Stealer Export (.zip archive)
curl --request POST \
--url https://findly.icu/api/v1/stealer-export \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"system_id": "3f0c6e1a-9b2d-4c7e-8f41-2a6d5b9e0c13"
}
'import requests
url = "https://findly.icu/api/v1/stealer-export"
payload = { "system_id": "3f0c6e1a-9b2d-4c7e-8f41-2a6d5b9e0c13" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({system_id: '3f0c6e1a-9b2d-4c7e-8f41-2a6d5b9e0c13'})
};
fetch('https://findly.icu/api/v1/stealer-export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));"<string>"{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}API reference
Stealer Export (.zip archive)
Downloads every stealer log attached to one System ID, packed into a single .zip archive.
Unlike every other endpoint, a success returns the archive itself (application/zip), not JSON. Errors still use the usual JSON envelope, so check the status code before reading the body.
Professional and Enterprise only. One request per export, whatever the archive holds. The request is given back when the service fails, times out, finds nothing, or returns an archive over 32 MB.
Archives are streamed straight through: Find.ly never stores their contents.
POST
/
api
/
v1
/
stealer-export
Stealer Export (.zip archive)
curl --request POST \
--url https://findly.icu/api/v1/stealer-export \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"system_id": "3f0c6e1a-9b2d-4c7e-8f41-2a6d5b9e0c13"
}
'import requests
url = "https://findly.icu/api/v1/stealer-export"
payload = { "system_id": "3f0c6e1a-9b2d-4c7e-8f41-2a6d5b9e0c13" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({system_id: '3f0c6e1a-9b2d-4c7e-8f41-2a6d5b9e0c13'})
};
fetch('https://findly.icu/api/v1/stealer-export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));"<string>"{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "api_key_in_url",
"message": "<string>",
"fields": {},
"plan": "<string>",
"required_plan": "<string>",
"reason": "concurrent",
"upstream_status": 123
},
"billed": true,
"usage": {
"plan": "Free",
"plan_expires_at": "2023-11-07T05:31:56Z",
"daily_quota": 123,
"used": 123,
"remaining": 123,
"resets_at": "2023-11-07T05:31:56Z"
}
}Authorizations
bearerAuthapiKeyHeader
Authorization: Bearer fly_live_…. Takes precedence when both headers are sent.
Body
application/json
System ID of the record, as shown under Expert Information on intelx.io. A UUID: 8-4-4-4-12 hexadecimal characters.
Example:
"3f0c6e1a-9b2d-4c7e-8f41-2a6d5b9e0c13"
Response
The archive (billed). Binary .zip; Content-Disposition carries the suggested file name.
The response is of type file.