FlareApiClient(api_key=api_key)

    limiter_default = Limiter.from_seconds(0.25)

    last_from: str | None = None
    fetched_pages: int = 0

    for resp in api_client.scroll(
        method="GET",
        url="/astp/v2/sources",
        params={
            "from": last_from,
        },
    ):
        # Rate limiting (default).
        limiter_default.tick()

        # Get results from the response
        resp_data = resp.json()
        items = resp_data.get("items")

        fetched_pages += 1
        print(f"Fetched page {fetched_pages} ({last_from=}) with {len(items)} items...")

        # Save the last "next" value.
        last_from = resp_data.get("next") or last_from

    print("The last value for 'next' was", last_from)
    ```
  </Accordion>

  <Accordion title="Python Generic Example">
    ```python theme={null}
    import os

    from flareio import FlareApiClient
    from flareio.ratelimit import Limiter


    api_key = os.environ.get("FLARE_API_KEY")
    if not api_key:
        raise Exception("Please provide an API key")

    api_client = FlareApiClient(api_key=api_key)

    limiter_default = Limiter.from_seconds(0.25)

    from_: str | None = None
    fetched_pages: int = 0

    while True:
        limiter_default.tick()

        params: dict = {}
        if from_:
            params["from"] = from_

        # Fetch the next page
        resp = api_client.get(
            "/astp/v2/sources",
            params=params,
        )
        resp.raise_for_status()

        fetched_pages += 1
        print(f"Fetched {fetched_pages} pages...")

        # Stop if there is no "next" value.
        next_page = resp.json().get("next")
        if not next_page:
            print("The last value for 'next' was", from_)
            break
        else:
            print(f"Next page will be from {next_page}")
            from_ = next_page
    ```
  </Accordion>

  <Accordion title="Go SDK Example">
    ```go theme={null}
    package main

    import (
    	"fmt"
    	"os"
    	"time"

    	"github.com/Flared/go-flareio"
    )

    func main() {
    	client := flareio.NewApiClient(
    		os.Getenv("FLARE_API_KEY"),
    	)

    	fetchedPages := 0

    	for result, err := range client.IterGet(
    		"/astp/v2/sources", nil,
    	) {
    		// Rate Limiting
    		time.Sleep(time.Second * 1)

    		if err != nil {
    			fmt.Printf("unexpected error: %s\n", err)
    			os.Exit(1)
    		}

    		// Handle the response...
    		result.Response.Body.Close()

    		// Print the status
    		fetchedPages = fetchedPages + 1
    		fmt.Printf(
    			"Fetched %d page(s) of astp Sources, next=%s\n",
    			fetchedPages,
    			result.Next,
    		)
    	}

    }
    ```
  </Accordion>
</AccordionGroup>


# Rate Limits and Quotas
Source: https://api.docs.flare.io/concepts/rate-limits-and-quotas



## Rate Limits

API usage is subject to Flare's API rate limit.
Rate Limits are enforced **per organization**.

Calls to certain resources have differing independant limits as follows:

* Basic: 4 requests per second
* Search: 1 request per second

For example, a user may perform a total of 5 requests per second, four basic requests and one search request.

Any endpoint that is not subject to basic limit will be identified as such.

Enforced limits receive a `RATELIMIT_REACHED` error message with the status code 429.

If you receive 429 errors, Flare's recommended course of action is to wait 10 seconds before retrying.

<ResponseExample>
  ```json Example Rate Limit Response theme={null}
  {
    "error": {
      "code": "RATELIMIT_REACHED",
      "message": "ratelimit reached"
    }
  }
  ```
</ResponseExample>

## Quotas

API and MCP users are responsible for monitoring their Global Search usage and ensuring it remains within their allocated monthly quota.

Users with account administration rights can also view their Global Search monthly usage by logging into the platform and navigating to [the tenants page](https://app.flare.io/#/tenants).

Moreover, each global search response includes the `X-Flare-Global-Searches-Remaining` header, indicating the number of searches remaining in your monthly allocation.

When you reach the maximum number of results for a search, the response includes the `X-Flare-Global-Searches-Batch-Reached` header. Performing another search afterward will trigger a quota increase.

To avoid service interruptions or missed events, we recommend implementing proactive monitoring of your usage.

For additional information, please refer to [Global Search Quota](https://docs.flare.io/global-search-quota).


# Blog Post
Source: https://api.docs.flare.io/event-types-v2/blog-post



The `blog_post` type represents blog-style documents and text-based publications that have been discovered and indexed by Flare across document-sharing or content-hosting platforms such as Scribd, Medium, or public paste/document repositories.
These records generally include technical manuals, guides, or articles that are accessible to the public, potentially containing sensitive, proprietary, or copyrighted materials.

```json Blog Post theme={null}
{
    "event_type": "blog_post",
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    },
    "data": {
        "url": "https://www.blog_name.com/post_slug",
        "content": "Post content",
        "description": "Post description",
        "posted_at": "2025-01-01T00:00:00"
    }
}
```


# Bot
Source: https://api.docs.flare.io/event-types-v2/bot



The `bot` event represents a compromised device (a “bot”) listed for sale on a dark-web marketplace (for example, “Russian Market”), where attackers sell access to machines infected by information stealer malware.
Each document corresponds to a single infected device, with the victim's environment (OS, ISP, location) and the listing details describing where the bot is offered and its price.

```json Bot theme={null}
{
    "event_type": "bot",
    "data": {
        "name": "Hacker Market - Bots",
        "url": "https://bot.market.com/market/bot/1234",
        "actor": {
            "id": "A1B2C3"
        },
        "victim_information": {
            "country_code": "CA",
            "location": "City, Country",
            "isp": "Internet Service Provider",
            "installed_at": "2026-07-22T00:00:00",
            "os": "Windows 7"
        },
        "price": "19.99",
        "currency": "usd"
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}
```


# Bucket
Source: https://api.docs.flare.io/event-types-v2/bucket



The `bucket` type represents publicly exposed cloud storage containers, such as Amazon S3, Azure Blob, or Google Cloud Storage buckets.
These records document information about misconfigured or accessible cloud storage endpoints, including domain names and providers.

```json Bucket theme={null}
{
    "event_type": "bucket",
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    },
    "data": {
        "url": "https://bucket.public.com/file.txt",
        "bucket": {
            "host": "bucket.public.com",
            "provider": "s3"
        }
    }
}
```


# Bucket Object
Source: https://api.docs.flare.io/event-types-v2/bucket-object



The `bucket_object` type represents individual files (objects) discovered within a publicly exposed cloud storage bucket, such as Amazon S3, Azure Blob Storage, or Google Cloud Storage.
Each record identifies a single accessible object and includes the bucket it was found in (host and provider).

```json Bucket Object theme={null}
{
    "event_type": "bucket_object",
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    },
    "data": {
        "url": "https://bucket.public.com/file.txt",
        "bucket": {
            "host": "bucket.public.com",
            "provider": "s3"
        }
    }
}
```


# Chat Message
Source: https://api.docs.flare.io/event-types-v2/chat-message



The `chat_message` type represents chat messages ingested from sources such as Telegram.
When possible this event type will include information about the message itself as well as
if it has been forwarded.

```json Chat Message theme={null}
{
    "event_type": "chat_message",
    "data": {
        "posted_at": "2025-01-01T00:00:00",
        "actor": {
            "id": "7432892726",
            "name": "chatty_cathy"
        },
        "context": {
            "conversation_id": "end_index",
            "conversation_name": "interesting chat"
        },
        "content": "This is the content of the message",
        "parent_context": {
            "parent_uid": "parent_uid",
            "parent_type": "parent_type"
        },
        "forward_info": {
            "forwarded_from": "forwarded_from",
            "forwarded_from_author_id": "forwarded_from_author_id",
            "forwarded_from_chat_id": 1,
            "forwarded_from_conversation_id": "forwarded_from_conversation_id",
            "forwarded_from_user_id": 1,
            "forwarded_from_username": "forwarded_from_username",
            "forwarded_message_time": "2025-01-01T00:00:00"
        },
        "was_forwarded": false
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}
```


# Docker Image
Source: https://api.docs.flare.io/event-types-v2/docker-image



The `docker_image` type represents a Docker image discovered on Docker Hub that has been recently created or updated. Image manifests are scanned for identifiers and secrets.

Each record corresponds to a single image and may include:

* The image digest and the tags it is published under, with their repository names.
* Platform details (architecture and operating system).
* When the image was last pushed and last pulled.
* The raw image manifest content.

```json Docker Image theme={null}
{
    "event_type": "docker_image",
    "data": {
        "content": "Docker image description",
        "digest": "sha256:e4b991038fd226016a60046db2109bf634f7f4b4ea9a2c548b559d3652e4cc38",
        "architecture": "amd64",
        "os": "linux",
        "last_pushed_at": "2025-01-01T00:00:00",
        "last_pulled_at": "2025-01-01T00:00:00",
        "tags": [
            {
                "name": "latest",
                "repository_name": "flared/docker"
            }
        ]
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}
```


# Docker Repository
Source: https://api.docs.flare.io/event-types-v2/docker-repository



The `docker_repository` type represents a Docker repository description that has been recently created or updated. Repository descriptions are scanned for identifiers and secrets.

```json Docker Repository theme={null}
{
    "event_type": "docker_repository",
    "data": {
        "url": "https://hub.docker.com/r/flared/docker",
        "star_count": 5,
        "pull_count": 10000,
        "collaborator_count": 2,
        "last_updated_at": "2026-01-01T00:00:00",
        "last_modified_at": "2025-01-01T00:00:00",
        "registered_at": "2024-01-01T00:00:00"
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}
```


# Lookalike Domain
Source: https://api.docs.flare.io/event-types-v2/domain



The `domain` type represents lookalike or typosquatted domains identified by Flare’s detection engines, often leveraging tools such as dnstwist.
These records capture information about suspicious domains that closely resemble legitimate organizations’ domains and could be used in phishing, brand impersonation, or malware campaigns.

```json Lookalike Domain theme={null}
{
    "event_type": "lookalike",
    "data": {
        "domain": "importante.com",
        "registered_at": "2025-01-01T00:00:00",
        "identifier_domains": [
            "important.co"
        ],
        "feed": null,
        "cert_data": null,
        "subject": null,
        "issuer": "/C=US/CN=R3/O=Let's Encrypt"
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}
```


# Forum Post
Source: https://api.docs.flare.io/event-types-v2/forum-post



The `forum_post` type represents an individual message or reply made within a forum thread on an underground or hacker-oriented site.
Each record contains the message text, author alias, message context, and metadata such as timestamps.

```json Forum Post theme={null}
{
    "event_type": "forum_post",
    "data": {
        "actor": {
            "id": "123456",
            "name": "John Doe"
        },
        "context": {
            "category_name": "Food & Drink",
            "topic_id": "1010",
            "topic_title": "Top 10 Pasta Recipes"
        },
        "posted_at": "2025-01-01T00:00:00",
        "content": "These are my favourite recipes for pasta!",
        "url": "https://forum.com/post/1010"
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}
```


# Invalid Credential
Source: https://api.docs.flare.io/event-types-v2/invalid-credential



The `invalid_credential` type represents a leaked credential that was checked against the tenant's identity provider integration, such as Microsoft Entra ID, and confirmed to to be invalid.

```json Invalid Credential theme={null}
{
    "event_type": "invalid_credential",
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    },
    "data": {
        "identity_name": "john.doe@example.com",
        "credential_hash": "a1b2c3d4e5f67890",
        "tenant_integration_id": "00000000-0000-0000-0000-000000000001"
    }
}
```


# Leak
Source: https://api.docs.flare.io/event-types-v2/leak



The `leak` type represents a discrete data leak, such as a batch of credentials or PII published on a leak site.

Each record corresponds to a single leak and may include:

* The search term that matched the leak and the site it originated from.
* Timing details: when the leak occurred and when the breach was disclosed.
* The number of leaked credentials and the categories of PII exposed.

```json Leak theme={null}
{
    "event_type": "leak",
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    },
    "data": {
        "term": "leakforum",
        "site_url": "leakforum.com",
        "leaked_at": "2024-01-10T00:00:00",
        "breached_at": "2024-01-10T00:00:00",
        "leaked_credential_count": 2,
        "pii_tags": [
            "Emails"
        ],
        "source": {
            "id": "leak_forum",
            "name": "Leak Forum"
        }
    }
}
```


# Leaked Credential
Source: https://api.docs.flare.io/event-types-v2/leaked-credential



The `leaked_credential` type represents a single leaked identity and password pair, collected from sources such as breaches and combolists circulating on illicit networks.

```json Leaked Credential theme={null}
{
    "event_type": "leaked_credential",
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    },
    "data": {
        "identity_name": "identity_name",
        "imported_at": "2025-01-01T00:00:00",
        "password": "password",
        "source": {
            "id": "url_login_pass",
            "name": "URL Login Pass"
        }
    }
}
```


# Listing
Source: https://api.docs.flare.io/event-types-v2/listing



The `listing` type represents marketplace product advertisements sourced from dark web or illicit online markets.
Each record captures a single product post, including its title, description, seller information, price, and shipping regions.
Listings can be classified as selling drugs, malware, guides, digital goods, counterfeit items, or stolen data, depending on the source market.

```json Listing theme={null}
{
    "event_type": "listing",
    "data": {
        "url": "http://b14ckm4rk3t.onion/product/123456789",
        "title": "Something for sale",
        "content": "Long item description",
        "currency": "eur",
        "escrow": true,
        "price": 38.0,
        "ship_to": [
            "Europe"
        ],
        "ship_from": [
            "Spain"
        ],
        "stock_count": 5,
        "actor": {
            "id": "ddc591f1257ab24eee28435286945abc0520",
            "name": "goodie_seller"
        },
        "classification": {
            "classes": {
                "is_carding": false,
                "is_bypass": true,
                "is_ident_fraud": false,
                "is_doc_fraud": true,
                "is_phishing": true,
                "is_money_xfer": true,
                "is_cashout": false,
                "is_virt_currency": false,
                "is_hacking": false,
                "is_misc_financial": false
            },
            "types": {
                "is_guide": false,
                "is_service": false,
                "is_software": true,
                "is_hardware": false,
                "is_data": false
            }
        },
        "context": {
            "category_name": "Goodies"
        }
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}
```


# Mitigated Credential
Source: https://api.docs.flare.io/event-types-v2/mitigated-credential



The `mitigated_credential` type represents a compromised credential for which a mitigation action, such as disabling the account or revoking its sessions, was performed through the tenant's identity provider integration.

```json Mitigated Credential theme={null}
{
    "event_type": "mitigated_credential",
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    },
    "data": {
        "identity_name": "john.doe@example.com",
        "credential_hash": "a1b2c3d4e5f67890",
        "tenant_integration_id": "00000000-0000-0000-0000-000000000001",
        "mitigation_action": "disable_account"
    }
}
```


# Event Types V2 (Beta)
Source: https://api.docs.flare.io/event-types-v2/overview

Overview of all Flare API event types

<Note>Event Types V2 are still in beta and are subject to change.</Note>

Currently these event type models are supported on the
[Retrieve Event V2 Endpoint <Icon icon="code" />](/api-reference/v4/endpoints/get-event)

| Event Type             | Documentation                                                                     |
| ---------------------- | --------------------------------------------------------------------------------- |
| `blog_post`            | [Blog Post <Icon icon="book" />](/event-types-v2/blog-post)                       |
| `bot`                  | [Bot <Icon icon="book" />](/event-types-v2/bot)                                   |
| `bucket`               | [Bucket <Icon icon="book" />](/event-types-v2/bucket)                             |
| `bucket_object`        | [Bucket Object <Icon icon="book" />](/event-types-v2/bucket-object)               |
| `chat_message`         | [Chat Message <Icon icon="book" />](/event-types-v2/chat-message)                 |
| `credit_card`          | [Chat Message <Icon icon="book" />](/event-types-v2/chat-message)                 |
| `docker_repository`    | [Docker Repository <Icon icon="book" />](/event-types-v2/docker-repository)       |
| `document`             | [Ransomleak (document) <Icon icon="book" />](/event-types-v2/ransom-leak)         |
| `docker Image`         | [Docker Image <Icon icon="book" />](/event-types-v2/docker-image)                 |
| `domain`               | [Lookalike Domain (domain) <Icon icon="book" />](/event-types-v2/domain)          |
| `forum_post`           | [Forum Post & Topic <Icon icon="book" />](/event-types-v2/forum-post)             |
| `invalid_credential`   | [Invalid Credential <Icon icon="book" />](/event-types-v2/invalid-credential)     |
| `leak`                 | [Leak <Icon icon="book" />](/event-types-v2/leak)                                 |
| `leaked_credential`    | [Leaked Credential <Icon icon="book" />](/event-types-v2/leaked-credential)       |
| `listing`              | [Listing <Icon icon="book" />](/event-types-v2/listing)                           |
| `mitigated_credential` | [Mitigated Credential <Icon icon="book" />](/event-types-v2/mitigated-credential) |
| `paste`                | [Paste <Icon icon="book" />](/event-types-v2/paste)                               |
| `stealer_log`          | [Stealer Log <Icon icon="book" />](/event-types-v2/stealer-log)                   |
| `social_media`         | [Social media <Icon icon="book" />](/event-types-v2/social-media-account)         |
| `service`              | [Service <Icon icon="book" />](/event-types-v2/service)                           |
| `valid_credential`     | [Valid Credential <Icon icon="book" />](/event-types-v2/valid-credential)         |


# Paste
Source: https://api.docs.flare.io/event-types-v2/paste



The `paste` event type corresponds to public text pastes found on paste sites such as *Pastebin*, *JustPaste.it*, *YamCode*, or similar sharing services.
These entries typically contain raw text dumps, links to leaked data, code snippets, or communication content,  sometimes referencing or re-hosting credential leaks.

```json Paste theme={null}
{
    "event_type": "paste",
    "data": {
        "url": "https://www.scribd.com/document/244878934/Final-Research",
        "title": "Final Research",
        "content": "a very long and passionate text",
        "actor": {
            "id": "Whydontweknowper",
            "name": "Marcelo"
        },
        "expires_at": "2023-01-01T00:00:00Z",
        "syntax": "python"
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}
```


# Ransomleak
Source: https://api.docs.flare.io/event-types-v2/ransom-leak



The `ransomleak` (or `document` subtype) represents a public leak post made by a ransomware group on a dark web site or leak portal.
Each record corresponds to a specific victim organization whose exfiltrated data is published as part of extortion attempts.
These entries typically include:

* Victim details (company name, country, industry).
* Threat statements or ransom instructions.

```json Ransom Leak theme={null}
{
    "event_type": "ransomleak",
    "data": {
        "url": "http://payupnow.onion/leaks.php",
        "response_url": "http://payupnow.onion/leaks.php",
        "title": "Leak Name - Victim Name",
        "content": "Ransom Leak Listing Content",
        "body": "Ransom Leak Listing Body",
        "victim_information": {
            "name": "Victim Name",
            "display_name": "Victim Name",
            "domain": "victim-domain.com",
            "alternative_domains": [
                "victim.co"
            ],
            "industry": "Non-Profit",
            "employee_count": 1,
            "city": "New York",
            "state": "New York",
            "country": "USA",
            "latitude": 123.456,
            "longitude": 123.456
        }
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}
```


# Service
Source: https://api.docs.flare.io/event-types-v2/service



The `service` type represents an internet-exposed service, such as a web server listening on a public IP address.

