> ## Documentation Index
> Fetch the complete documentation index at: https://docs.findly.icu/llms.txt
> Use this file to discover all available pages before exploring further.

# Stealer Export (.zip archive)

> Downloads **every stealer log attached to one System ID**, packed into a single `.zip` archive.

Unlike every other endpoint, a success returns the **archive itself** (`application/zip`), not JSON. Errors still use the usual JSON envelope, so check the status code before reading the body.

**Professional and Enterprise only.** One request per export, whatever the archive holds. The request is given back when the service fails, times out, finds nothing, or returns an archive over 32 MB.

Archives are streamed straight through: Find.ly never stores their contents.



## OpenAPI

````yaml /openapi.json post /api/v1/stealer-export
openapi: 3.1.0
info:
  title: Find.ly API
  version: 1.0.0
  description: >-
    Search leak and OSINT data from your own code with the same five modules,
    quota and limits as the Find.ly dashboard. API access comes with the
    Professional and Enterprise plans.


    Every search is `POST /api/v1/search/{module}`, where `{module}` is one of
    `intelligence-search`, `phonebook`, `identity-portal`, `system-id`,
    `storage-id`. Each module has its own reference page below because each
    takes a different body.
servers:
  - url: https://findly.icu
    description: Production
security:
  - bearerAuth: []
  - apiKeyHeader: []
tags:
  - name: Account
    description: 'Plan and quota. Free: never billed.'
  - name: Search
    description: One request per served search.
  - name: Export
    description: Bulk downloads that return a file instead of JSON.
paths:
  /api/v1/stealer-export:
    post:
      tags:
        - Export
      summary: Stealer Export (.zip archive)
      description: >-
        Downloads **every stealer log attached to one System ID**, packed into a
        single `.zip` archive.


        Unlike every other endpoint, a success returns the **archive itself**
        (`application/zip`), not JSON. Errors still use the usual JSON envelope,
        so check the status code before reading the body.


        **Professional and Enterprise only.** One request per export, whatever
        the archive holds. The request is given back when the service fails,
        times out, finds nothing, or returns an archive over 32 MB.


        Archives are streamed straight through: Find.ly never stores their
        contents.
      operationId: stealer_export
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StealerExportRequest'
            examples:
              request:
                value:
                  system_id: 3f0c6e1a-9b2d-4c7e-8f41-2a6d5b9e0c13
      responses:
        '200':
          description: >-
            The archive (billed). Binary `.zip`; `Content-Disposition` carries
            the suggested file name.
          headers:
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
            X-Request-Billed:
              $ref: '#/components/headers/XRequestBilled'
            X-Quota-Limit:
              $ref: '#/components/headers/XQuotaLimit'
            X-Quota-Remaining:
              $ref: '#/components/headers/XQuotaRemaining'
            X-Quota-Reset:
              $ref: '#/components/headers/XQuotaReset'
            Content-Disposition:
              $ref: '#/components/headers/ContentDisposition'
          content:
            application/zip:
              schema:
                type: string
                format: binary
        '400':
          description: Bad request. `api_key_in_url`, `invalid_json`.
          headers:
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
            X-Request-Billed:
              $ref: '#/components/headers/XRequestBilled'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: '`missing_api_key` or `invalid_api_key`.'
          headers:
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
            X-Request-Billed:
              $ref: '#/components/headers/XRequestBilled'
            WWW-Authenticate:
              $ref: '#/components/headers/WWWAuthenticate'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: >-
            `plan_required` (no API access) or `module_locked` (the plan does
            not include Stealer Export). Not billed.
          headers:
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
            X-Request-Billed:
              $ref: '#/components/headers/XRequestBilled'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: >-
            `not_found` — no stealer logs are attached to this `system_id`.
            **The request is given back.**
          headers:
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
            X-Request-Billed:
              $ref: '#/components/headers/XRequestBilled'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '413':
          description: '`body_too_large` — the body is over 16 KB.'
          headers:
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
            X-Request-Billed:
              $ref: '#/components/headers/XRequestBilled'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          description: >-
            `invalid_input` — `system_id` is missing or is not a UUID. See
            `error.fields`. Never billed.
          headers:
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
            X-Request-Billed:
              $ref: '#/components/headers/XRequestBilled'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: >-
            `quota_exceeded` (daily quota), `rate_limited` (20 requests in the
            last minute, or an export already running on this account), or
            `too_many_requests` (60 API calls in a minute from this IP). Never
            billed.
          headers:
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
            X-Request-Billed:
              $ref: '#/components/headers/XRequestBilled'
            Retry-After:
              $ref: '#/components/headers/RetryAfter'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: '`internal_error`. No request was used.'
          headers:
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
            X-Request-Billed:
              $ref: '#/components/headers/XRequestBilled'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '502':
          description: >-
            `upstream_error` — the export service failed, timed out, or returned
            an archive over 32 MB. **The request is given back.**
          headers:
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
            X-Request-Billed:
              $ref: '#/components/headers/XRequestBilled'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    StealerExportRequest:
      type: object
      additionalProperties: false
      required:
        - system_id
      properties:
        system_id:
          type: string
          format: uuid
          description: >-
            System ID of the record, as shown under Expert Information on