Each record corresponds to a single host and port combination and may include:

* Network details (IP address, port, hostname, ASN, country, and the organization managing the IP).
* Protocol and product (for example `https` served by Apache httpd), plus a URL and raw response content when available.
* CVE identifiers of vulnerabilities the service may be affected by.

```json Service theme={null}
{
    "event_type": "service",
    "data": {
        "url": "https://www.example.com",
        "asn": "AS64496",
        "content": "<!DOCTYPE html>\n<html>\n<head>\n    <title>Example Domain</title>\n</head>\n<body>\n    <h1>Example Domain</h1>\n</body>\n</html>",
        "service": "https",
        "product": "Apache httpd",
        "port": 443,
        "ip_address": "192.0.2.10",
        "organization": "Example Hosting Inc.",
        "hostname": "www.example.com",
        "country_code": "US",
        "vulnerabilities": [
            "CVE-2021-41773"
        ]
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}
```


# Social Media Account
Source: https://api.docs.flare.io/event-types-v2/social-media-account



The `social_media` type represents social media accounts that we find related to events
that match identifiers.

```json Social Media Account theme={null}
{
    "event_type": "social_media_account",
    "data": {
        "url": "https://social.net/user/coolgi",
        "site": "SocialNet",
        "username": "john_nolan"
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}
```


# Stealer Log
Source: https://api.docs.flare.io/event-types-v2/stealer-log



The `stealer_log` (also observed as `bot` in some indices) represents a record of a compromised device whose credentials and browsing data were harvested by an information stealer malware (such as RedLine, Raccoon, or Vidar).
These entries originate from dark-web marketplaces (for example, “Russian Market”) where attackers sell logs containing cookies, saved passwords, and session tokens from infected machines.
Each document corresponds to a single device or “bot,” with metadata describing where and when it was first seen, its environment (OS, IP, ISP), and the websites and services discovered in its data.

```json Stealer Log theme={null}
{
    "event_type": "stealer_log",
    "data": {
        "victim_information": {
            "ip_address": "127.0.0.1",
            "ip_network": "127.0.0.0/8",
            "username": "admin",
            "country_code": "USA",
            "zip_code": null,
            "location": null,
            "hwid": null,
            "current_language": "en-US",
            "screensize_width": 1920,
            "screensize_height": 1080,
            "timezone": "UTC+7",
            "os": "Windows 10 22H2 Pro (Build 19045) (64 Bit)",
            "uac": null,
            "process_elevation": false,
            "available_keyboards": [
                "en-US"
            ],
            "hardware": [
                "CPU: Intel(R) Core(TM) i3-10105F CPU @ 3.70GHz (4 cores, 8 threads)",
                "RAM: 31.92 GB",
                "HOSTNAME: DESKTOP-123456"
            ],
            "anti_viruses": [
                "Windows Defender",
                "Avast Antivirus"
            ]
        },
        "malware_information": {
            "malware_family": "Lumastealer",
            "build_id": "1234567890",
            "file_location": "C:\\Windows\\System32\\malware.exe",
            "infected_at": "2025-01-01T00:00:00"
        }
    },
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    }
}
```


# Valid Credential
Source: https://api.docs.flare.io/event-types-v2/valid-credential



The `valid_credential` type represents a leaked credential that was confirmed to still be valid against the tenant's identity provider integration, such as Microsoft Entra ID.

```json Valid Credential theme={null}
{
    "event_type": "valid_credential",
    "metadata": {
        "estimated_created_at": "2025-01-01T00:00:00",
        "flare_url": "https://app.flare.io/#/uid",
        "matched_at": null,
        "severity": "info",
        "uid": "index/source/id"
    },
    "data": {
        "identity_name": "john.doe@example.com",
        "credential_hash": "a1b2c3d4e5f67890",
        "tenant_integration_id": "00000000-0000-0000-0000-000000000001"
    }
}
```


# Blog Post
Source: https://api.docs.flare.io/event-types/blog-post



The `blog_post` type represents blog-style documents and text-based publications that have been discovered and indexed by Flare across document-sharing or content-hosting platforms such as Scribd, Medium, or public paste/document repositories.\
These records generally include technical manuals, guides, or articles that are accessible to the public, potentially containing sensitive, proprietary, or copyrighted materials.

```json Example Content theme={null}
{
  "id": "example-id-12345",
  "title": "Example Technical Document | PDF | Mechanical Part | Component Type",
  "description": "Example Product Line Full Description",
  "content": "Brief summary of the document contents",
  "url": "https://example.com/document/example-id-12345",
  "browser_url": "https://example.com/document/example-id-12345",
  "metadata": {
    "estimated_created_at": "2025-10-27T05:51:19.667458+00:00",
    "event_id": null,
    "first_crawled_at": "2025-10-27T05:51:19.667458+00:00",
    "last_crawled_at": "2025-10-27T05:51:19.667458+00:00",
    "payload_digest": "hashvalue123abc",
    "scraped_at": "2025-10-27T05:51:22.483346+00:00",
    "source": "example_source",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/blog_post/scribd/example-id-12345"
  },
  "header": {
    "actor": "John Doe",
    "actor_id": null,
    "category_name": "",
    "content_hash": "hashvalue123abc",
    "content_preview": "Short excerpt from the document text",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "id": "example-id-12345",
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": { "score": 2 },
    "similar_items_count": 0,
    "source": "example_source",
    "source_name": "Example Platform",
    "target_name": "Example Platform",
    "tags": [],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-10-27T05:51:19.667458+00:00",
    "title": "Example Technical Document | PDF | Mechanical Part | Component Type",
    "type": "blog_post",
    "uid": "blog_post/example_source/example-id-12345",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "posted",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null
  },
  "duplicates": [],
  "history_logs": null,
  "similar_items": []
}

```


# Bucket
Source: https://api.docs.flare.io/event-types/bucket



The `bucket` type represents publicly exposed cloud storage containers, such as Amazon S3, Azure Blob, or Google Cloud Storage buckets.\
These records document information about misconfigured or accessible cloud storage endpoints, including domain names, providers, and discovered files.

```json Example Content theme={null}
{
  "id": "example-id-34567",
  "title": "Example Bucket example-bucket.s3.amazonaws.com on Aws",
  "url": null,
  "browser_url": null,
  "metadata": {
    "estimated_created_at": "2022-07-20T08:01:19.174392+00:00",
    "event_id": null,
    "first_crawled_at": "2022-07-20T08:01:19.174392+00:00",
    "last_crawled_at": "2022-08-15T04:24:18.493735+00:00",
    "payload_digest": null,
    "scraped_at": "2022-08-15T04:24:18.495069+00:00",
    "source": "example_source",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/bucket/grayhat_warfare/example-id-34567"
  },
  "resource_url": "https://example-bucket.s3.amazonaws.com",
  "domain": "example-bucket.s3.amazonaws.com",
  "provider": "aws",
  "content_type": null,
  "file_count": 1,
  "files": [],
  "features": {
    "domains": ["example-bucket.s3.amazonaws.com"],
    "emails": null,
    "ip_addresses": null,
    "ip_addresses_cidr": null,
    "reversed_domains": ["com.amazonaws.s3.example-bucket"],
    "urls": null,
    "usernames": null,
    "vulnerabilities": null
  },
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "category_name": "aws",
    "content_hash": "bucket/example_source/example-id-34567",
    "content_preview": "",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "example-id-34567",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": { "score": 2 },
    "similar_items_count": 0,
    "source": "example_source",
    "source_name": "Example Source",
    "target_name": "Example Target",
    "tags": [],
    "notes": null,
    "state_code": null,
    "timestamp": "2022-07-20T08:01:19.174392+00:00",
    "title": "Example Bucket example-bucket.s3.amazonaws.com on Aws",
    "type": "bucket",
    "uid": "bucket/example_source/example-id-34567",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null
  },
  "history_logs": null,
  "similar_items": []
}
```


# Bucket Object
Source: https://api.docs.flare.io/event-types/bucket-object



The `bucket_object` type represents individual files (objects) discovered within publicly exposed cloud storage buckets, such as those hosted on Amazon S3, Azure Blob Storage, or Google Cloud Storage.\
Each record identifies a single accessible object, typically containing metadata like its bucket location, provider, file path, and exposure source.

```json Example Content theme={null}
{
  "id": "example-id-67890",
  "title": "Example Bucket Object example-user@example.com.json",
  "content": null,
  "content_en": null,
  "url": null,
  "browser_url": null,
  "metadata": {
    "estimated_created_at": "2022-09-29T05:41:31.384630+00:00",
    "event_id": null,
    "first_crawled_at": "2022-09-29T05:41:31.384630+00:00",
    "last_crawled_at": "2022-10-03T01:32:45.841604+00:00",
    "payload_digest": null,
    "scraped_at": "2022-10-03T01:32:45.845075+00:00",
    "source": "example_source",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/bucket_object/grayhat_warfare/example-id-67890"
  },
  "bucket": {
    "host": "example.blob.core.windows.net",
    "bucket_id": "example-bucket-id",
    "id": "azure/example-bucket-id",
    "provider": "azure"
  },
  "commit": {
    "author_email": null,
    "author_id": null,
    "author_name": null,
    "committer_email": null,
    "committer_id": null,
    "committer_name": null,
    "sha": null,
    "patch_url": null
  },
  "code": {
    "commit_name": null,
    "commit_date": null,
    "path": null,
    "commit_email": null
  },
  "drill_type": "bucket_object",
  "dork_name": null,
  "html_url": null,
  "is_secret_detection_rule_match": null,
  "issue": {
    "id": null,
    "state": null,
    "title": null,
    "tags": null,
    "assignee_id": null,
    "assignee_name": null
  },
  "project_name": null,
  "project": {
    "owner_name": null,
    "owner_id": null,
    "owner_type": null,
    "tags": null,
    "last_activity_at": null,
    "language": null,
    "followers_count": null,
    "forks_count": null,
    "is_fork": null
  },
  "resource_url": [
    "https://example.blob.core.windows.net/publiccontainer/Users/example-user@example.com.json"
  ],
  "secret_detection_rule_id": null,
  "snippets": null,
  "user": {
    "email": null,
    "company": null,
    "full_name": null,
    "location": null,
    "followers_count": null
  },
  "features": {
    "domains": ["example.blob.core.windows.net"],
    "emails": null,
    "ip_addresses": null,
    "ip_addresses_cidr": null,
    "reversed_domains": ["net.windows.core.blob.example"],
    "urls": ["https://example.blob.core.windows.net/publiccontainer/Users/example-user@example.com.json"],
    "usernames": null,
    "vulnerabilities": null
  },
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "category_name": "Drill",
    "content_hash": "bucket_object/example_source/example-id-67890",
    "content_preview": "example-user@example.com.json on Azure at example.blob.core.windows.net",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "example-id-67890",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": { "score": 2 },
    "similar_items_count": 0,
    "source": "example_source",
    "source_name": "Example Source",
    "target_name": "Example Target",
    "tags": [],
    "notes": null,
    "state_code": null,
    "timestamp": "2022-09-29T05:41:31.384630+00:00",
    "title": "Example Bucket Object example-user@example.com.json",
    "type": "bucket_object",
    "uid": "bucket_object/example_source/example-id-67890",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "pushed",
    "external_url": "https://example.blob.core.windows.net/publiccontainer/Users/example-user@example.com.json",
    "external_netloc": "example.blob.core.windows.net",
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "victim_name": null,
    "contains_secrets": false,
    "secrets_metadata": []
  },
  "history_logs": null,
  "similar_items": []
}
```


# Ransomleak (document)
Source: https://api.docs.flare.io/event-types/document



The `ransomleak` (or `document` subtype) represents a public leak post made by a ransomware group on a dark web site or leak portal.\
Each record corresponds to a specific victim organization whose exfiltrated data is published as part of extortion attempts.\
These entries typically include:

* Victim details (company name, country, industry).
* Leak description and download links to stolen archives.
* Threat statements or ransom instructions.
* Screenshots or excerpts of the leaked data for proof.

```json Example Content theme={null}
{
  "id": "example-id-91011",
  "title": "Example Leak - www.example.com PART1",
  "url": "http://exampleonionaddress.onion/page_company.php?id=123",
  "browser_url": null,
  "main": "Brief description of the leak content and references to external onion links",
  "body": "Shortened representation of the text body",
  "type": "RANSOMLEAK",
  "response_url": "http://exampleonionaddress.onion/page_company.php?id=123",
  "docmeta": {
    "title": "Example Leak - www.example.com PART1"
  },
  "screenshots": [
    {
      "preview_url": "https://example-screenshot-storage.s3.amazonaws.com/examplehash1",
      "extracted_content": "Short text snippet from screenshot 1"
    },
    {
      "preview_url": "https://example-screenshot-storage.s3.amazonaws.com/examplehash2",
      "extracted_content": "Short text snippet from screenshot 2"
    },
    {
      "preview_url": "https://example-screenshot-storage.s3.amazonaws.com/examplehash3",
      "extracted_content": "Short text snippet from screenshot 3"
    }
  ],
  "victim_metadata": {
    "name": "Example Financial Institution S.A.",
    "display_name": "Example Financial Institution S.A.",
    "domain": "example.com",
    "alternative_domains": null,
    "industry": "Financial Services",
    "employee_count": 250,
    "city": "Example City",
    "state": "Example State",
    "country": "Example Country",
    "latitude": -25.3,
    "longitude": -57.63
  },
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "category_name": "Ransom Leak",
    "content_hash": "hashvalue123xyz",
    "content_preview": "Brief preview of the leaked page content",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "example-id-91011",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": { "score": 3 },
    "similar_items_count": 0,
    "source": "example_source",
    "source_name": "Example Leak Source",
    "target_name": "Example Leak Target",
    "tags": [],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-10-28T19:49:18.173119+00:00",
    "title": "Example Leak - www.example.com PART1",
    "type": "ransomleak",
    "uid": "document/example_source/example-id-91011",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "victim_name": "Example Financial Institution S.A.",
    "contains_secrets": null,
    "secrets_metadata": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2025-10-28T19:49:18.173119+00:00",
    "event_id": null,
    "first_crawled_at": "2024-11-29T15:03:18.015000+00:00",
    "last_crawled_at": "2025-10-28T19:49:20.490310+00:00",
    "payload_digest": "hashvalue123xyz",
    "scraped_at": "2025-10-28T19:49:20.981763+00:00",
    "source": "example_source",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/document/eraleign/example-id-91011"
  },
  "similar_items": []
}
```


# Lookalike Domain (domain)
Source: https://api.docs.flare.io/event-types/domain



The `domain` type represents lookalike or typosquatted domains identified by Flare’s detection engines, often leveraging tools such as dnstwist.\
These records capture information about suspicious domains that closely resemble legitimate organizations’ domains and could be used in phishing, brand impersonation, or malware campaigns.

The `domain` event is also referred to as the discovery event: it is emitted when a lookalike domain is first discovered.
It is complemented by the `domain_*` enrichment events documented below, which each carry the results of one enrichment (page title, IP addresses, favicon, screenshot, DNS records, WHOIS/RDAP data, SSL certificates) and reference the discovered domain through their `domain` field.

<Note>Some of the below field types will not be available until after August 26th.</Note>

## domain

| Field               | Type                                                     |
| ------------------- | -------------------------------------------------------- |
| `name`              | `str`                                                    |
| `registered_at`     | `str`                                                    |
| `feed`              | `str`                                                    |
| `identifier_domain` | `list[str]`                                              |
| `cert_data`         | `raw`                                                    |
| `subject`           | `str`                                                    |
| `issuer`            | `str`                                                    |
| `features`          | `{domains, reversed_domains, ip_addresses, emails, ...}` |
| `title`             | `str \| null`                                            |
| `screenshot`        | `str \| null`                                            |
| `sources`           | `list[str]`                                              |
| `url`               | `str \| null`                                            |

```json Example Content theme={null}
{
  "data": {
    "es_id": "1234/domain/example_source/exampledomain.co.uk",
    "es_score": 1.0,
    "highlights": {},
    "id": "exampledomain.co.uk",
    "index": "domain",
    "metadata": {
      "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
      "event_id": null,
      "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
      "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
      "payload_digest": null,
      "scraped_at": "2025-10-26T00:29:04.264838+00:00",
      "source": "example_source",
      "crawled_by": null,
      "flare_url": "https://app.flare.io/#/domain/example_source/exampledomain.co.uk"
    },
    "uid": "domain/example_source/exampledomain.co.uk",
    "url": "https://exampledomain.co.uk/",
    "browser_url": null,
    "name": "exampledomain.co.uk",
    "registered_at": null,
    "feed": null,
    "identifier_domain": [
      "example.co.uk"
    ],
    "cert_data": null,
    "subject": null,
    "issuer": null,
    "features": {
      "domains": [
        "example.co.uk",
        "exampledomain.co.uk"
      ],
      "emails": null,
      "ip_addresses": null,
      "ip_addresses_cidr": null,
      "reversed_domains": [
        "uk.co.example",
        "uk.co.exampledomain"
      ],
      "urls": null,
      "usernames": null,
      "vulnerabilities": null
    },
    "title": "Parking Page",
    "screenshot": "https://flared-domain-screenshots.s3.amazonaws.com/8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4?AWSAccessKeyId=ASIAEXAMPLEEXAMPLE&Signature=examplesignature%3D&Expires=1786379481",
    "sources": [
      "example_source"
    ]
  },
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "asset_uuid": null,
    "bank": null,
    "bin": null,
    "brand": null,
    "credential_count": null,
    "category_name": "domain",
    "content_hash": "domain/example_source/exampledomain.co.uk",
    "content_preview": "Domain exampledomain.co.uk",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "exampledomain.co.uk",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [
      "domain/example_source/exampledomain.co.uk"
    ],
    "risk": {
      "score": 1
    },
    "similar_items_count": 0,
    "source": "example_source",
    "source_name": "Example DNS Monitor",
    "target_name": "Example DNS Monitor",
    "tags": [],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-10-20T23:15:59.521157+00:00",
    "title": "exampledomain.co.uk",
    "type": "domain",
    "uid": "domain/example_source/exampledomain.co.uk",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "analyzers_items_uids": [],
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null,
    "identity_name": null,
    "password": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
    "event_id": null,
    "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
    "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
    "payload_digest": null,
    "scraped_at": "2025-10-26T00:29:04.264838+00:00",
    "source": "example_source",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/domain/example_source/exampledomain.co.uk"
  },
  "similar_items": []
}
```

## domain\_title

The page title observed on the lookalike domain.

| Field    | Type  |
| -------- | ----- |
| `title`  | `str` |
| `domain` | `str` |

```json Example Content theme={null}
{
  "data": {
    "es_id": "1234/domain_title/flare/exampledomain.co.uk/420311875",
    "es_score": 1.0,
    "highlights": {},
    "id": "exampledomain.co.uk",
    "index": "domain_title",
    "metadata": {
      "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
      "event_id": null,
      "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
      "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
      "payload_digest": "dc069ed0cb03d131ff8b0f8fd142ae732d1d8d47",
      "scraped_at": "2025-10-26T00:29:04.264838+00:00",
      "source": "flare",
      "crawled_by": null,
      "flare_url": "https://app.flare.io/#/domain_title/flare/exampledomain.co.uk%2F420311875"
    },
    "uid": "domain_title/flare/exampledomain.co.uk/420311875",
    "url": null,
    "browser_url": null,
    "title": "Example Domain – Sign In",
    "domain": "exampledomain.co.uk"
  },
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "asset_uuid": null,
    "bank": null,
    "bin": null,
    "brand": null,
    "credential_count": null,
    "category_name": "domain_title",
    "content_hash": "dc069ed0cb03d131ff8b0f8fd142ae732d1d8d47",
    "content_preview": "",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "exampledomain.co.uk",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": {
      "score": 1
    },
    "similar_items_count": 0,
    "source": "exampledomain.co.uk",
    "source_name": "exampledomain.co.uk",
    "target_name": "exampledomain.co.uk",
    "tags": [],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-10-20T23:15:59.521157+00:00",
    "title": "Title",
    "type": "domain_title",
    "uid": "domain_title/flare/exampledomain.co.uk/420311875",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "analyzers_items_uids": [],
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null,
    "identity_name": null,
    "password": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
    "event_id": null,
    "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
    "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
    "payload_digest": "dc069ed0cb03d131ff8b0f8fd142ae732d1d8d47",
    "scraped_at": "2025-10-26T00:29:04.264838+00:00",
    "source": "flare",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/domain_title/flare/exampledomain.co.uk%2F420311875"
  },
  "similar_items": []
}
```

## domain\_ip\_address

The IP addresses the lookalike domain resolves to.

| Field          | Type        |
| -------------- | ----------- |
| `ip_addresses` | `list[str]` |
| `domain`       | `str`       |

```json Example Content theme={null}
{
  "data": {
    "es_id": "1234/domain_ip_address/flare/exampledomain.co.uk/438568022",
    "es_score": 1.0,
    "highlights": {},
    "id": "exampledomain.co.uk",
    "index": "domain_ip_address",
    "metadata": {
      "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
      "event_id": null,
      "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
      "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
      "payload_digest": "3d525347cf9822ba9b94f4e6b020ca35cabb00e0",
      "scraped_at": "2025-10-26T00:29:04.264838+00:00",
      "source": "flare",
      "crawled_by": null,
      "flare_url": "https://app.flare.io/#/domain_ip_address/flare/exampledomain.co.uk%2F438568022"
    },
    "uid": "domain_ip_address/flare/exampledomain.co.uk/438568022",
    "url": null,
    "browser_url": null,
    "ip_addresses": [
      "203.0.113.10",
      "203.0.113.11"
    ],
    "domain": "exampledomain.co.uk"
  },
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "asset_uuid": null,
    "bank": null,
    "bin": null,
    "brand": null,
    "credential_count": null,
    "category_name": "domain_ip_address",
    "content_hash": "3d525347cf9822ba9b94f4e6b020ca35cabb00e0",
    "content_preview": "",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "exampledomain.co.uk",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": {
      "score": 1
    },
    "similar_items_count": 0,
    "source": "exampledomain.co.uk",
    "source_name": "exampledomain.co.uk",
    "target_name": "exampledomain.co.uk",
    "tags": [],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-10-20T23:15:59.521157+00:00",
    "title": "IP Address",
    "type": "domain_ip_address",
    "uid": "domain_ip_address/flare/exampledomain.co.uk/438568022",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "analyzers_items_uids": [],
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null,
    "identity_name": null,
    "password": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
    "event_id": null,
    "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
    "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
    "payload_digest": "3d525347cf9822ba9b94f4e6b020ca35cabb00e0",
    "scraped_at": "2025-10-26T00:29:04.264838+00:00",
    "source": "flare",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/domain_ip_address/flare/exampledomain.co.uk%2F438568022"
  },
  "similar_items": []
}
```

## domain\_favicon

The favicon observed on the lookalike domain.

| Field     | Type  |
| --------- | ----- |
| `favicon` | `str` |
| `domain`  | `str` |

```json Example Content theme={null}
{
  "data": {
    "es_id": "1234/domain_favicon/flare/exampledomain.co.uk/441871456",
    "es_score": 1.0,
    "highlights": {},
    "id": "exampledomain.co.uk",
    "index": "domain_favicon",
    "metadata": {
      "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
      "event_id": null,
      "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
      "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
      "payload_digest": "c02031ede93ddf1d90e2590536deee3129a32390",
      "scraped_at": "2025-10-26T00:29:04.264838+00:00",
      "source": "flare",
      "crawled_by": null,
      "flare_url": "https://app.flare.io/#/domain_favicon/flare/exampledomain.co.uk%2F441871456"
    },
    "uid": "domain_favicon/flare/exampledomain.co.uk/441871456",
    "url": null,
    "browser_url": null,
    "favicon": "https://flared-domain-favicons.s3.amazonaws.com/2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae?AWSAccessKeyId=ASIAEXAMPLEEXAMPLE&Signature=examplesignature%3D&Expires=1786379481",
    "domain": "exampledomain.co.uk"
  },
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "asset_uuid": null,
    "bank": null,
    "bin": null,
    "brand": null,
    "credential_count": null,
    "category_name": "domain_favicon",
    "content_hash": "c02031ede93ddf1d90e2590536deee3129a32390",
    "content_preview": "",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "exampledomain.co.uk",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": {
      "score": 1
    },
    "similar_items_count": 0,
    "source": "exampledomain.co.uk",
    "source_name": "exampledomain.co.uk",
    "target_name": "exampledomain.co.uk",
    "tags": [],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-10-20T23:15:59.521157+00:00",
    "title": "Favicon",
    "type": "domain_favicon",
    "uid": "domain_favicon/flare/exampledomain.co.uk/441871456",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "analyzers_items_uids": [],
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null,
    "identity_name": null,
    "password": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
    "event_id": null,
    "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
    "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
    "payload_digest": "c02031ede93ddf1d90e2590536deee3129a32390",
    "scraped_at": "2025-10-26T00:29:04.264838+00:00",
    "source": "flare",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/domain_favicon/flare/exampledomain.co.uk%2F441871456"
  },
  "similar_items": []
}
```

## domain\_screenshot

A screenshot of the lookalike domain's landing page.

| Field        | Type  |
| ------------ | ----- |
| `screenshot` | `str` |
| `domain`     | `str` |

```json Example Content theme={null}
{
  "data": {
    "es_id": "1234/domain_screenshot/flare/exampledomain.co.uk/431758338",
    "es_score": 1.0,
    "highlights": {},
    "id": "exampledomain.co.uk",
    "index": "domain_screenshot",
    "metadata": {
      "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
      "event_id": null,
      "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
      "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
      "payload_digest": "9bb1e800edbd0226a9e9376aa41ac32d8ee9deb9",
      "scraped_at": "2025-10-26T00:29:04.264838+00:00",
      "source": "flare",
      "crawled_by": null,
      "flare_url": "https://app.flare.io/#/domain_screenshot/flare/exampledomain.co.uk%2F431758338"
    },
    "uid": "domain_screenshot/flare/exampledomain.co.uk/431758338",
    "url": null,
    "browser_url": null,
    "screenshot": "https://flared-domain-screenshots.s3.amazonaws.com/8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4?AWSAccessKeyId=ASIAEXAMPLEEXAMPLE&Signature=examplesignature%3D&Expires=1786379481",
    "domain": "exampledomain.co.uk"
  },
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "asset_uuid": null,
    "bank": null,
    "bin": null,
    "brand": null,
    "credential_count": null,
    "category_name": "domain_screenshot",
    "content_hash": "9bb1e800edbd0226a9e9376aa41ac32d8ee9deb9",
    "content_preview": "",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "exampledomain.co.uk",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": {
      "score": 1
    },
    "similar_items_count": 0,
    "source": "exampledomain.co.uk",
    "source_name": "exampledomain.co.uk",
    "target_name": "exampledomain.co.uk",
    "tags": [],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-10-20T23:15:59.521157+00:00",
    "title": "Screenshot",
    "type": "domain_screenshot",
    "uid": "domain_screenshot/flare/exampledomain.co.uk/431758338",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "analyzers_items_uids": [],
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null,
    "identity_name": null,
    "password": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
    "event_id": null,
    "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
    "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
    "payload_digest": "9bb1e800edbd0226a9e9376aa41ac32d8ee9deb9",
    "scraped_at": "2025-10-26T00:29:04.264838+00:00",
    "source": "flare",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/domain_screenshot/flare/exampledomain.co.uk%2F431758338"
  },
  "similar_items": []
}
```

## domain\_dns\_records

The DNS records observed for the lookalike domain.

| Field          | Type                                   |
| -------------- | -------------------------------------- |
| `domain`       | `str`                                  |
| `a_records`    | `list[str]`                            |
| `aaaa_records` | `list[str]`                            |
| `mx_records`   | `list[{priority: int, exchange: str}]` |
| `ns_records`   | `list[str]`                            |
| `txt_records`  | `list[str]`                            |
| `has_spf`      | `bool`                                 |
| `has_dmarc`    | `bool`                                 |

```json Example Content theme={null}
{
  "data": {
    "es_id": "1234/domain_dns_records/flare/exampledomain.co.uk/438568021",
    "es_score": 1.0,
    "highlights": {},
    "id": "exampledomain.co.uk",
    "index": "domain_dns_records",
    "metadata": {
      "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
      "event_id": null,
      "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
      "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
      "payload_digest": "0d901f4405516690ae181459b8671eb7665a5fce",
      "scraped_at": "2025-10-26T00:29:04.264838+00:00",
      "source": "flare",
      "crawled_by": null,
      "flare_url": "https://app.flare.io/#/domain_dns_records/flare/exampledomain.co.uk%2F438568021"
    },
    "uid": "domain_dns_records/flare/exampledomain.co.uk/438568021",
    "url": null,
    "browser_url": null,
    "domain": "exampledomain.co.uk",
    "a_records": [
      "203.0.113.10",
      "203.0.113.11"
    ],
    "aaaa_records": [
      "2001:db8::1"
    ],
    "mx_records": [
      {
        "priority": 10,
        "exchange": "mail1.exampledomain.co.uk"
      },
      {
        "priority": 20,
        "exchange": "mail2.exampledomain.co.uk"
      }
    ],
    "ns_records": [
      "ns1.exampledomain.co.uk",
      "ns2.exampledomain.co.uk"
    ],
    "txt_records": [
      "v=spf1 include:_spf.example.com ~all"
    ],
    "has_spf": true,
    "has_dmarc": false
  },
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "asset_uuid": null,
    "bank": null,
    "bin": null,
    "brand": null,
    "credential_count": null,
    "category_name": "domain_dns_records",
    "content_hash": "0d901f4405516690ae181459b8671eb7665a5fce",
    "content_preview": "",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "exampledomain.co.uk",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": {
      "score": 1
    },
    "similar_items_count": 0,
    "source": "exampledomain.co.uk",
    "source_name": "exampledomain.co.uk",
    "target_name": "exampledomain.co.uk",
    "tags": [],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-10-20T23:15:59.521157+00:00",
    "title": "DNS Records",
    "type": "domain_dns_records",
    "uid": "domain_dns_records/flare/exampledomain.co.uk/438568021",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "analyzers_items_uids": [],
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null,
    "identity_name": null,
    "password": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
    "event_id": null,
    "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
    "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
    "payload_digest": "0d901f4405516690ae181459b8671eb7665a5fce",
    "scraped_at": "2025-10-26T00:29:04.264838+00:00",
    "source": "flare",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/domain_dns_records/flare/exampledomain.co.uk%2F438568021"
  },
  "similar_items": []
}
```

## domain\_whois\_rdap

Registration data for the lookalike domain, collected from both WHOIS and RDAP.

| Field                    | Type        |
| ------------------------ | ----------- |
| `registrar`              | `str`       |
| `contact_email`          | `str`       |
| `epp_status`             | `list[str]` |
| `registered_date`        | `datetime`  |
| `updated_date`           | `datetime`  |
| `expires_date`           | `datetime`  |
| `registrant`             | `raw`       |
| `administrative_contact` | `raw`       |
| `technical_contact`      | `raw`       |
| `domain`                 | `str`       |

```json Example Content theme={null}
{
  "data": {
    "es_id": "1234/domain_whois_rdap/example_source/exampledomain.co.uk/1785563866",
    "es_score": 1.0,
    "highlights": {},
    "id": "exampledomain.co.uk/1785563866",
    "index": "domain_whois_rdap",
    "metadata": {
      "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
      "event_id": null,
      "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
      "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
      "payload_digest": "8c0f28e2108ca6637b16f0fde9f61b74a37a6ec3",
      "scraped_at": "2025-10-26T00:29:04.264838+00:00",
      "source": "example_source",
      "crawled_by": null,
      "flare_url": "https://app.flare.io/#/domain_whois_rdap/example_source/exampledomain.co.uk%2F1785563866"
    },
    "uid": "domain_whois_rdap/example_source/exampledomain.co.uk/1785563866",
    "url": null,
    "browser_url": null,
    "registrar": "Example Registrar Ltd",
    "contact_email": "abuse@example-registrar.com",
    "epp_status": [
      "clientTransferProhibited"
    ],
    "registered_date": "2025-10-18T00:00:00+00:00",
    "updated_date": "2025-10-19T08:12:00+00:00",
    "expires_date": "2026-10-18T00:00:00+00:00",
    "registrant": {
      "organization": "Privacy service provided by Example Privacy Ltd",
      "street1": "1 Example Street",
      "city": "Exampleville",
      "state": "Example State",
      "postalCode": "00000",
      "country": "UNITED STATES",
      "countryCode": "US",
      "telephone": "15555550100"
    },
    "administrative_contact": null,
    "technical_contact": {
      "name": "Hostmaster",
      "email": "hostmaster@example-hosting.net",
      "fax": "15555550199"
    },
    "domain": "exampledomain.co.uk"
  },
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "asset_uuid": null,
    "bank": null,
    "bin": null,
    "brand": null,
    "credential_count": null,
    "category_name": "domain_whois_rdap",
    "content_hash": "8c0f28e2108ca6637b16f0fde9f61b74a37a6ec3",
    "content_preview": "",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "exampledomain.co.uk/1785563866",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": {
      "score": 1
    },
    "similar_items_count": 0,
    "source": "exampledomain.co.uk",
    "source_name": "exampledomain.co.uk",
    "target_name": "exampledomain.co.uk",
    "tags": [],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-10-20T23:15:59.521157+00:00",
    "title": "WHOIS/RDAP",
    "type": "domain_whois_rdap",
    "uid": "domain_whois_rdap/example_source/exampledomain.co.uk/1785563866",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "analyzers_items_uids": [],
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null,
    "identity_name": null,
    "password": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
    "event_id": null,
    "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
    "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
    "payload_digest": "8c0f28e2108ca6637b16f0fde9f61b74a37a6ec3",
    "scraped_at": "2025-10-26T00:29:04.264838+00:00",
    "source": "example_source",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/domain_whois_rdap/example_source/exampledomain.co.uk%2F1785563866"
  },
  "similar_items": []
}
```

## domain\_certificate

An SSL certificate observed covering the lookalike domain.

| Field                    | Type        |
| ------------------------ | ----------- |
| `domain`                 | `str`       |
| `subject`                | `str`       |
| `issuer`                 | `str`       |
| `not_before`             | `datetime`  |
| `not_after`              | `datetime`  |
| `authority_info_access`  | `list[str]` |
| `subject_alt_names`      | `list[str]` |
| `is_extended_validation` | `bool`      |

```json Example Content theme={null}
{
  "data": {
    "es_id": "1234/domain_certificate/example_source/exampledomain.co.uk/1785495379",
    "es_score": 1.0,
    "highlights": {},
    "id": "exampledomain.co.uk/1785495379",
    "index": "domain_certificate",
    "metadata": {
      "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
      "event_id": null,
      "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
      "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
      "payload_digest": "4ac40d27373742c020015a735e39a7a6e7815452",
      "scraped_at": "2025-10-26T00:29:04.264838+00:00",
      "source": "example_source",
      "crawled_by": null,
      "flare_url": "https://app.flare.io/#/domain_certificate/example_source/exampledomain.co.uk%2F1785495379"
    },
    "uid": "domain_certificate/example_source/exampledomain.co.uk/1785495379",
    "url": null,
    "browser_url": null,
    "domain": "exampledomain.co.uk",
    "subject": "/CN=exampledomain.co.uk",
    "issuer": "/C=US/O=Example CA/CN=Example TLS Intermediate CA DV - R1",
    "not_before": "2025-10-19T00:00:00+00:00",
    "not_after": "2026-01-17T00:00:00+00:00",
    "authority_info_access": [
      "CA Issuers - URI:http://certificates.example-ca.com/repository/example_tls_issuing_dv-r1.crt"
    ],
    "subject_alt_names": [
      "exampledomain.co.uk",
      "www.exampledomain.co.uk"
    ],
    "is_extended_validation": false
  },
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "asset_uuid": null,
    "bank": null,
    "bin": null,
    "brand": null,
    "credential_count": null,
    "category_name": "domain_certificate",
    "content_hash": "4ac40d27373742c020015a735e39a7a6e7815452",
    "content_preview": "",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "exampledomain.co.uk/1785495379",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": {
      "score": 1
    },
    "similar_items_count": 0,
    "source": "exampledomain.co.uk",
    "source_name": "exampledomain.co.uk",
    "target_name": "exampledomain.co.uk",
    "tags": [],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-10-20T23:15:59.521157+00:00",
    "title": "Certificate",
    "type": "domain_certificate",
    "uid": "domain_certificate/example_source/exampledomain.co.uk/1785495379",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "analyzers_items_uids": [],
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null,
    "identity_name": null,
    "password": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2025-10-20T23:15:59.521157+00:00",
    "event_id": null,
    "first_crawled_at": "2025-10-20T23:15:59.521157+00:00",
    "last_crawled_at": "2025-10-26T00:29:04.263918+00:00",
    "payload_digest": "4ac40d27373742c020015a735e39a7a6e7815452",
    "scraped_at": "2025-10-26T00:29:04.264838+00:00",
    "source": "example_source",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/domain_certificate/example_source/exampledomain.co.uk%2F1785495379"
  },
  "similar_items": []
}
```


# Experimental
Source: https://api.docs.flare.io/event-types/experimental



The `experimental` type represents test or prototype data sources curated by the research team that Flare is evaluating for potential inclusion as officially supported event types.

```json Example Content theme={null}
{
  "id": "example-id-55667",
  "title": "Darknet App Listing - AI Chat Assistant (suspicious)",
  "url": null,
  "browser_url": "http://hiddenserviceexample.onion/app/210.0",
  "data": {
    "app_name": "DarkChat AI",
    "publisher": "anonymous_publisher",
    "description": "Darknet-hosted APK listing. Entry claims multilingual AI chat functionality but metadata and hosting indicate untrusted provenance. Listing notes: obfuscated binary, unknown signing key, and community comments alleging covert telemetry and possible remote access components. Use in CTI contexts to track actor TTPs and indicators of compromise — do NOT execute the APK; treat as intelligence artifact."
  },
  "content": "Dark web-style app marketplace entry summarizing version history, mirrored onion download locations (redacted), uploader notes claiming 'hardened' build and bundled modules, and community-sourced warnings about suspected backdoor behavior. Contains version list and redacted hashes for analyst reference.",
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "category_name": "",
    "content_hash": "hashvalue123xyz",
    "content_preview": "Dark web APK listing for 'DarkChat AI' with suspicious provenance — mirrors and community warnings.",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "example-id-55667",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": { "score": 3 },
    "similar_items_count": 0,
    "source": "darknet_market_scrape",
    "source_name": "Darknet Market Scrape",
    "target_name": "Darknet Market Scrape",
    "tags": ["darkweb", "apk", "malicious-suspected", "cti"],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-10-01T23:57:51.346759+00:00",
    "title": "Darknet App Listing - AI Chat Assistant (suspicious)",
    "type": "experimental",
    "uid": "experimental/darknet/darkchat/example-id-55667",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2025-10-01T23:57:51.346759+00:00",
    "event_id": null,
    "first_crawled_at": "2025-10-01T23:57:51.346759+00:00",
    "last_crawled_at": "2025-10-01T23:57:51.346759+00:00",
    "payload_digest": "hashvalue123xyz",
    "scraped_at": "2025-10-01T23:57:51.347503+00:00",
    "source": "darknet_market_scrape",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/experimental/app_store/example-id-55667"
  },
  "similar_items": []
}
```