            intelx.io. A UUID: 8-4-4-4-12 hexadecimal characters.
          example: 3f0c6e1a-9b2d-4c7e-8f41-2a6d5b9e0c13
    ErrorResponse:
      type: object
      required:
        - error
        - billed
      properties:
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              $ref: '#/components/schemas/ErrorCode'
            message:
              type: string
              description: >-
                Human-readable. It can change: branch on `code`, not on
                `message`.
            fields:
              type: object
              additionalProperties:
                type: string
              description: '`invalid_input` only. One message per invalid or unknown field.'
            plan:
              type: string
              description: '`plan_required` only. The current plan.'
            required_plan:
              type: string
              description: '`module_locked` only. Cheapest plan that includes the module.'
            reason:
              type: string
              enum:
                - concurrent
                - per-minute
              description: '`rate_limited` only. Which account limit was hit.'
            upstream_status:
              type:
                - integer
                - 'null'
              description: >-
                `upstream_error` only. HTTP status returned by the search
                service when it sent one (400 or above), otherwise `null`.
        billed:
          type: boolean
          description: Errors are never billed.
        usage:
          $ref: '#/components/schemas/Usage'
    ErrorCode:
      type: string
      description: >-
        Stable, machine-readable error code:


        - `api_key_in_url`: 400 — an API key was sent in the query string
        (`key`, `api_key`, `apikey`, `token` or `access_token`).

        - `invalid_json`: 400 — the body is missing, is not valid UTF-8 JSON, or
        is not a JSON object.

        - `unsupported_format`: 400 — `format` is not `json`, or `txt` was asked
        for a module that has no text output.

        - `missing_api_key`: 401 — neither `Authorization` nor `X-API-Key` was
        sent.

        - `invalid_api_key`: 401 — the key is malformed, unknown, regenerated,
        or belongs to a deleted account.

        - `account_suspended`: 403 — the account that owns the key is suspended.

        - `plan_required`: 403 — the account plan does not include API access
        (Professional and Enterprise only).

        - `module_locked`: 403 — the account plan does not include this module
        (Stealer Export needs Professional or Enterprise).

        - `unknown_module`: 404 — `{module}` is not one of the five search
        module slugs.

        - `not_a_search_module`: 400 — `stealer-export` was called as a search
        module. Use `POST /api/v1/stealer-export`.

        - `not_found`: 404 — no API endpoint at this path, or a Stealer Export
        whose System ID has no logs attached (the request is given back).

        - `body_too_large`: 413 — the request body is over 16 KB.

        - `invalid_input`: 422 — a field is unknown, has the wrong type, or has
        an invalid value. See `error.fields`.

        - `too_many_requests`: 429 — more than 60 API calls in one minute from
        the same IP address.

        - `quota_exceeded`: 429 — the account has used all of today's requests.

        - `rate_limited`: 429 — two searches already running, an export already
        running, or 20 requests in the last minute, on this account.

        - `internal_error`: 500 — unexpected server error. No request was used.

        - `upstream_error`: 502 — the search or export service failed, timed
        out, or sent an unreadable or oversized response (an archive over 32
        MB). The request is refunded.
      enum:
        - api_key_in_url
        - invalid_json
        - unsupported_format
        - missing_api_key
        - invalid_api_key
        - account_suspended
        - plan_required
        - module_locked
        - not_a_search_module
        - unknown_module
        - not_found
        - body_too_large
        - invalid_input
        - too_many_requests
        - quota_exceeded
        - rate_limited
        - internal_error
        - upstream_error
    Usage:
      type: object
      description: Quota of the account, after the call.
      required:
        - plan
        - plan_expires_at
        - daily_quota
        - used
        - remaining
        - resets_at
      properties:
        plan:
          type: string
          enum:
            - Free
            - Starter
            - Professional
            - Enterprise
        plan_expires_at:
          type:
            - string
            - 'null'
          format: date-time
          description: End of the paid plan. `null` on Free.
        daily_quota:
          type: integer
          description: 'Requests per day: 500 on Professional, 1,500 on Enterprise.'
        used:
          type: integer
          description: Requests used today, dashboard and API combined.
        remaining:
          type: integer
          description: Requests left today.
        resets_at:
          type: string
          format: date-time
          description: Next reset, 02:00 Europe/Paris.
  headers:
    CacheControl:
      description: Always `no-store`.
      schema:
        type: string
        const: no-store
    XRequestBilled:
      description: >-
        `true` if this call used one request from the daily quota, otherwise
        `false`.
      schema:
        type: string
        enum:
          - 'true'
          - 'false'
    XQuotaLimit:
      description: >-
        Daily quota of the plan. Sent whenever the account quota is known (not
        on authentication or IP-limit errors).
      schema:
        type: string
        examples:
          - '500'
    XQuotaRemaining:
      description: Requests left today, after this call.
      schema:
        type: string
        examples:
          - '487'
    XQuotaReset:
      description: ISO 8601 time of the next reset (02:00 Europe/Paris).
      schema:
        type: string
        format: date-time
    ContentDisposition:
      description: >-
        `attachment; filename="…"`. The file name only contains `A-Z a-z 0-9 . _
        -`.
      schema:
        type: string
    WWWAuthenticate:
      description: >-
        `Bearer realm="Find.ly API"`, with `error="invalid_token"` for
        `invalid_api_key`.
      schema:
        type: string
    RetryAfter:
      description: Seconds to wait before retrying (at least 1).
      schema:
        type: string
        examples:
          - '3'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        `Authorization: Bearer fly_live_…`. Takes precedence when both headers
        are sent.
    apiKeyHeader:
      type: apiKey
      in: header
      name: X-API-Key
      description: >-
        `X-API-Key: fly_live_…`. Used only when no `Authorization` header is
        sent.

````