# Forum Post
Source: https://api.docs.flare.io/event-types/forum-post



The `forum_post` type represents an individual message or reply made within a forum thread on an underground or hacker-oriented site.\
Each record contains the message text, author alias, thread association, and metadata such as timestamps and extracted indicators (domains, emails, etc.).

```json Example Content theme={null}
{
  "id": "example-id-77889",
  "title": "Leaked Database – Government Regulatory Agency (INDONESIA)",
  "url": "http://hiddenforumexample.onion/showthread.php?pid=77889#pid77889",
  "browser_url": "http://hiddenforumexample.onion/Thread-Leaked-Government-Agency-Database",
  "actor": "DarkLeakX",
  "actor_id": null,
  "actor_name": "DarkLeakX",
  "category_name": "Databases",
  "category_path_name": null,
  "content": "Thread posted by user DarkLeakX offering multiple CSV files allegedly exfiltrated from a government nuclear regulatory body. The actor lists multiple database names and sample table filenames suggesting personnel and licensing data. The post includes redacted sample entries with identifiers and email addresses, indicating exposure of administrative and technical staff information. The dataset is hosted on an external anonymous file service (URL redacted) and mirrored through multiple onion links. Mentions of CSV exports such as 'users.csv', 'licenses.csv', and 'requests.csv' are included. The author claims to provide access upon contact or trade.",
  "content_en": null,
  "title_en": null,
  "posted_at": "2025-10-28T18:50:57.328427+05:30",
  "topic_id": "9999",
  "topic_title": "Leaked Database – Government Regulatory Agency (INDONESIA)",
  "topic_title_en": null,
  "features": {
    "domains": [
      "example.gov.id",
      "examplemail.com",
      "anonfiles.onion"
    ],
    "emails": [
      "admin@example.gov.id",
      "contact@examplemail.com"
    ],
    "ip_addresses": null,
    "ip_addresses_cidr": null,
    "reversed_domains": [
      "id.gov.example",
      "com.examplemail",
      "onion.anonfiles"
    ],
    "urls": [
      "https://example.gov.id",
      "https://anonfiles.onion/example"
    ],
    "usernames": ["DarkLeakX", "ParanoidHax"],
    "vulnerabilities": null
  },
  "duplicates": [],
  "header": {
    "actor": "DarkLeakX",
    "actor_id": null,
    "category_name": "Databases",
    "content_hash": "hashvalue123xyz",
    "content_preview": "Forum post advertising leaked Indonesian government database with multiple CSV exports and user data samples.",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "example-id-77889",
    "infection_date": null,
    "parent_id": "9999",
    "parent_title": "Leaked Database – Government Regulatory Agency (INDONESIA)",
    "parent_title_en": null,
    "parent_uid": "forum_topic/darkforums/example-id-9999",
    "parent_uids": [],
    "risk": { "score": 3 },
    "similar_items_count": 0,
    "source": "darkforums",
    "source_name": "DarkForums",
    "target_name": "DarkForums",
    "tags": ["darkweb", "leak", "database", "government", "cti"],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-10-28T13:20:57.328427+00:00",
    "title": "Leaked Database – Government Regulatory Agency (INDONESIA)",
    "type": "forum_post",
    "uid": "forum_post/darkforums/example-id-77889",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "posted",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "victim_name": "Government Regulatory Agency (Indonesia)",
    "contains_secrets": null,
    "secrets_metadata": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2025-10-28T13:20:57.328427+00:00",
    "event_id": null,
    "first_crawled_at": "2025-10-28T19:00:57.328427+00:00",
    "last_crawled_at": "2025-10-28T19:00:57.328427+00:00",
    "payload_digest": "hashvalue123xyz",
    "scraped_at": "2025-10-28T19:00:57.394413+00:00",
    "source": "darkforums",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/forum_post/darkforums/example-id-77889"
  },
  "similar_items": []
}
```


# Forum Topic
Source: https://api.docs.flare.io/event-types/forum-topic



The `forum_topic` type represents a forum discussion thread, capturing its title, author, creation date, and source platform.\
Each record corresponds to a thread-level post, distinct from individual replies (`forum_post`).\
Forum topics are often technical discussions, tutorials, leak announcements, or tool releases shared by actors on underground or gray-hat forums.

```json Example Content theme={null}
{
  "id": "example-id-1628778",
  "title": "[Tutorial] Mobile Game Crack – Angry Birds Match 3 (Android)",
  "url": "http://hiddenforumexample.onion/thread-1628778-1-1.html",
  "browser_url": null,
  "actor": "ByteWing",
  "actor_id": "user-874154",
  "actor_name": "ByteWing",
  "category_id": "65",
  "category_name": "[Mobile Security Zone]",
  "category_path_name": null,
  "content": "Forum topic posted by underground user 'ByteWing' describing methods for modifying mobile game binaries. The thread explains the use of patched APKs and custom scripts to bypass license verification and in-app purchase checks. While framed as an educational post, the content includes step-by-step details and links to modified game builds (links redacted). Community replies discuss anti-tamper protections and note that the author may use these techniques in broader Android cracking operations. The post’s tone and context align with known behavior of low-tier mobile modding groups active on clear and dark web forums.",
  "title_en": "[Tutorial] Angry Birds Match 3 Android Game – Reverse Engineering Guide",
  "posted_at": "2022-04-27T21:46:00+00:00",
  "tags": ["android", "reverse-engineering", "apk", "tutorial", "darkweb"],
  "profile_id": null,
  "first_post_preview": "User post includes a step-by-step 'how-to' for unpacking and modifying Android game binaries.",
  "posts": [],
  "duplicates": [],
  "header": {
    "actor": "ByteWing",
    "actor_id": "user-874154",
    "category_name": "[Mobile Security Zone]",
    "content_hash": "hashvalue123xyz",
    "content_preview": "Underground tutorial post showing mobile APK cracking process for an Android puzzle game.",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "example-id-1628778",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": { "score": 2 },
    "similar_items_count": 0,
    "source": "darkweb_forum",
    "source_name": "DarkWeb Forum",
    "target_name": "DarkWeb Forum",
    "tags": ["darkweb", "apk", "reverse-engineering", "tutorial"],
    "notes": null,
    "state_code": null,
    "timestamp": "2022-04-27T21:46:00+00:00",
    "title": "[Tutorial] Mobile Game Crack – Angry Birds Match 3 (Android)",
    "type": "forum_topic",
    "uid": "forum_topic/darkweb_forum/example-id-1628778",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "posted",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2022-04-27T21:46:00+00:00",
    "event_id": null,
    "first_crawled_at": "2025-10-26T06:06:24.944152+00:00",
    "last_crawled_at": "2025-10-26T06:06:24.944152+00:00",
    "payload_digest": "hashvalue123xyz",
    "scraped_at": "2025-10-26T06:06:34.643500+00:00",
    "source": "darkweb_forum",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/forum_topic/darkweb_forum/example-id-1628778"
  },
  "similar_items": []
}
```


# Google
Source: https://api.docs.flare.io/event-types/google



The `driller_google` type represents Google search-based reconnaissance data, gathered through Flare’s “Driller” engine.\
This data consists of crafted Google dork queries and their discovered URLs; used to identify exposed files, misconfigured services, or leaked data indexed by Google.

```json Example Content theme={null}
{
  "id": "example-id-413",
  "title": "Example Intelligence Scrape — Search Engine Crawl",
  "url": null,
  "browser_url": null,
  "content": "Short summary: archived HTML capture of a publicly-posted 'best hacking tools' article scraped from a search engine result. Contains article metadata, markup, and embedded tracking scripts — treated as an intelligence artifact for CTI indexing (do not execute any embedded code).",
  "bucket": {
    "host": null,
    "bucket_id": null,
    "id": null,
    "provider": null
  },
  "commit": {
    "author_email": null,
    "author_id": null,
    "author_name": null,
    "committer_email": null,
    "committer_id": null,
    "committer_name": null,
    "sha": null,
    "patch_url": null
  },
  "code": {
    "commit_name": null,
    "commit_date": null,
    "path": null,
    "commit_email": null
  },
  "duplicates": [],
  "header": {
    "actor": "",
    "actor_id": null,
    "category_name": "driller",
    "content_hash": "driller/google_search/example-id-413",
    "content_preview": "Search-engine-captured page about 'Best Hacking Tools' with full HTML and embedded metadata.",
    "country": null,
    "duplicates": [],
    "es_score": 1.0,
    "expiration": null,
    "highlights": {},
    "host": null,
    "id": "example-id-413",
    "infection_date": null,
    "parent_id": null,
    "parent_title": null,
    "parent_title_en": null,
    "parent_uid": null,
    "parent_uids": [],
    "risk": { "score": 1 },
    "similar_items_count": 0,
    "source": "google_search",
    "source_name": "Search Engine Crawl",
    "target_name": "Search Engine Crawl",
    "tags": ["crawler", "html", "intake"],
    "notes": null,
    "state_code": null,
    "timestamp": "2025-03-21T21:08:10.949536+00:00",
    "title": "Example Intelligence Scrape — Search Engine Crawl",
    "type": "driller",
    "uid": "driller/google_search/example-id-413",
    "user_risk_score": null,
    "user_notes": null,
    "ignored_at": null,
    "remediated_at": null,
    "verb": "scraped",
    "external_url": null,
    "external_netloc": null,
    "can_have_duplicates": true,
    "priority_action_uuid_related": false,
    "victim_name": null,
    "contains_secrets": null,
    "secrets_metadata": null
  },
  "history_logs": null,
  "metadata": {
    "estimated_created_at": "2025-03-21T21:08:10.949536+00:00",
    "event_id": null,
    "first_crawled_at": "2025-03-21T21:08:10.949536+00:00",
    "last_crawled_at": "2025-03-25T22:49:57.146074+00:00",
    "payload_digest": "example-payload-digest-1445a761",
    "scraped_at": "2025-03-25T22:49:57.160355+00:00",
    "source": "google_search",
    "crawled_by": null,
    "flare_url": "https://app.flare.io/#/driller/google_search/2c3aedb836e52893c8254ac0ac6bf4bca8dce5c1"
  },
  "similar_items": []
}
```


# Leaked Credentials
Source: https://api.docs.flare.io/event-types/leaked-credential



The `leaked_credential` event type represents a single leaked credentials, usually in the form of a `url:login:password` triplet.

```json Example Content theme={null}
{
  "activity": {
    "data": {
      "es_id": "425470/leaked_credential/combolists/9492d3cb916d17660421053e3a68674f",
      "es_score": 1,
      "highlights": {},
      "id": null,
      "index": "leaked_credential",
      "metadata": {
        "estimated_created_at": "2026-03-05T05:48:05.031000+00:00",
        "event_id": null,
        "first_crawled_at": "2026-03-05T05:49:52.429348+00:00",
        "last_crawled_at": "2026-03-05T05:49:52.429348+00:00",
        "payload_digest": "5f59f9014eb1121f56701d818f482091c04e1b93",
        "scraped_at": "2026-03-05T05:49:52.429348+00:00",
        "source": "combolists",
        "crawled_by": null,
        "flare_url": "https://app.flare.io/#/leaked_credential/combolists/9492d3cb916d17660421053e3a68674f"
      },
      "uid": "leaked_credential/combolists/9492d3cb916d17660421053e3a68674f",
      "url": null,
      "browser_url": null,
      "domain": null,
      "identity_name": "example_user@example.com",
      "imported_at": "2026-03-05T05:48:05.031000+00:00",
      "password": "ExamplePassword", # Only shown with the appropriate permission
      "source_id": "combolists",
      "source_name": "Combolists",
      "leak_id": 406285232303,
      "leak_source": {
        "id": "combolists",
        "name": "Combolists",
        "description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
        "description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) échangées sur des réseaux illicites.",
        "breached_at": null,
        "leaked_at": null,
        "pii_tags": []
      },
      "features": {
        "domains": [
          "example.com"
        ],
        "emails": [
          "example_user@example.com"
        ],
        "ip_addresses": null,
        "ip_addresses_cidr": null,
        "reversed_domains": [
          "com.example"
        ],
        "urls": null,
        "usernames": null,
        "vulnerabilities": null
      }
    },
    "duplicates": [],
    "header": {
      "actor": null,
      "actor_id": null,
      "bank": null,
      "bin": null,
      "brand": null,
      "credential_count": null,
      "category_name": "Leaked Credential",
      "content_hash": "5f59f9014eb1121f56701d818f482091c04e1b93",
      "content_preview": "Email / Username: example_user@example.com",
      "country": null,
      "duplicates": [],
      "es_score": 1,
      "expiration": null,
      "highlights": {},
      "host": null,
      "id": "9492d3cb916d17660421053e3a68674f",
      "infection_date": null,
      "parent_id": null,
      "parent_title": null,
      "parent_title_en": null,
      "parent_uid": null,
      "parent_uids": [],
      "risk": {
        "score": 4
      },
      "similar_items_count": 0,
      "source": "combolists",
      "source_name": "Combolists",
      "target_name": "Combolists",
      "tags": [],
      "notes": null,
      "state_code": null,
      "timestamp": "2026-03-05T05:48:05.031000+00:00",
      "title": "",
      "type": "leaked_credential",
      "uid": "leaked_credential/combolists/9492d3cb916d17660421053e3a68674f",
      "user_risk_score": null,
      "user_notes": null,
      "ignored_at": null,
      "remediated_at": null,
      "verb": "",
      "external_url": null,
      "external_netloc": null,
      "can_have_duplicates": true,
      "priority_action_uuid_related": false,
      "analyzers_items_uids": [],
      "victim_name": null,
      "contains_secrets": null,
      "secrets_metadata": null,
      "identity_name": "example_user@example.com",
      "password": "ExamplePassword" # Only shown with the appropriate permission
    },
    "history_logs": null,
    "metadata": {
      "estimated_created_at": "2026-03-05T05:48:05.031000+00:00",
      "event_id": null,
      "first_crawled_at": "2026-03-05T05:49:52.429348+00:00",
      "last_crawled_at": "2026-03-05T05:49:52.429348+00:00",
      "payload_digest": "5f59f9014eb1121f56701d818f482091c04e1b93",
      "scraped_at": "2026-03-05T05:49:52.429348+00:00",
      "source": "combolists",
      "crawled_by": null,
      "flare_url": "https://app.flare.io/#/leaked_credential/combolists/9492d3cb916d17660421053e3a68674f"
    },
    "similar_items": []
  }
}
```


# Listing
Source: https://api.docs.flare.io/event-types/listing



The `listing` type represents marketplace product advertisements sourced from dark web or illicit online markets.
Each record captures a single product post, including its title, description, seller information, price, and shipping regions.\
Listings can refer to drugs, malware, guides, digital goods, counterfeit items, or stolen data, depending on the source market.

```json Example Content theme={null}
{
  "activity": {
    "data": {
      "es_id": "dark_market/listing_12345",
      "es_score": 1.0,
      "highlights": {},
      "id": "listing_12345",
      "index": "listing",
      "metadata": {
        "estimated_created_at": "2025-03-12T09:15:00Z",
        "event_id": null,
        "first_crawled_at": "2025-03-12T09:15:00Z",
        "last_crawled_at": "2025-03-14T16:30:00Z",
        "payload_digest": "abcdef0987654321abcdef0987654321abcdef09",
        "scraped_at": "2025-03-14T16:31:00Z",
        "source": "dark_market",
        "crawled_by": null,
        "flare_url": "https://app.cti.example.com/#/listing/dark_market/listing_12345"
      },
      "uid": "listing/dark_market/listing_12345",
      "url": "http://darkmarketxyz.onion/products/listing_12345",
      "browser_url": null,
      "actor": "vendor_alpha",
      "actor_id": "vendor_alpha",
      "actor_name": "vendor_alpha",
      "category_name": null,
      "classification": {
        "classes": {
          "is_carding": null,
          "is_bypass": null,
          "is_ident_fraud": null,
          "is_doc_fraud": null,
          "is_phishing": null,
          "is_money_xfer": null,
          "is_cashout": null,
          "is_virt_currency": null,
          "is_hacking": null,
          "is_misc_financial": null
        },
        "types": {
          "is_guide": null,
          "is_service": null,
          "is_software": null,
          "is_hardware": null,
          "is_data": null
        }
      },
      "currency": "usd",
      "description": "Listing for a cybercrime-related product with anonymized shipment details and general marketplace disclaimers.",
      "description_en": null,
      "description_preview": [""],
      "escrow": null,
      "price": "75.00",
      "seller_id": "vendor_alpha",
      "seller_name": "vendor_alpha",
      "ship_to": ["Worldwide"],
      "ship_from": ["United States"],
      "title": "Synthetic Product Sample",
      "title_en": null,
      "stock_count": 8000
    },
    "duplicates": [],
    "header": {
      "actor": "vendor_alpha",
      "actor_id": "vendor_alpha",
      "bank": null,
      "bin": null,
      "brand": null,
      "credential_count": null,
      "category_name": "",
      "content_hash": "abcdef0987654321abcdef0987654321abcdef09",
      "content_preview": "Listing for a cybercrime-related product with anonymized shipment details...",
      "country": null,
      "duplicates": [],
      "es_score": 1.0,
      "expiration": null,
      "highlights": {},
      "host": null,
      "id": "listing_12345",
      "infection_date": null,
      "parent_id": null,
      "parent_title": null,
      "parent_title_en": null,
      "parent_uid": null,
      "parent_uids": [],
      "risk": {
        "score": 3
      },
      "similar_items_count": 0,
      "source": "dark_market",
      "source_name": "Dark Market",
      "target_name": "Dark Market",
      "tags": [],
      "notes": null,
      "state_code": null,
      "timestamp": "2025-03-12T09:15:00Z",
      "title": "Synthetic Product Sample",
      "type": "listing",
      "uid": "listing/dark_market/listing_12345",
      "user_risk_score": null,
      "user_notes": null,
      "ignored_at": null,
      "remediated_at": null,
      "verb": "announced",
      "external_url": null,
      "external_netloc": null,
      "can_have_duplicates": true,
      "priority_action_uuid_related": false,
      "analyzers_items_uids": [],
      "victim_name": null,
      "contains_secrets": null,
      "secrets_metadata": null
    },
    "history_logs": null,
    "metadata": {
      "estimated_created_at": "2025-03-12T09:15:00Z",
      "event_id": null,
      "first_crawled_at": "2025-03-12T09:15:00Z",
      "last_crawled_at": "2025-03-14T16:30:00Z",
      "payload_digest": "abcdef0987654321abcdef0987654321abcdef09",
      "scraped_at": "2025-03-14T16:31:00Z",
      "source": "dark_market",
      "crawled_by": null,
      "flare_url": "https://app.cti.example.com/#/listing/dark_market/listing_12345"
    },
    "similar_items": []
  }
}
```


# Event Types
Source: https://api.docs.flare.io/event-types/overview

Overview of all Flare API event types

| Event Type                                                                | Documentation                                                                                                                       |
| ------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `blog_post`                                                               | [Blog Post <Icon icon="book" />](/event-types/blog-post)                                                                            |
| `bucket_object`                                                           | [Bucket Object <Icon icon="book" />](/event-types/bucket-object)                                                                    |
| `bucket`                                                                  | [Bucket <Icon icon="book" />](/event-types/bucket)                                                                                  |
| `document`                                                                | [Ransomleak (document) <Icon icon="book" />](/event-types/document)                                                                 |
| `domain`                                                                  | [Lookalike Domain (domain) <Icon icon="book" />](/event-types/domain#domain)                                                        |
| `domain_title`                                                            | [Domain Title <Icon icon="book" />](/event-types/domain#domain_title)                                                               |
| `domain_ip_address`                                                       | [Domain IP Address <Icon icon="book" />](/event-types/domain#domain_ip_address)                                                     |
| `domain_favicon`                                                          | [Domain Favicon <Icon icon="book" />](/event-types/domain#domain_favicon)                                                           |
| `domain_screenshot`                                                       | [Domain Screenshot <Icon icon="book" />](/event-types/domain#domain_screenshot)                                                     |
| `domain_dns_records`                                                      | [Domain DNS Records <Icon icon="book" />](/event-types/domain#domain_dns_records)                                                   |
| `domain_whois_rdap`                                                       | [Domain WHOIS/RDAP <Icon icon="book" />](/event-types/domain#domain_whois_rdap)                                                     |
| `domain_certificate`                                                      | [Domain Certificate <Icon icon="book" />](/event-types/domain#domain_certificate)                                                   |
| `experimental`                                                            | [Experimental <Icon icon="book" />](/event-types/experimental)                                                                      |
| `forum_post`                                                              | [Forum Post <Icon icon="book" />](/event-types/forum-post)                                                                          |
| `forum_topic`                                                             | [Forum Topic <Icon icon="book" />](/event-types/forum-topic)                                                                        |
| `google`                                                                  | [Google <Icon icon="book" />](/event-types/google)                                                                                  |
| `leaked_credential`                                                       | [Leaked Credentials <Icon icon="book" />](/event-types/leaked-credential)                                                           |
| `listing`                                                                 | [Listing <Icon icon="book" />](/event-types/listing)                                                                                |
| `paste`                                                                   | [Paste <Icon icon="book" />](/event-types/paste)                                                                                    |
| `profile`                                                                 | [Profile <Icon icon="book" />](/event-types/profile)                                                                                |
| `seller`                                                                  | [Seller <Icon icon="book" />](/event-types/seller)                                                                                  |
| `source_code`                                                             | [Source code <Icon icon="book" />](/event-types/source-code)                                                                        |
| `stealer_log`                                                             | [Stealer Log <Icon icon="book" />](/event-types/stealer-log)                                                                        |
| `driller`, `driller_forum_topic`, `driller_forum_post`, `driller_profile` | Not intended to be directly searchable, can be found by searching the types they power like `source_code`, `google` or `forum_post` |
| `chat_message`                                                            | Chats that are ingested, mostly Telegram.                                                                                           |
| `attachment`                                                              | Attachments that are collected in telegram chats.                                                                                   |
| `social_media`                                                            | Social media accounts that we find related to events that match identifiers.                                                        |
| `experimental`                                                            | Evolving list of test sources uncovered by our research team.                                                                       |
| `service`                                                                 | Hosts with potentially exposed services that we discover on the open web.                                                           |

# Categories

See [Event Source Filters <Icon icon="book" />](/advanced/event-source-filters)


# Paste
Source: https://api.docs.flare.io/event-types/paste



The `paste` event type corresponds to public text pastes found on paste sites such as *Pastebin*, *JustPaste.it*, *YamCode*, or similar sharing services.\
These entries typically contain raw text dumps, links to leaked data, code snippets, or communication content,  sometimes referencing or re-hosting credential leaks.

```json Example Content theme={null}
{
  "activity": {
    "data": {
      "es_id": "paste_site/example_paste_12345",
      "es_score": 1.0,
      "highlights": {},
      "id": "example_paste_12345",
      "index": "paste",
      "metadata": {
        "estimated_created_at": "2025-03-18T00:00:00Z",
        "event_id": null,
        "first_crawled_at": "2025-03-18T09:00:00Z",
        "last_crawled_at": "2025-03-18T09:00:00Z",
        "payload_digest": "123abc456def789ghi012jkl345mno678pqr901",
        "scraped_at": "2025-03-18T09:00:30Z",
        "source": "paste_site",
        "crawled_by": null,
        "flare_url": "https://app.cti.example.com/#/paste/paste_site/example_paste_12345"
      },
      "uid": "paste/paste_site/example_paste_12345",
      "url": "http://pasteexample.onion/example_paste_12345",
      "browser_url": null,
      "actor": "threat_user01",
      "actor_id": null,
      "actor_name": "threat_user01",
      "content": "Example text containing links or credentials shared on a paste site.",
      "content_en": null,
      "title": "Leaked Credentials Paste",
      "title_en": null,
      "expire_at": null,
      "syntax": null,
      "features": {
        "domains": ["example.com"],
        "emails": null,
        "ip_addresses": null,
        "ip_addresses_cidr": null,
        "reversed_domains": ["com.example"],
        "urls": ["example.com/leak123"],
        "usernames": null,
        "vulnerabilities": null
      }
    },
    "duplicates": [],
    "header": {
      "actor": "threat_user01",
      "actor_id": null,
      "bank": null,
      "bin": null,
      "brand": null,
      "credential_count": null,
      "category_name": "",
      "content_hash": "123abc456def789ghi012jkl345mno678pqr901",
      "content_preview": "Example text containing links or credentials...",
      "country": null,
      "duplicates": [],
      "es_score": 1.0,
      "expiration": null,
      "highlights": {},
      "host": null,
      "id": "example_paste_12345",
      "infection_date": null,
      "parent_id": null,
      "parent_title": null,
      "parent_title_en": null,
      "parent_uid": null,
      "parent_uids": [],
      "risk": {
        "score": 2
      },
      "similar_items_count": 0,
      "source": "paste_site",
      "source_name": "Paste Site",
      "target_name": "Paste Site",
      "tags": [],
      "notes": null,
      "state_code": null,
      "timestamp": "2025-03-18T00:00:00Z",
      "title": "Leaked Credentials Paste",
      "type": "paste",
      "uid": "paste/paste_site/example_paste_12345",
      "user_risk_score": null,
      "user_notes": null,
      "ignored_at": null,
      "remediated_at": null,
      "verb": "",
      "external_url": null,
      "external_netloc": null,
      "can_have_duplicates": true,
      "priority_action_uuid_related": false,
      "analyzers_items_uids": [],
      "victim_name": null,
      "contains_secrets": false,
      "secrets_metadata": []
    },
    "history_logs": null,
    "metadata": {
      "estimated_created_at": "2025-03-18T00:00:00Z",
      "event_id": null,
      "first_crawled_at": "2025-03-18T09:00:00Z",
      "last_crawled_at": "2025-03-18T09:00:00Z",
      "payload_digest": "123abc456def789ghi012jkl345mno678pqr901",
      "scraped_at": "2025-03-18T09:00:30Z",
      "source": "paste_site",
      "crawled_by": null,
      "flare_url": "https://app.cti.example.com/#/paste/paste_site/example_paste_12345"
    },
    "similar_items": []
  }
}
```


# Profile
Source: https://api.docs.flare.io/event-types/profile



The `driller_profile` type captures developer identity profiles discovered on software development platforms such as GitHub, GitLab, or Bitbucket.\
These profiles are enriched by analyzing open-source repositories, contributor metadata, and contact information to build intelligence around potentially exposed developer accounts or threat-linked GitHub users.

```json Example Content theme={null}
{
  "activity": {
    "data": {
      "es_id": "driller_github/user_98765",
      "es_score": 1.0,
      "highlights": {},
      "id": "user_98765",
      "index": "driller_profile",
      "metadata": {
        "estimated_created_at": "2025-03-08T17:04:18Z",
        "event_id": null,
        "first_crawled_at": "2025-02-10T05:04:09Z",
        "last_crawled_at": "2025-03-08T17:04:19Z",
        "payload_digest": null,
        "scraped_at": "2025-03-08T17:04:19Z",
        "source": "github",
        "crawled_by": null,
        "flare_url": "https://app.cti.example.com/#/driller_profile/github/user_98765"
      },
      "uid": "driller_profile/github/user_98765",
      "url": null,
      "browser_url": null,
      "about": "",
      "about_en": null,
      "contact_info": {
        "twitter": null,
        "email": "example_contact@protonmail.com"
      },
      "location": null,
      "website": null,
      "groups": null,
      "username": null,
      "realname": "User98765",
      "features": {
        "domains": null,
        "emails": ["example_contact@protonmail.com"],
        "ip_addresses": null,
        "ip_addresses_cidr": null,
        "reversed_domains": null,
        "urls": null,
        "usernames": null,
        "vulnerabilities": null
      }
    },
    "duplicates": [],
    "header": {
      "actor": "User98765",
      "actor_id": "User98765",
      "bank": null,
      "bin": null,
      "brand": null,
      "credential_count": null,
      "category_name": "",
      "content_hash": "driller_profile/github/user_98765",
      "content_preview": "...",
      "country": null,
      "duplicates": [],
      "es_score": 1.0,
      "expiration": null,
      "highlights": {},
      "host": null,
      "id": "user_98765",
      "infection_date": null,
      "parent_id": null,
      "parent_title": null,
      "parent_title_en": null,
      "parent_uid": null,
      "parent_uids": [],
      "risk": {
        "score": 1
      },
      "similar_items_count": 0,
      "source": "github",
      "source_name": "GitHub",
      "target_name": "GitHub",
      "tags": [],
      "notes": null,
      "state_code": null,
      "timestamp": "2025-03-08T17:04:18Z",
      "title": "User98765",
      "type": "driller_profile",
      "uid": "driller_profile/github/user_98765",
      "user_risk_score": null,
      "user_notes": null,
      "ignored_at": null,
      "remediated_at": null,
      "verb": "",
      "external_url": null,
      "external_netloc": null,
      "can_have_duplicates": true,
      "priority_action_uuid_related": false,
      "analyzers_items_uids": [],
      "victim_name": null,
      "contains_secrets": null,
      "secrets_metadata": null
    },
    "history_logs": null,
    "metadata": {
      "estimated_created_at": "2025-03-08T17:04:18Z",
      "event_id": null,
      "first_crawled_at": "2025-02-10T05:04:09Z",
      "last_crawled_at": "2025-03-08T17:04:19Z",
      "payload_digest": null,
      "scraped_at": "2025-03-08T17:04:19Z",
      "source": "github",
      "crawled_by": null,
      "flare_url": "https://app.cti.example.com/#/driller_profile/github/user_98765"
    },
    "similar_items": []
  }
}
```


# Seller
Source: https://api.docs.flare.io/event-types/seller



The `seller` event type represents a vendor profile extracted from darknet marketplaces or illicit e-commerce platforms.\
Each record corresponds to a seller’s identity page, including their alias, reputation score, number of transactions, and contact details (such as PGP public keys or Telegram handles).\
This information is used to track threat actor personas, understand marketplace reputations, and correlate sellers across multiple marketplaces or identities.

```json Example Content theme={null}
{
  "activity": {
    "data": {
      "es_id": "dark_market/seller_12345",
      "es_score": 1.0,
      "highlights": {},
      "id": "seller_12345",
      "index": "seller",
      "metadata": {
        "estimated_created_at": "2025-03-25T17:20:23Z",
        "event_id": null,
        "first_crawled_at": "2025-01-10T16:35:15Z",
        "last_crawled_at": "2025-03-25T17:21:05Z",
        "payload_digest": null,
        "scraped_at": "2025-03-25T17:21:06Z",
        "source": "dark_market",
        "crawled_by": null,
        "flare_url": "https://app.cti.example.com/#/seller/dark_market/seller_12345"
      },
      "uid": "seller/dark_market/seller_12345",
      "url": "http://darkmarketxyz.onion/seller/profile/seller_12345",
      "browser_url": null,
      "about": "Seller specializing in high-demand illicit goods and services with a focus on reliability, discretion, and customer satisfaction.",
      "about_en": null,
      "actor": "seller_12345",
      "actor_id": "seller_12345",
      "actor_name": "seller_12345",
      "contact_info": {
        "public_pgp_fingerprint": "-----BEGIN PGP PUBLIC KEY BLOCK-----\nVersion: BCPG v1.58\n\n[Truncated PGP public key data for documentation example]\n-----END PGP PUBLIC KEY BLOCK-----",
        "public_pgp_uid": null
      },
      "title": null,
      "transactions_count": null,
      "rating": ["0.00"],
      "ratings_count": null,
      "rating_pos": null,
      "rating_neg": null,
      "ship_to": null,
      "ship_from": null,
      "features": {
        "domains": null,
        "emails": null,
        "ip_addresses": null,
        "ip_addresses_cidr": null,
        "reversed_domains": null,
        "urls": null,
        "usernames": null,
        "vulnerabilities": null
      }
    },
    "duplicates": [],
    "header": {
      "actor": "seller_12345",
      "actor_id": "seller_12345",
      "bank": null,
      "bin": null,
      "brand": null,
      "credential_count": null,
      "category_name": "",
      "content_hash": "seller/dark_market/seller_12345",
      "content_preview": "Seller specializing in high-demand illicit goods and services...",
      "country": null,
      "duplicates": [],
      "es_score": 1.0,
      "expiration": null,
      "highlights": {},
      "host": null,
      "id": "seller_12345",
      "infection_date": null,
      "parent_id": null,
      "parent_title": null,
      "parent_title_en": null,
      "parent_uid": null,
      "parent_uids": [],
      "risk": {
        "score": 3
      },
      "similar_items_count": 0,
      "source": "dark_market",
      "source_name": "Dark Market",
      "target_name": "Dark Market",
      "tags": [],
      "notes": null,
      "state_code": null,
      "timestamp": "2025-03-25T17:20:23Z",
      "title": "seller_12345",
      "type": "seller",
      "uid": "seller/dark_market/seller_12345",
      "user_risk_score": null,
      "user_notes": null,
      "ignored_at": null,
      "remediated_at": null,
      "verb": "",
      "external_url": null,
      "external_netloc": null,
      "can_have_duplicates": true,
      "priority_action_uuid_related": false,
      "analyzers_items_uids": [],
      "victim_name": null,
      "contains_secrets": null,
      "secrets_metadata": null
    },
    "history_logs": null,
    "metadata": {
      "estimated_created_at": "2025-03-25T17:20:23Z",
      "event_id": null,
      "first_crawled_at": "2025-01-10T16:35:15Z",
      "last_crawled_at": "2025-03-25T17:21:05Z",
      "payload_digest": null,
      "scraped_at": "2025-03-25T17:21:06Z",
      "source": "dark_market",
      "crawled_by": null,
      "flare_url": "https://app.cti.example.com/#/seller/dark_market/seller_12345"
    },
    "similar_items": []
  }
}
```


# Source code
Source: https://api.docs.flare.io/event-types/source-code



The `source_code` event type captures data originating from public source code repositories or registries, such as Docker Hub, GitHub, or GitLab.\
These entries are used to identify potentially exposed code, build artifacts, or embedded secrets that may represent a security risk.\
For Docker images, Flare extracts and analyzes metadata such as the image digest, architecture, tags, and embedded configuration or environment data.

```json Example Content theme={null}
{
  "activity": {
    "data": {
      "es_id": "dockerhub/image_12345",
      "es_score": 1.0,
      "highlights": {},
      "id": "image_12345",
      "index": "docker_image",
      "metadata": {
        "estimated_created_at": "2025-03-20T19:58:52Z",
        "event_id": null,
        "first_crawled_at": "2025-03-20T20:00:00Z",
        "last_crawled_at": "2025-03-20T20:00:00Z",
        "payload_digest": "abc123def456ghi789jkl012mno345pqr678stu901",
        "scraped_at": "2025-03-20T20:00:15Z",
        "source": "dockerhub",
        "crawled_by": null,
        "flare_url": "https://app.cti.example.com/#/docker_image/dockerhub/image_12345"
      },
      "uid": "docker_image/dockerhub/image_12345",
      "url": null,
      "browser_url": null,
      "digest": "sha256:abc123def456ghi789jkl012mno345pqr678stu901",
      "architecture": "amd64",
      "variant": null,
      "os": "linux",
      "os_features": null,
      "os_version": null,
      "size": 19240105,
      "last_pushed_at": "2025-03-20T19:58:52Z",
      "last_pulled_at": "2025-03-20T19:58:54Z",
      "tag": [
        {
          "name": "frontend-prod-latest",
          "repository_name": "exampleorg/webapp"
        }
      ],
      "content": "Dockerfile contents with environment setup, package installations, and service configuration steps. Example truncated for documentation purposes.",
      "features": {
        "domains": ["nginx.org", "example.com"],
        "emails": ["maintainer@example.com"],
        "ip_addresses": null,
        "ip_addresses_cidr": null,
        "reversed_domains": ["org.nginx", "com.example"],
        "urls": ["https://nginx.org/packages/alpine", "https://example.com/repo"],
        "usernames": null,
        "vulnerabilities": null
      }
    },
    "duplicates": [],
    "header": {
      "actor": null,
      "actor_id": null,
      "bank": null,
      "bin": null,
      "brand": null,
      "credential_count": null,
      "category_name": "Docker Image",
      "content_hash": "abc123def456ghi789jkl012mno345pqr678stu901",
      "content_preview": "Dockerfile setup with environment and service configuration steps...",
      "country": null,
      "duplicates": [],
      "es_score": 1.0,
      "expiration": null,
      "highlights": {},
      "host": null,
      "id": "image_12345",
      "infection_date": null,
      "parent_id": null,
      "parent_title": null,
      "parent_title_en": null,
      "parent_uid": null,
      "parent_uids": [],
      "risk": {
        "score": 1
      },
      "similar_items_count": 0,
      "source": "dockerhub",
      "source_name": "Docker Hub",
      "target_name": "Docker Hub",
      "tags": [],
      "notes": null,
      "state_code": null,
      "timestamp": "2025-03-20T19:58:52Z",
      "title": "Docker Image image_12345 (exampleorg/webapp:frontend-prod-latest)",
      "type": "docker_image",
      "uid": "docker_image/dockerhub/image_12345",
      "user_risk_score": null,
      "user_notes": null,
      "ignored_at": null,
      "remediated_at": null,
      "verb": "",
      "external_url": null,
      "external_netloc": null,
      "can_have_duplicates": true,
      "priority_action_uuid_related": false,
      "analyzers_items_uids": [],
      "victim_name": null,
      "contains_secrets": false,
      "secrets_metadata": []
    },
    "history_logs": null,
    "metadata": {
      "estimated_created_at": "2025-03-20T19:58:52Z",
      "event_id": null,
      "first_crawled_at": "2025-03-20T20:00:00Z",
      "last_crawled_at": "2025-03-20T20:00:00Z",
      "payload_digest": "abc123def456ghi789jkl012mno345pqr678stu901",
      "scraped_at": "2025-03-20T20:00:15Z",
      "source": "dockerhub",
      "crawled_by": null,
      "flare_url": "https://app.cti.example.com/#/docker_image/dockerhub/image_12345"
    },
    "similar_items": []
  }
}
```


# Stealer Log
Source: https://api.docs.flare.io/event-types/stealer-log



The `stealer_log` (also observed as `bot` in some indices) represents a record of a compromised device whose credentials and browsing data were harvested by an information stealer malware (such as RedLine, Raccoon, or Vidar).\
These entries originate from dark-web marketplaces (for example, “Russian Market”) where attackers sell logs containing cookies, saved passwords, and session tokens from infected machines.\
Each document corresponds to a single device or “bot,” with metadata describing where and when it was first seen, its environment (OS, IP, ISP), and the websites and services discovered in its data.

```json Example Content theme={null}
{
  "activity": {
    "data": {
      "es_id": "stealer_logs/sample_log_doc_000002",
      "es_score": 1.0,
      "highlights": {},
      "id": "sample_log_doc_000002",
      "index": "stealer_log",
      "metadata": {
        "estimated_created_at": "2025-10-24T03:51:00+00:00",
        "event_id": null,
        "first_crawled_at": "2025-10-28T18:35:15.095033+00:00",
        "last_crawled_at": "2025-10-28T18:35:15.095033+00:00",
        "payload_digest": "f8fbcbf034e346eedf2a8abed80b883433ddccaf",
        "scraped_at": "2025-10-28T18:35:17.333487+00:00",
        "source": "stealer_logs",
        "crawled_by": null,
        "flare_url": "https://app.example.com/#/stealer_log/stealer_logs/sample_log_doc_000002"
      },
      "uid": "stealer_log/stealer_logs/sample_log_doc_000002",
      "url": null,
      "browser_url": null,
      "name": null,
      "installed_at": "2025-10-24T03:51:00+00:00",
      "updated_at": null,
      "seller_id": null,
      "isp": null,
      "information": null,
      "credentials": [
        {
          "url": "https://www.epicgames.com/id/login",
          "username": "user1@example.com",
          "password": "raf*********",
          "application": "Browser/Logins/Edge_Default[edeafc70].txt"
        }
      ],
      "cookies": [
        {
          "host_key": ".instagram.com",
          "path": "/",
          "expires_utc": "2026-03-04T02:22:08",
          "name": "datr",
          "value": "REDACTED"
        },
        {
          "host_key": ".mediafire.com",
          "path": "/",
          "expires_utc": "2026-03-04T12:54:47",
          "name": "ukey",
          "value": "REDACTED"
        }
      ],
      "user_information": {
        "ip_address": "198.51.100.1",
        "ip_network": null,
        "username": "user_display_name",
        "country_code": "BR",
        "zip_code": "",
        "location": "",
        "hwid": "HWID-REDACTED-0001",
        "current_language": "",
        "screensize_width": 1920,
        "screensize_height": 1080,
        "timezone": "UTC-3",
        "os": "Windows 11 24H2 build 26200 (64 Bit)",
        "uac": "",
        "process_elevation": null,
        "available_keyboards": [
          "Portuguese"
        ],
        "hardware": [
          "CPU: AMD Ryzen 5 5500",
          "RAM: 16278 MB",
          "HOSTNAME: HOST-XXXX"
        ],
        "anti_viruses": null
      },
      "malware_information": {
        "malware_family": "unknown",
        "build_id": "",
        "file_location": "",
        "infection_date": "2025-10-24T03:51:00+00:00"
      },
      "files": [
        "Browser/Autofill/Blink_Default[99168010].txt",
        "Browser/Autofill/Blink_Default[9cf42651].txt",
        "Browser/Autofill/Blink_Default[edeafc70].txt",
        "Browser/Autofill/Blink_Default[f4116c65].txt"
      ],
      "price": null,
      "currency": null,
      "features": {
        "domains": [
          "account.educacross.com.br",
          "accounts.google.com",
          "bitly.com",
          "connect.ubisoft.com",
          "discord.com",
          "gmail.com",
          "hotmail.com",
          "myaccount.google.com",
          "saladofuturo.educacao.sp.gov.br",
          "store.steampowered.com",
          "www.epicgames.com",
          "www.fortnite.com",
          "www.roblox.com"
        ],
        "emails": [
          "user1@example.com",
          "user2@example.com"
        ],
        "ip_addresses": [
          "198.51.100.1"
        ],
        "ip_addresses_cidr": [
          "198.51.100.1"
        ],
        "reversed_domains": [
          "br.com.educacross.account",
          "br.gov.sp.educacao.saladofuturo",
          "com.bitly",
          "com.discord",
          "com.epicgames.www",
          "com.fortnite.www",
          "com.gmail",
          "com.google.accounts",
          "com.google.myaccount",
          "com.hotmail",
          "com.roblox.www",
          "com.steampowered.store",
          "com.ubisoft.connect"
        ],
        "urls": [
          "https://account.educacross.com.br/login",
          "https://accounts.google.com/v3/signin/challenge/pwd",
          "https://bitly.com/a/sign_up",
          "https://connect.ubisoft.com/login",
          "https://connect.ubisoft.com/oauth/create",
          "https://discord.com/channels/@me",
          "https://myaccount.google.com/signinoptions/password",
          "https://saladofuturo.educacao.sp.gov.br/login-alunos",
          "https://store.steampowered.com/join/completesignup",
          "https://www.epicgames.com/id/login",
          "https://www.fortnite.com/id/login/customized",
          "https://www.roblox.com/login"
        ],
        "usernames": [
          "user120063621",
          "user_display_name",
          "user_display_2",
          "user_display_3",
          "user_display_4",
          "user_display_5",
          "user1@example.com",
          "user2@example.com",
          "user_display_6"
        ],
        "vulnerabilities": null
      },
      "sources": [
        "stealer_logs_private"
      ]
    },
    "duplicates": [],
    "header": {
      "actor": null,
      "actor_id": null,
      "bank": null,
      "bin": null,
      "brand": null,
      "credential_count": 17,
      "category_name": "Infected Device",
      "content_hash": "f8fbcbf034e346eedf2a8abed80b883433ddccaf",
      "content_preview": "17 credentials",
      "country": null,
      "duplicates": [],
      "es_score": 1.0,
      "expiration": null,
      "highlights": {},
      "host": null,
      "id": "sample_log_doc_000002",
      "infection_date": "2025-10-24T03:51:00+00:00",
      "parent_id": null,
      "parent_title": null,
      "parent_title_en": null,
      "parent_uid": null,
      "parent_uids": [
        "chat_message/telegram/0000000000/00000000000"
      ],
      "risk": {
        "score": 3
      },
      "similar_items_count": 0,
      "source": "stealer_logs",
      "source_name": "Stealer Logs",
      "target_name": "Stealer Logs",
      "tags": [],
      "notes": null,
      "state_code": null,
      "timestamp": "2025-10-24T03:51:00+00:00",
      "title": "",
      "type": "stealer_log",
      "uid": "stealer_log/stealer_logs/sample_log_doc_000002",
      "user_risk_score": null,
      "user_notes": null,
      "ignored_at": null,
      "remediated_at": null,
      "verb": "sold",
      "external_url": "s3://example-bucket/0000000000/00000000000000000000000000000000000000",
      "external_netloc": "example-bucket",
      "can_have_duplicates": true,
      "priority_action_uuid_related": false,
      "analyzers_items_uids": [],
      "victim_name": null,
      "contains_secrets": null,
      "secrets_metadata": null
    },
    "history_logs": null,
    "metadata": {
      "estimated_created_at": "2025-10-24T03:51:00+00:00",
      "event_id": null,
      "first_crawled_at": "2025-10-28T18:35:15.095033+00:00",
      "last_crawled_at": "2025-10-28T18:35:15.095033+00:00",
      "payload_digest": "f8fbcbf034e346eedf2a8abed80b883433ddccaf",
      "scraped_at": "2025-10-28T18:35:17.333487+00:00",
      "source": "stealer_logs",
      "crawled_by": null,
      "flare_url": "https://app.example.com/#/stealer_log/stealer_logs/sample_log_doc_000002"
    },
    "similar_items": []
  }
}
```


# Monitor Leaked Cookies for Your Domain
Source: https://api.docs.flare.io/guides/cookie-monitoring



<Info>
  Access to  is required for this feature.
  Please contact your Customer Success Manager for more details.
</Info>

Flare's
[Leaked Cookies API <Icon icon="code" />](/api-reference/astp/endpoints/post-cookies-search)
allows for searching in cookies matching your domains found in stealer logs.
Integrators may use this API to identify and invalidate sessions before they are taken over.

This will guide will explain how to use the Leaked Cookies API to monitor for newly found cookies and invalidate
their session.

## Prequisites

* Cookie monitoring must be enabled for your tenant. This feature must be activated by Flare Support.
* Access to a mechanism by which you may verify a cookie's validity.
* Access to a mechanism by which you may invalidate a cookie.

## Steps

<Steps>
  <Step title="Fetch one page of results">
    Use the `cookies/_search` endpoint to fetch one page of results.

    If `next` is missing from the response (or is null), this means that you viewed all pages.
  </Step>

  <Step title="Verify and Invalidate">
    Loop over the response's items to verify the cookie's validity and invalidate the cookie.
  </Step>

  <Step title="Ratelimit and go to step 1">
    Wait one second to avoid going over the API rate limit. Then, go back to step 1 to fetch the next page.
  </Step>
</Steps>

## Full Project Template

Flare maintains a full project example on Github:

* [https://github.com/Flared/cookie-monitoring](https://github.com/Flared/cookie-monitoring)

It can serve as a starting point to implement automated session revocation in your organization.

## End-to-End API Example

This is an end-to-end example in Python.

<AccordionGroup>
  <Accordion title="Python SDK Example">
    ```python theme={null}
    import json

    from datetime import datetime
    from datetime import timedelta
    from datetime import timezone
    from flareio import FlareApiClient
    from flareio.ratelimit import Limiter


    api_client = FlareApiClient.from_env()

    limiter_default = Limiter.from_seconds(0.25)

    last_from: str | None = None
    fetched_pages: int = 0
    fetch_full_event: bool = False

    for resp in api_client.scroll(
        method="POST",
        url="/astp/v2/cookies/_search",
        json={
            "from": last_from,
            "domain": "scatterholt.com",
            "paths": ["/", "/login"],
            "names": ["session"],
            "expires_after": datetime.now(
                tz=timezone.utc,
            ).isoformat(),  # Search for cookies not yet expired
            "imported_after": (
                datetime.now(tz=timezone.utc) - timedelta(days=90)
            ).isoformat(),
        },
    ):
        limiter_default.tick()

        resp_data: dict = resp.json()

        fetched_pages += 1
        num_results: int = len(resp_data["items"])
        print(f"Fetched page {fetched_pages} with {num_results} results...")

        # Save the last "next" value.
        last_from = resp_data.get("next") or last_from

        # Iterate on cookies in the current page
        for cookie in resp_data["items"]:
            # Invalidate the cookie here...
            print(f"Cookie Value: {cookie['value']}")

            # Optionally fetch more information about how it was leaked...
            if fetch_full_event:
                limiter_default.tick()
                full_event = api_client.get(
                    url="/firework/v2/activities/",
                    params={
                        "uid": cookie["event_uid"],
                    },
                ).json()["activity"]
                malware_information = full_event["data"]["malware_information"]
                print(f"Malware Info: {json.dumps(malware_information)}")
                user_infomation = full_event["data"]["user_information"]
                print(f"User Info: {json.dumps(user_infomation)}")
                print("--")

    print(f"The next execution could resume using {last_from=}.")
    ```
  </Accordion>
</AccordionGroup>


# Create And Assign Matching Policies to Identifiers
Source: https://api.docs.flare.io/guides/create-identifiers-with-matching-policies



Identifiers (domains, keywords, identities, and other types) and Matching Policies (excluded\_keywords, lucene\_query and other types) can be created, updated and listed via the Management API.

Matching Policies are useful for customers who want precise control over which events appear in an Identifier’s feed, either by including or excluding events based on keywords, or by scoping results with a specific search query.

This guide covers how to create an identifier and apply a matching policy to it.

## Steps

<Steps>
  <Step title="Create an identifier">
    Use the
    [Create Identifier <Icon icon="code" />](/api-reference/v2/endpoints/identifiers/post-fireworkv2assets)
    endpoint to create an identifier. Apply filters to narrow down results to specific identifiers you want to match.
  </Step>

  <Step title="Create a matching policy">
    Use the
    [Create Matching Policy <Icon icon="code" />](/api-reference/v4/endpoints/create-matching-policy)
    endpoint to create a matching policy to precisely control which events should appear in the identifier's feed.
  </Step>

  <Step title="Assign the matching policy to the identifier">
    Use the
    [Assign Policy <Icon icon="code" />](/api-reference/v4/endpoints/assign-policy)
    endpoint to assign the matching policy to the identifier.
  </Step>
</Steps>

## End-to-end examples

<AccordionGroup>
  <Accordion title="Python SDK Example">
    ```python theme={null}
    from flareio import FlareApiClient
    from flareio.ratelimit import Limiter


    api_client = FlareApiClient.from_env()

    limiter_default = Limiter.from_seconds(0.25)

    # 1. Create an Identifier
    identifier_resp = api_client.post(
        "/firework/v2/assets/",
        json={
            "name": "scatterholt.com",
            "type": "domain",
            "search_types": [
                "forum_post",
            ],
            "data": {"type": "domain", "fqdn": "scatterholt.com"},
            "risks": [1, 2, 3, 4, 5],
        },
    )

    identifier = identifier_resp.json()["asset"]
    identifier_id = identifier["id"]

    # Rate limiting (default).
    limiter_default.tick()

    # 2. Create a Matching Policy
    matching_policy_resp = api_client.post(
        "/firework/v4/matching-policies",
        json={
            "name": "Terms to ignore",
            "type": "EXCLUDED_KEYWORDS",
            "value": {"keywords": ["term1", "term2", "term3"]},
        },
    )
    matching_policy = matching_policy_resp.json()
    matching_policy_name = matching_policy["name"]
    matching_policy_uuid = matching_policy["uuid"]

    # Rate limiting (default).
    limiter_default.tick()

    # 3. Assign the matching policy to the identifier
    api_client.post(
        f"/firework/v4/matching-policies/{matching_policy_uuid}/assignments",
        json={"identifier_ids": [identifier_id], "clean_past_events": False},
    )

    print(
        f"Created identifier {identifier_id} with matching policy '{matching_policy_name}' assigned to it"
    )
    ```
  </Accordion>
</AccordionGroup>


# Exporting a Domain's Credentials
Source: https://api.docs.flare.io/guides/credentials-export-domain



<Info>
  Access to  is required for this feature.
  Please contact your Customer Success Manager for more details.
</Info>

Flare's Leaked Credentials API can be used to export a domain's leaked credentials.

This guide will explain how to export all leaked credentials for the example.com domain using the
[credentials/\_search <Icon icon="code" />](/api-reference/astp/endpoints/post-credentials-search)
endpoint.

## Export Steps

<Steps>
  <Step title="Fetch one page of results">
    Use the `credentials/_search` endpoint to fetch one page of results.

    If the returned page of results is empty, this means that the export is complete.
  </Step>

  <Step title="Print the results">
    Loop over the response's items and print the results.
  </Step>

  <Step title="Ratelimit and go to step 1">
    Wait one second to avoid going over the API rate limit. Then, go back to step 1 to fetch the next page.
  </Step>
</Steps>

## End-to-End Examples

These are end-to-end examples in various programming languages.

<AccordionGroup>
  <Accordion title="Python SDK Example">
    ```python theme={null}
    import csv
    import sys

    from flareio import FlareApiClient
    from flareio.ratelimit import Limiter


    api_client = FlareApiClient.from_env()

    limiter = Limiter.from_seconds(0.25)

    # The cursor from which we are starting the current execution.
    last_from: str | None = None

    writer = csv.DictWriter(
        sys.stdout,
        fieldnames=[
            "identity",
            "password",
            "source",
        ],
    )

    for resp in api_client.scroll(
        method="POST",
        url="/astp/v2/credentials/_search",
        json={
            "query": {
                "type": "domain",
                "fqdn": "scatterholt.com",
            },
            "from": last_from,
        },
    ):
        # Print results
        credentials = resp.json()["items"]
        for credential in credentials:
            writer.writerow(
                {
                    "identity": credential["identity_name"],
                    "password": credential["hash"],
                    "source": credential["source"]["id"],
                },
            )

        # Save the cursor for the next execution
        last_from = resp.json().get("next") or last_from

        # Rate limiting.
        limiter.tick()

    print(f"The next execution could resume using {last_from=}.")
    ```
  </Accordion>

  <Accordion title="Go SDK Example">
    ```go theme={null}
    package main

    import (
    	"encoding/csv"
    	"encoding/json"
    	"fmt"
    	"os"
    	"strconv"
    	"time"

    	"github.com/Flared/go-flareio"
    )

    type CredentialsResponse struct {
    	Items []Credential `json:"items"`
    }

    type CredentialSource struct {
    	Id string `json:"id"`
    }

    type Credential struct {
    	Id           int               `json:"id"`
    	Source       *CredentialSource `json:"source"`
    	IdentityName string            `json:"identity_name"`
    	Hash         string            `json:"hash"`
    }

    func exportDomainCredentials(
    	client *flareio.ApiClient,
    	domain string,
    ) error {
    	csvWriter := csv.NewWriter(os.Stdout)

    	for result, err := range client.IterPostJson(
    		"/astp/v2/credentials/_search",
    		nil,
    		map[string]interface{}{
    			"query": map[string]string{
    				"type": "domain",
    				"fqdn": domain,
    			},
    		},
    	) {
    		// Rate Limiting
    		time.Sleep(time.Second * 1)

    		if err != nil {
    			return fmt.Errorf("failed to fetch page: %w", err)
    		}

    		var credentialsResponse CredentialsResponse
    		if err := json.NewDecoder(result.Response.Body).Decode(&credentialsResponse); err != nil {
    			return fmt.Errorf("failed to decode response: %w", err)
    		}

    		for _, credential := range credentialsResponse.Items {
    			if err := csvWriter.Write(
    				[]string{
    					strconv.Itoa(credential.Id),
    					credential.Source.Id,
    					credential.IdentityName,
    					credential.Hash,
    				},
    			); err != nil {
    				return fmt.Errorf("failed to output record: %w", err)
    			}
    		}

    		csvWriter.Flush()
    		if err := csvWriter.Error(); err != nil {
    			return fmt.Errorf("failed to flush writer: %w", err)
    		}

    		if err := result.Response.Body.Close(); err != nil {
    			return fmt.Errorf("failed to close response: %w", err)
    		}
    	}

    	return nil
    }

    func main() {
    	client := flareio.NewApiClient(
    		os.Getenv("FLARE_API_KEY"),
    	)
    	if err := exportDomainCredentials(client, "scatterholt.com"); err != nil {
    		fmt.Println(err)
    		os.Exit(1)
    	}
    }
    ```
  </Accordion>
</AccordionGroup>


# Search in All of Flare's Events
Source: https://api.docs.flare.io/guides/global-search



Global searches in Flare is exposed through the
[global/\_search <Icon icon="code" />](/api-reference/v4/endpoints/global-search)
endpoint.

This guide details a typical search use case and provides an example for how to impement it.

## Use Case

* Export all chat messages collected by Flare in the last 6 hours that match the `fraud` keyword.
* Save our last page cursor so that we can resume fetching results in a future execution.

## Body Parameters

To achieve the desired results, the following body parameters will be used:

| Parameter                         | Value         | Justification                                                                                                            |
| --------------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------ |
| query.query\_string               | fraud         | The keyword we are looking for.                                                                                          |
| filter.types                      | chat\_message | Retrieve only the chat\_message events.                                                                                  |
| order                             | asc           | Retrieve results in ascending order so that we can resume fetching in the future.                                        |
| filter.estimated\_created\_at.gte | `<from_date>` | Replace `<from_date>` with a timestamp that corresponds to 6 hours that we can fetch all results until the current time. |

### Query string examples

Global search supports the Lucene Query Syntax, which supports, among other things, boolean operators and regexes. Here are some common example queries.

| Description                                                | Example                                   |
| ---------------------------------------------------------- | ----------------------------------------- |
| Search for a telegram channel named "Best Telegram Source" | conversation\_name:"Best Telegram Source" |

## Paging

The search endpoint uses parameters that match the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

## Fetching new results in future executions

It is possible to save the `next` in a database and use it to resume fetching new results in the future.
However, it is important that future requests use the same parameters for everything else but `next`. Even the time filter.

## End-to-End Examples

These are end-to-end examples in various programming languages.

<AccordionGroup>
  <Accordion title="Python SDK Example">
    ```python theme={null}
    import datetime

    from flareio import FlareApiClient
    from flareio.ratelimit import Limiter


    api_client = FlareApiClient.from_env()

    limiter_search = Limiter.from_seconds(1)
    limiter_default = Limiter.from_seconds(0.25)

    from_timestamp: str = (
        datetime.datetime.now(tz=datetime.timezone.utc) - datetime.timedelta(hours=1)
    ).isoformat()

    last_from: str | None = None
    fetched_pages: int = 0

    for resp in api_client.scroll(
        method="POST",
        url="/firework/v4/events/global/_search",
        json={
            "size": 10,
            "order": "asc",
            "from": last_from,
            "filters": {
                "type": ["chat_message"],
                "estimated_created_at": {"gte": from_timestamp},
            },
            "query": {
                "type": "query_string",
                "query_string": "hello",
            },
        },
    ):
        limiter_search.tick()

        resp_data: dict = resp.json()
        items: list[dict] = resp_data["items"]

        fetched_pages += 1
        print(f"Fetched page {fetched_pages} with {len(items)} results...")

        # Save the last "next" value.
        last_from = resp_data.get("next") or last_from

        # (Optional): Get the full data
        for item in items:
            limiter_default.tick()

            event_response = api_client.get(
                url="/firework/v2/activities/",
                params={
                    "uid": item["metadata"]["uid"],
                },
            )

            full_data = event_response.json()
            print(f"Here is the full data of the event: {full_data}")

    print(f"The next execution could resume using {last_from=}.")
    ```
  </Accordion>
</AccordionGroup>


# Intelligence Feeds
Source: https://api.docs.flare.io/guides/ioc-feeds



<Info>
  Access to  is required for this feature.
  Please contact your Customer Success Manager for more details.
</Info>

Flare exposes Intelligence Feeds delivered via
[TAXII 2](https://oasis-open.github.io/cti-documentation/taxii/intro.html). The
TAXII **discovery** endpoint is `https://api.flare.io/taxii2/`; point your TAXII
client at it and it will discover the available API roots and feeds below.

## Available Feeds

Flare serves two curated CTI feeds, split by STIX object type:

| Feed         | API Root                                         | TAXII 2 Collection ID                  |
| ------------ | ------------------------------------------------ | -------------------------------------- |
| CTI SDO Feed | `https://api.flare.io/taxii2/cti/`               | `f1a4ec71-0c00-4f5f-9dbd-e8a4cd33aa66` |
| CTI SRO Feed | `https://api.flare.io/taxii2/cti/relationships/` | `f1a4e540-2c14-4d5f-8bbc-2e7eb31ad104` |

* The **CTI SDO Feed** delivers STIX Domain Objects (indicators and related
  Flare-curated cyber threat intelligence).
* The **CTI SRO Feed** delivers STIX Relationship Objects — the `relationship`
  objects that link the SDOs together.

Feed URLs can be constructed using:

* **CTI SDO Feed**
  * Format: `https://api.flare.io/taxii2/cti/collections/<TAXII 2 Collection ID>/`
  * Example: `https://api.flare.io/taxii2/cti/collections/f1a4ec71-0c00-4f5f-9dbd-e8a4cd33aa66/`
* **CTI SRO Feed**
  * Format: `https://api.flare.io/taxii2/cti/relationships/collections/<TAXII 2 Collection ID>/`
  * Example: `https://api.flare.io/taxii2/cti/relationships/collections/f1a4e540-2c14-4d5f-8bbc-2e7eb31ad104/`

## Deprecated Feeds

<Warning>
  The feeds below are deprecated in favor of the CTI SDO and CTI SRO feeds
  above. Please migrate existing integrations to the `/taxii2/cti/` API roots.
</Warning>

| Feed                     | TAXII 2 ID                                   |
| ------------------------ | -------------------------------------------- |
| Full Feed (with context) | `d6092c37-d8d7-45c3-8aff-c4dc26030608`       |
| IPV4 Only                | `feed--689f0191-3b4d-47c8-9313-85820aae7c27` |
| Domains Only             | `feed--a2e7ea2d-ec01-4550-91e5-1316282d01a0` |
| URLs Only                | `feed--af0848cc-ae01-4937-93fe-5d9bf69ba3d2` |

Deprecated feed URLs can be constructed using:

* Format: `https://api.flare.io/taxii2/collections/<TAXII 2 ID>/`
* Example: `https://api.flare.io/taxii2/collections/d6092c37-d8d7-45c3-8aff-c4dc26030608/`

## Authentication

The intelligence feeds use HTTP Basic Auth, which most TAXII clients support:

* The username should be set to `api-key`.
* The password should be your Flare API Key.

Obtaining an API key is documented in the
[Authentication Guide <Icon icon="book" />](/concepts/authentication).

## Query Parameters

| Parameter Name | Description                                         | Example                                 |
| -------------- | --------------------------------------------------- | --------------------------------------- |
| match\[type]   | filter the SDO by type                              | `?match[type]=indicator, malware`       |
| added\_after   | filter the IOCs that were added after the timestamp | `?added_after=2026-02-04T12:05:00.000Z` |
| limit          | restricts the results by the specified amount       | `?limit=25`                             |

### Supported `match[type]` values

The `match[type]` parameter accepts one or more STIX object types (comma-separated,
e.g. `?match[type]=indicator,malware`). The **CTI SDO Feed** serves the types
below; the `relationship` type is served exclusively by the **CTI SRO Feed**.

Any value outside this list returns `400 Unsupported match[type]`.

**STIX 2.1 SDO types**

| `match[type]` value | Object         |
| ------------------- | -------------- |
| `attack-pattern`    | Attack Pattern |
| `campaign`          | Campaign       |
| `indicator`         | Indicator      |
| `infrastructure`    | Infrastructure |
| `intrusion-set`     | Intrusion Set  |
| `location`          | Location       |
| `malware`           | Malware        |
| `report`            | Report         |
| `threat-actor`      | Threat Actor   |
| `tool`              | Tool           |
| `vulnerability`     | Vulnerability  |

**Flare-specific extensions**

These are Flare extensions that have no standard STIX SDO counterpart.

| `match[type]` value | Object                                 |
| ------------------- | -------------------------------------- |
| `actor`             | Threat actor profile tracked by Flare  |
| `chat-channel`      | Monitored chat channel (e.g. Telegram) |
| `forum-thread`      | Forum thread from a monitored source   |

<Note>
  `match[type]=relationship` is **not** valid on the CTI SDO Feed and returns a
  `400`. STIX `relationship` objects are served by the CTI SRO Feed at
  `https://api.flare.io/taxii2/cti/relationships/collections/<TAXII 2 Collection ID>/`.
</Note>

## Code Examples

Code examples for connecting to the feeds can be found in this Github repository:

* [https://github.com/Flared/ioc-feeds-example](https://github.com/Flared/ioc-feeds-example)

The following example uses `taxii2-client`, which is
[available on PyPI](https://pypi.org/project/taxii2-client/).

```python theme={null}
import datetime
import os

from taxii2client.v21 import ApiRoot
from taxii2client.v21 import Server
from taxii2client.v21 import as_pages


def main() -> None:
    server = Server(
        "https://api.flare.io/taxii2/",
        user="api-key",  # Do not change the user.
        password=os.environ["FLARE_API_KEY"],
    )

    print(server.title)

    # Deprecated use the ApiRoot with /cti or /cti/relationship instead
    # api_root = ApiRoot(
    #     url="https://api.flare.io/taxii2/",
    #     user="api-key",  # Do not change the user.
    #     password=os.environ["FLARE_API_KEY"],
    # )

    api_root = ApiRoot(
        url="https://api.flare.io/taxii2/cti/",  # Add relationship to fetch SRO
        user="api-key",  # Do not change the user.
        password=os.environ["FLARE_API_KEY"],
    )

    start_date: datetime.datetime = datetime.datetime.now() - datetime.timedelta(
        hours=2
    )

    # Iterate through the available collections and print new items
    for collection in api_root.collections:
        print(collection.title)

        # Pagination request.
        for envelope in as_pages(
            collection.get_objects,
            per_request=50,
            added_after=start_date,
        ):
            print(envelope)


if __name__ == "__main__":
    main()
```


# List Credentials Within a Tenant
Source: https://api.docs.flare.io/guides/tenant-credentials



Browsing credentials within a tenant is exposed through the
[List Tenant Credentials <Icon icon="code" />](/api-reference/v2/endpoints/me/get-mefeedcredentials)
API.

This guide explains how to use the tenant feed API to perform a full export
of all credentials results.

## Paging

The tenant credentials feed endpoint uses parameters that match the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

## End-to-End Examples

These are end-to-end examples in various programming languages.

<AccordionGroup>
  <Accordion title="Python SDK Example">
    ```python theme={null}
    from flareio import FlareApiClient
    from flareio.ratelimit import Limiter


    api_client = FlareApiClient.from_env()

    limiter = Limiter.from_seconds(1)

    last_from: str | None = None
    fetched_pages: int = 0

    for resp in api_client.scroll(
        method="GET",
        url="/firework/v2/me/feed/credentials",
        params={
            "from": last_from,
            "order_type": "asc",
        },
    ):
        # Rate limiting.
        limiter.tick()

        resp_data: dict = resp.json()

        fetched_pages += 1
        num_results: int = len(resp_data["items"])
        print(f"Fetched page {fetched_pages} with {num_results} results...")

        # Save the last "next" value.
        last_from = resp_data.get("next") or last_from

        for item in resp_data["items"]:
            print(item)

    print(f"The next execution could resume using {last_from=}.")
    ```
  </Accordion>
</AccordionGroup>


# List Events Within a Tenant
Source: https://api.docs.flare.io/guides/tenant-events



Browsing events within a tenant is exposed through the
[List Tenant Events <Icon icon="code" />](/api-reference/v4/endpoints/current-tenant-feed)
API.

This guide explains how to use the tenant feed API perform a full export
of all results.

## Paging

The tenant feed endpoint uses parameters that match the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

## Fetching new results in future executions

It is possible to save the `next` in a database and use it to resume fetching new results in the future.
However, it is important that future requests use **exactly** the same parameters for everything else but `next`.

## Getting the full data of results

For performance reasons, feed results only contain the bare minimum.
To get the full data, an API call must be made per result to the
[Retrieve Event <Icon icon="code" />](/api-reference/v2/endpoints/activities/get-activities-)
endpoint.

## Available Endpoints

### List events for a tenant

If you're looking to export the events of a tenant, refer to the
[List Tenant Events <Icon icon="code" />](/api-reference/v4/endpoints/current-tenant-feed)
endpoint.

```python theme={null}
# (incomplete example)

for resp in api_client.scroll(
    method="POST",
    url="/firework/v4/events/tenant/_search",
    json={
        "from": last_from,
    },
):
    ...
```

### List events for a single identifier

If you're looking to export the events of a single identifier, refer to the
[List Identifier Events <Icon icon="code" />](/api-reference/v4/endpoints/identifier-feed)
endpoint.

```python theme={null}
# (incomplete example)

# ID of the identifier for which we want to list the events.
identifier_id: int = 12345

for resp in api_client.scroll(
    method="POST",
    url=f"/firework/v4/events/identifiers/{identifier_id}/_search",
    json={
        "from": last_from,
    },
):
    ...
```

### List events for an identifier group

If you're looking to export the events of an entire identifier group, refer to the [List Identifier Group's Events <Icon icon="code" />](/api-reference/v4/endpoints/identifier-group-feed) endpoint.

```python theme={null}
# (incomplete example)

# ID of the identifier group for which we want to list the events.
identifier_group_id: int = 12345

for resp in api_client.scroll(
    method="POST",
    url=f"/firework/v4/events/identifier_groups/{identifier_group_id}/_search",
    json={
        "from": last_from,
    },
):
    ...
```

## End-to-End Examples

These are end-to-end examples in various programming languages.

<AccordionGroup>
  <Accordion title="Python SDK Example">
    ```python theme={null}
    from flareio import FlareApiClient
    from flareio.ratelimit import Limiter


    api_client = FlareApiClient.from_env()

    limiter_search = Limiter.from_seconds(1)
    limiter_default = Limiter.from_seconds(0.25)

    last_from: str | None = None
    fetched_pages: int = 0

    for resp in api_client.scroll(
        method="POST",
        url="/firework/v4/events/tenant/_search",
        json={
            "from": last_from,
        },
    ):
        limiter_search.tick()

        resp_data: dict = resp.json()

        fetched_pages += 1
        num_results: int = len(resp_data["items"])
        print(f"Fetched page {fetched_pages} with {num_results} results...")

        # Save the last "next" value.
        last_from = resp_data.get("next") or last_from

        # (Optional): Get the full data
        for item in resp_data["items"]:
            limiter_default.tick()

            event_response = api_client.get(
                url="/firework/v2/activities/",
                params={
                    "uid": item["metadata"]["uid"],
                },
            )

            full_data = event_response.json()
            print(f"Here is the full data of the event: {full_data}")

    print(f"The next execution could resume using {last_from=}.")
    ```
  </Accordion>
</AccordionGroup>


# Generate a Threat Flow Report
Source: https://api.docs.flare.io/guides/threat-flow-report



<Steps>
  <Step title="Create a report request">
    Use the
    [threat\_flow/reports/request <Icon icon="code" />](/api-reference/v4/endpoints/create-report-request)
    endpoint to create a new report request.

    This endpoint returns an id that can be used to fetch the report when it is ready.
  </Step>

  <Step title="Verify for the report's status">
    Use the
    [/threat\_flow/reports/\{report\_id} <Icon icon="code" />](/api-reference/v4/endpoints/get-report)
    endpoint to verify the status.

    If the report is ready, this endpoint will return an object with the `status` property set to `completed`.

    If the report is not yet completed, wait 5 seconds and call this endpoint again.
  </Step>

  <Step title="Access the report">
    On success, access the `report` property of the previous response to view the report.
  </Step>
</Steps>

## End-to-End API Example

This is an end-to-end example in Python.

<AccordionGroup>
  <Accordion title="Python SDK Example">
    ```python theme={null}
    import json
    import time

    from datetime import datetime
    from datetime import timedelta
    from flareio import FlareApiClient


    api_client = FlareApiClient.from_env()

    # Create a report request
    report_request_resp = api_client.post(
        "/firework/v4/threat_flow/reports/requests",
        json={
            "report_title": f"XSS report - {datetime.now().isoformat()}",
            "question": "xss vulnerability in banks",
            "time_range_type": "last_1m",
            "included_keywords": ["xss"],
            "excluded_keywords": ["canada"],
        },
    )
    report_request_resp.raise_for_status()
    request_id: str = report_request_resp.json()["request_id"]
    print(f"Created report request: {request_id=}")

    # Wait for the report to be completed
    timeout = datetime.now() + timedelta(minutes=5)
    while datetime.now() < timeout:
        report_resp = api_client.get(
            f"/firework/v4/threat_flow/reports/requests/{request_id}",
        )
        report_resp.raise_for_status()
        report_status = report_resp.json()["status"]

        if report_status == "completed":
            break
        elif report_status != "processing":
            raise Exception(f"Unexpected report status: {report_status=}")

        print("Waiting for report to be completed...")
        time.sleep(5)
    else:
        raise Exception("Failed to create report within 5 minutes")

    # Display the report
    report: dict = report_resp.json()["report"]
    print("Report:")
    print(json.dumps(report, indent=4))
    ```
  </Accordion>
</AccordionGroup>


# List and Update Identifiers
Source: https://api.docs.flare.io/guides/update-identifiers



Identifiers (domains, keywords, identities, and other types) can be listed and updated via the Management API.
This guide covers how to list identifiers, retrieve a specific identifier by ID, and update it using the endpoints below.

## Steps

<Steps>
  <Step title="List identifiers">
    Use the
    [List Identifiers <Icon icon="code" />](/api-reference/v3/endpoints/identifiers/get-fireworkv3identifiers)
    endpoint to retrieve all identifiers. Apply filters to narrow down results to specific identifiers you want to update.
  </Step>

  <Step title="Get the full identifier by ID">
    Use the
    [Get Identifier <Icon icon="code" />](/api-reference/v3/endpoints/identifiers/get-fireworkv3identifiers-1)
    endpoint with the identifier ID to retrieve its complete details and associated data needed to perform the update.
  </Step>

  <Step title="Update the identifier by ID">
    Use the
    [Update Asset (Identifier) <Icon icon="code" />](/api-reference/v2/endpoints/identifiers/put-fireworkv2assets)
    endpoint to apply the desired changes to each identifier.
  </Step>
</Steps>

## End-to-end examples

<AccordionGroup>
  <Accordion title="Python SDK Example">
    ```python theme={null}
    from flareio import FlareApiClient
    from flareio.ratelimit import Limiter


    api_client = FlareApiClient.from_env()

    limiter_default = Limiter.from_seconds(0.25)

    # 1. List all identifiers
    for resp in api_client.scroll(
        method="GET",
        url="/firework/v3/identifiers/",
    ):
        limiter_default.tick()

        for item in resp.json()["items"]:
            limiter_default.tick()

            identifier_id = item["id"]

            # 2. Get the full identifier by ID
            identifier_resp = api_client.get(f"/firework/v3/identifiers/{identifier_id}")
            identifier = identifier_resp.json()["identifier"]

            # Rate limiting (default).
            limiter_default.tick()

            # 3. Do the necessary updates to the identifier
            api_client.put(
                f"/firework/v2/assets/{identifier_id}",
                json={
                    "name": identifier.get("name", "")
                    + " (updated)",  # Example: update name or other fields
                    "type": identifier.get("type"),  # Required
                    "data": identifier.get("data"),  # Required
                    # Include other fields from the Identifier schema as needed
                },
            )
            print(f"Updated identifier {identifier_id}")
    ```
  </Accordion>
</AccordionGroup>


# Getting Started
Source: https://api.docs.flare.io/introduction/getting-started



The Flare API can be used to access Flare's search capabilities, configure monitoring, export events, and more.

## Base Concepts

<CardGroup>
  <Card title="Authentication" icon="key" href="/concepts/authentication">
    Create an API Key and obtain API tokens.
  </Card>

  <Card title="Rate Limits" icon="gauge-high" href="/concepts/rate-limits-and-quotas">
    Learn about the Flare API's rate limits.
  </Card>

  <Card title="Paging" icon="scroll" href="/concepts/paging">
    Learn about Flare's standard `from` request parameter and `next` response field.
  </Card>
</CardGroup>

## SDK

<CardGroup>
  <Card title="Python SDK" icon="python" href="/sdk/python">
    The Python SDK exposes a small `requests` wrapper
    that automatically manages authentication.
  </Card>

  <Card title="Go SDK" icon="golang" href="/sdk/go">
    The Go SDK exposes a small `net/http.Client` wrapper
    that automatically manages authentication.
  </Card>
</CardGroup>

## CLI

<CardGroup>
  <Card title="CLI (beta)" icon="terminal" href="/sdk/cli">
    Interact with the Flare API from your terminal.
  </Card>
</CardGroup>

## MCP

<CardGroup>
  <Card title="API MCP (beta)" icon="robot" href="/sdk/api-mcp">
    Connect any MCP-capable client to Flare's search
    and platform APIs.
  </Card>

  <Card title="Documentation MCP (beta)" icon="book" href="/sdk/docs-mcp">
    Ask questions about the Flare API and its documentation from any
    MCP-capable client.
  </Card>
</CardGroup>

## Guides

<CardGroup>
  <Card title="Global Search" icon="magnifying-glass" href="/guides/global-search">
    Search in all of Flare's events using the Search API.
  </Card>

  <Card title="List Events Within a Tenant" icon="list" href="/guides/tenant-events">
    Export or search within all events associated within your tenant.
  </Card>

  <Card title="Exporting a Domain's Credentials" icon="passport" href="/guides/credentials-export-domain">
    Export all of Flare's leaked credentials for a given domain.
  </Card>

  <Card title="Cookie Monitoring" icon="cookie" href="/guides/cookie-monitoring">
    Monitor leaked cookies for your domain.
  </Card>
</CardGroup>

## API Reference

<CardGroup>
  <Card title="Endpoint References" icon="code" href="/api-reference">
    View the full API reference.
  </Card>
</CardGroup>


# API MCP (beta)
Source: https://api.docs.flare.io/sdk/api-mcp



<Note>The Flare API MCP server is still in beta and is subject to change.</Note>

Flare provides a
[Model Context Protocol](https://modelcontextprotocol.io/) (MCP) server that
exposes Flare's search and platform APIs to any MCP-capable client. It lets
agents query Flare's threat-intel dataset, inspect a tenant's monitored
events, look up event-type schemas, and read the current user's profile —
without writing any code against the REST API.

For a documentation-only companion server (search across the Flare API docs
themselves), see the
[Documentation MCP <Icon icon="book" />](/sdk/docs-mcp).

## Available Tools

| Tool                           | Description                                                                                                                     |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------- |
| `search_global`                | Global Search — executes a Lucene query against the entire Flare threat-intel dataset.                                          |
| `search_tenant`                | Tenant Search — executes a Lucene query scoped to events matching the caller's monitored identifiers.                           |
| `search_validate_search_query` | Validates that a Lucene query complies with Flare's search rules before running it. Useful when composing or debugging a query. |
| `events_get_event`             | Returns the complete event payload (metadata + data) for a single uid.                                                          |
| `events_get_event_type`        | Returns the documentation and searchable field list for a given event type (e.g. `chat_message`, `forum_post`, `stealer_log`).  |
| `profile_get`                  | Returns the current user's profile, including tenants, permissions, feature flags, and default tenant id.                       |

<Note>
  `search_global` requires the Global Search permission on the target tenant. Each call counts against the tenant's monthly Global Search quota.

  For additional information, please refer to [Global Search Quota](https://docs.flare.io/global-search-quota).
</Note>

### Search Parameters

The `search_global` and `search_tenant` tools accept the following
parameters:

<ParamField type="string">
  Lucene query.
</ParamField>

<ParamField type="string | object">
  Time window to restrict results to. Either a preset (`last_24h`, `last_2d`, `last_7d`,
  `last_1m`, `last_3m`, `last_6m`, `all`) or a `{ begin_at, end_at }` object with ISO-8601 datetimes.
</ParamField>

<ParamField type="array of string">
  List of event types to scope the search. Defaults to all event types.
</ParamField>

<ParamField type="array of string">
  Filter results by event severity. Passing an array returns only events whose
  severity exactly matches one of the listed values. Allowed values: `info`,
  `low`, `medium`, `high`, `critical`.
</ParamField>

<ParamField type="integer">
  Number of results to return. Between `1` and `10`.
</ParamField>

<ParamField type="string">
  Opaque pagination cursor from a previous response.
</ParamField>

#### Tenant Search Parameters

In addition to the shared parameters above, `search_tenant` accepts the
following tenant-scoped filters:

<ParamField type="array of string">
  Filter results to events that carry at least one of the given tenant tags.
</ParamField>

<ParamField type="boolean">
  If `true`, only return events that have been marked as ignored. `false` has no
  effect and behaves the same as omitting it.
</ParamField>

<ParamField type="boolean">
  If `true`, only return events that have been marked as remediated. `false` has
  no effect and behaves the same as omitting it.
</ParamField>

### Prompt Examples

* `What has Flare picked up on our monitored domain scatterholt.com in the last 24 hours?`
* `Search the whole Flare dataset for chat messages mentioning "acme-corp" in the last 7 days.`
* `Validate this query for me: author_name:/some_username_\d+/`
* `What fields can I search on the stealer_log event type?`
* `Which tenants do I currently have access to?`

## MCP Server Configuration

The MCP server is available at the following URL:

* `https://api.flare.io/mcp`

To connect an MCP client to the server, see
[Client Setup](#client-setup).

### Authentication

Every MCP request must include a Flare API key in the `Authorization`
header. Follow the
[Authentication Guide <Icon icon="book" />](/concepts/authentication)
to generate one.

### Targeting a specific tenant

Requests default to your account's default tenant. To scope MCP tool calls
to a specific tenant, set the `X-Flare-Tenant-Id` header on the MCP
connection to the target tenant id. You can find your tenant ids via the `profile_get` MCP tool, or on the [Profile page](https://app.flare.io/#/profile) under the "Tenants" section
(also documented in the
[Authentication Guide <Icon icon="book" />](/concepts/authentication#finding-tenant-ids)).

## Client Setup

<Note>
  The `X-Flare-Tenant-Id` header is optional: omitting it uses your default
  tenant.
</Note>

### Claude Code

The quickest way to add the server to a project's config is through the
[Claude Code](https://docs.claude.com/en/docs/claude-code/overview) CLI:

```bash theme={null}
claude mcp add flare --transport http https://api.flare.io/mcp \
  --scope project \
  --header "Authorization: <api-key>" \
  --header "X-Flare-Tenant-Id: <tenant-id>"
```

The Flare API key is obtained from the
[Authentication Guide <Icon icon="book" />](/concepts/authentication).

Alternatively, you may create an
`.mcp.json` file at the root of your project and restart Claude Code once the file is in place:

```json .mcp.json theme={null}
{
  "mcpServers": {
    "flare": {
      "type": "http",
      "url": "https://api.flare.io/mcp",
      "headers": {
        "Authorization": "<api-key>",
        "X-Flare-Tenant-Id": "<tenant-id>"
      }
    }
  }
}
```

The Flare tools will appear
under the `flare` server in the `/mcp` command output, and Claude will call
them automatically when your prompts match their descriptions.

<Note>
  Store the API key outside version control. Claude Code also supports reading
  headers from environment variables — see the [Claude Code MCP
  docs](https://code.claude.com/docs/en/mcp#environment-variable-expansion-in-mcp-json)
  for details.
</Note>

### Claude Desktop

Claude Desktop's configuration file only supports local (stdio) servers, so the connection goes through the `mcp-remote` bridge via `npx` (requires Node.js).
The configuration file is located at:

* **macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`
* **Windows**: `%APPDATA%\Claude\claude_desktop_config.json`

The file is also reachable through **Settings → Developer → Edit Config**.

```json claude_desktop_config.json theme={null}
{
  "mcpServers": {
    "flare": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://api.flare.io/mcp",
        "--header",
        "Authorization:<api-key>",
        "--header",
        "X-Flare-Tenant-Id:<tenant-id>"
      ]
    }
  }
}
```

Once the change is in place, you should fully quit and relaunch Claude Desktop.

### Cursor

The server can be added to the `.cursor/mcp.json` in your project (or
`~/.cursor/mcp.json` to make it available in all projects).

```json .cursor/mcp.json theme={null}
{
  "mcpServers": {
    "flare": {
      "url": "https://api.flare.io/mcp",
      "headers": {
        "Authorization": "<api-key>",
        "X-Flare-Tenant-Id": "<tenant-id>"
      }
    }
  }
}
```

Cursor picks up the change automatically: check **Settings → MCP** to confirm the MCP server is connected.
See [Cursor's MCP docs](https://cursor.com/docs/mcp) for details.

## Quotas & Rate Limits

* Calls to `search_global` (Global Search) consume the tenant's monthly Global
  Search quota. See
  [Rate Limits and Quotas <Icon icon="book" />](/concepts/rate-limits-and-quotas).
* Standard API rate limits apply to all tools.


# CLI (beta)
Source: https://api.docs.flare.io/sdk/cli



<Note>
  The CLI utility is still in beta and is subject to change.
</Note>

Flare publishes a [CLI interface](https://github.com/flared/flareio-cli) for interacting with the Flare API.
It automates basic tasks such exporting events to output files.

## Changelog & Releases

You may find the [changelog and all available versions](https://github.com/Flared/flareio-cli/releases) on the Github releases page.

## Installing

`flareio-cli` is [available on PyPI](https://pypi.org/project/flareio-cli/).

Invoke it directly using [uv](https://docs.astral.sh/uv/) (recommended):

```bash theme={null}
# Running the most recent version.
uvx flareio-cli --help

# Running a specific version. Recommended to ensure stability.
# Example: uvx flareio-cli@0.8.0 --help
uvx flareio-cli@version --help
```

Or install it:

```bash theme={null}
# Using uv
uv tool install flareio-cli

# Using pip
pip install flareio-cli
```

## Configuration

Most commands will require exporting environment variables `FLARE_API_KEY` and `FLARE_TENANT_ID`:

```bash theme={null}
export FLARE_API_KEY="<api-key>"
export FLARE_TENANT_ID="<tenant-id>"
```

## Features

### Discovering Commands

You may discover all commands using `help`:

```bash theme={null}
uvx flareio-cli help
```

### Exporting Tenant Events

You may export a tenant's events to a CSV using the `export-tenant-feed` command:

* The output will be written to `output.csv`.

```bash theme={null}
uvx flareio-cli export-tenant-feed \
    --output-file=output.csv \
    --from-date=2025-01-01
```

### Exporting Tenant Credentials

You may export a tenant's credentials to a CSV using the `export-tenant-credentials` command:

* The output will be written to `output.csv`.

```bash theme={null}
uvx flareio-cli export-tenant-credentials \
    --output-file=output.csv
```

### Exporting Identifier Credentials

You may export an identifier's credentials to a CSV using the `export-identifier-credentials` command:

* The output will be written to `output.csv`.

```bash theme={null}
uvx flareio-cli export-identifier-credentials \
    --identifier-id=123 \
    --output-file=output.csv
```

## Feedback

The `flareio-cli` project is still considered beta.
Feedback may be directed to the [Github project's issues](https://github.com/Flared/flareio-cli/issues).


# Documentation MCP (beta)
Source: https://api.docs.flare.io/sdk/docs-mcp



<Note>
  The MCP server is still in beta and is subject to change.
</Note>

Flare provides a [Model Context Protocol](https://modelcontextprotocol.io/) (MCP) server that can be used to ask questions about the Flare API.
This is useful for developers building Flare API automations with AI-powered integrated development environments (IDE).

Available tools:

* `Search`: Search across the Flare documentation to fetch relevant context for a given query.

Things the MCP server **cannot** do:

* Perform queries or actions using the Flare API.

## MCP Server Configuration

The MCP server requires no authentication, it is available at the following URL:

* `https://api.docs.flare.io/mcp`

The Flare API documentation is also available via the [llms.txt format](https://llmstxt.org/) at the following URL:

* `https://api.docs.flare.io/llms.txt`

### IDEs / Tools

Configuration Guides:

* Claude Desktop: [https://support.anthropic.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp](https://support.anthropic.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp)

* Cursor: [https://docs.cursor.com/en/context/mcp#using-mcp-json](https://docs.cursor.com/en/context/mcp#using-mcp-json)


# Go SDK
Source: https://api.docs.flare.io/sdk/go



Flare has a Go SDK available on Github. It is a light wrapper around
[net/http.Client](https://pkg.go.dev/net/http#Client)
that automatically manages API authentication.

## Links

* [Github Repository](https://github.com/Flared/go-flareio)
* [Go Reference](https://pkg.go.dev/github.com/Flared/go-flareio)

## Installing

```bash theme={null}
go get github.com/Flared/go-flareio
```

## Basic Usage

The `flareio` package provides the `NewApiClient` method that can be used
to create a Flare API client.

The client exposes `Get` and `Post` methods that have a similar API to `net/http.Client`
with the exception that they accept paths as parameters instead of full URLs.

```go theme={null}
package main

import (
	"fmt"
	"io"
	"os"

	"github.com/Flared/go-flareio"
)

func main() {
	client := flareio.NewApiClient(
		os.Getenv("FLARE_API_KEY"),
	)
	resp, err := client.Get(
		"/tokens/test", nil,
	)
	if err != nil {
		fmt.Printf("failed to test token: %s\n", err)
		os.Exit(1)
	}
	defer resp.Body.Close()
	if _, err := io.Copy(os.Stdout, resp.Body); err != nil {
		fmt.Printf("failed to print response: %s\n", err)
		os.Exit(1)
	}
}
```

## Specifying a Tenant Id

The Api Client can be configured to use a specific tenant id using the `WithTenantId` option.

```go theme={null}
client := flareio.NewApiClient(
    os.Getenv("FLARE_API_KEY"),
    flareio.WithTenantId(42),
)
// ...
```

## Paging Util

The `ApiClient` has `IterGet` and `IterPostJson` methods that return iterators implementing the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

<Note>
  The paging util leverages Go iterators which require Go version >= 1.23.
</Note>

```go Paging Util Example theme={null}
package main

import (
	"fmt"
	"os"
	"time"

	"github.com/Flared/go-flareio"
)

func main() {
	client := flareio.NewApiClient(
		os.Getenv("FLARE_API_KEY"),
	)

	fetchedPages := 0

	for result, err := range client.IterGet(
		"/astp/v2/sources", nil,
	) {
		// Rate Limiting
		time.Sleep(time.Second * 1)

		if err != nil {
			fmt.Printf("unexpected error: %s\n", err)
			os.Exit(1)
		}

		// Handle the response...
		result.Response.Body.Close()

		// Print the status
		fetchedPages = fetchedPages + 1
		fmt.Printf(
			"Fetched %d page(s) of ASTP Sources, next=%s\n",
			fetchedPages,
			result.Next,
		)
	}

}
```


# Python SDK
Source: https://api.docs.flare.io/sdk/python



Flare has a Python SDK available on PyPI. It is a light wrapper around
[requests](https://pypi.org/project/requests/)
that automatically manages API authentication.

## Links

* [Github Repository](https://github.com/Flared/python-flareio)
* [PyPI Page](https://pypi.org/project/flareio/)

## Installing

```bash theme={null}
pip install flareio
```

## Basic Usage

The `flareio` package provides the `FlareApiClient` class, which automatically manages
authentication and exposes `get`, `post`, `put`, and `delete` methods.

```python Basic Usage Example theme={null}
import os

from flareio import FlareApiClient


client = FlareApiClient(
    api_key=os.environ["FLARE_API_KEY"],
    tenant_id=None,  # Use my default tenant.
)

resp = client.get("/tokens/test")

print(resp.json())
```

## Creating a client from environment variables

The Flare SDK automatically recognizes the `FLARE_API_KEY` and `FLARE_TENANT_ID` environment variables.

For example, you may expose the following environment variables, and then create an API client from them:

```shell theme={null}
export FLARE_API_KEY="<api-key>"
export FLARE_TENANT_ID="<tenant-id>"
```

```python theme={null}
from flareio import FlareApiClient


client = FlareApiClient.from_env()

resp = client.get("/tokens/test")

print(resp.json())
```

## Paging Util - Generic

The `FlareApiClient` has a `scroll` method that can be used with endpoints that support the
[Flare standard paging pattern <Icon icon="book" />](/concepts/paging).

```python Paging Util - Generic Example theme={null}
import os

from flareio import FlareApiClient
from flareio.ratelimit import Limiter


api_key = os.environ.get("FLARE_API_KEY")
if not api_key:
    raise Exception("Please provide an API key")

api_client = FlareApiClient(api_key=api_key)

limiter = Limiter.from_seconds(0.25)

last_from: str | None = None
fetched_pages: int = 0

for resp in api_client.scroll(
    method="GET",
    url="/astp/v2/sources",
    params={
        "from": last_from,
    },
):
    # Rate limiting (default).
    limiter.tick()

    # Get results from the response
    resp_data = resp.json()
    items = resp_data.get("items")

    fetched_pages += 1
    print(f"Fetched page {fetched_pages} ({last_from=}) with {len(items)} items...")

    # Save the last "next" value.
    last_from = resp_data.get("next") or last_from

print("The last value for 'next' was", last_from)
```

## Paging Util - Event Feeds

The `FlareApiClient` has a `scroll_events` method that can be used with event feeds endpoints.
The advantage of this method over `scroll` is that it also automates the fetching of individual events.

```python Paging Util - Event Feeds Example theme={null}
import datetime

from flareio import FlareApiClient


api_client = FlareApiClient.from_env()
initial_cursor = None

from_timestamp: str = (
    datetime.datetime.now(tz=datetime.timezone.utc) - datetime.timedelta(hours=1)
).isoformat()

for result in api_client.scroll_events(
    method="POST",
    pages_url="/firework/v4/events/global/_search",
    events_url="/firework/v2/activities/",
    json={
        "size": 10,
        "order": "asc",
        "from": initial_cursor,
        "filters": {
            "type": ["chat_message"],
            "estimated_created_at": {"gte": from_timestamp},
        },
        "query": {
            "type": "query_string",
            "query_string": "hello",
        },
    },
):
    print(f"Full event data: {result.event}")
    print(f"The next execution could resume using from={result.next}")
```

## Custom Session

The `FlareApiClient` can be initialized with a custom `requests.Session`. This allows, for example,
to inject custom retry configuration.

```python Custom Session theme={null}
import requests

from flareio import FlareApiClient
from requests.adapters import HTTPAdapter
from urllib3.util import Retry


session = requests.Session()
retries = Retry(
    total=5,
    backoff_factor=2,
    status_forcelist=[429, 502, 503, 504],
    allowed_methods={"GET", "POST"},
    backoff_max=15,
)
session.mount(
    "https://",
    HTTPAdapter(
        max_retries=retries,
    ),
)

api_client = FlareApiClient(
    api_key="fw_...",
    session=session,
)
```