> ## Documentation Index > Fetch the complete documentation index at: https://docs.findly.icu/llms.txt > Use this file to discover all available pages before exploring further. # Breach Search > Find one person's records across Find.ly's own breach index. Send a free-text `query`, an advanced `fields` object (ANDed), or both. Draws from a separate daily bucket (Starter 100, Professional 800, Enterprise 5000), not the request quota. ## OpenAPI ````yaml /openapi.json post /api/v1/search/breach-search openapi: 3.1.0 info: title: Find.ly API version: 1.0.0 description: >- Search leak and OSINT data from your own code with the same modules, quota and limits as the Find.ly dashboard. API access comes with the Professional and Enterprise plans. Find.ly serves its own modules. Most are powered by our search provider, Intelligence X — `intelligence-search`, `phonebook`, `identity-portal`, `system-id`, `storage-id` and the Stealer Export archive. `breach-search` is ours: it runs on a breach index Find.ly ingests and documents itself, on its own separate daily quota. Every search is `POST /api/v1/search/{module}`. Each module has its own reference page below because each takes a different body. servers: - url: https://findly.icu description: Production security: - bearerAuth: [] - apiKeyHeader: [] tags: - name: Account description: 'Plan and quota. Free: never billed.' - name: Search description: One request per served search. - name: Export description: Bulk downloads that return a file instead of JSON. paths: /api/v1/search/breach-search: post: tags: - Search summary: Breach Search description: >- Find one person's records across Find.ly's own breach index. Send a free-text `query`, an advanced `fields` object (ANDed), or both. Draws from a separate daily bucket (Starter 100, Professional 800, Enterprise 5000), not the request quota. operationId: search_breach requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/BreachSearchRequest' examples: base: summary: Free query value: query: jane.doe@example.com advanced: summary: Advanced, combined fields value: fields: city: Paris last_name: Dupont first_name: Jean responses: '200': description: >- Search served (billed from the breach bucket), including a successful empty result. headers: Cache-Control: $ref: '#/components/headers/CacheControl' X-Request-Billed: $ref: '#/components/headers/XRequestBilled' X-Quota-Limit: $ref: '#/components/headers/XQuotaLimit' X-Quota-Remaining: $ref: '#/components/headers/XQuotaRemaining' X-Quota-Reset: $ref: '#/components/headers/XQuotaReset' content: application/json: schema: $ref: '#/components/schemas/BreachRecordsResponse' examples: results: value: module: breach-search query: jane.doe@example.com total: 1 total_is_lower_bound: false returned: 1 truncated: false partial: false sources: acme-2023: id: acme-2023 name: Acme 2023 site: acme.example description: null date: '2023-05-01' date_kind: disclosed results: - breach_id: acme-2023 breach_name: Acme 2023 breach_date: '2023-05-01' record: email: jane.doe@example.com full_name: Jane Doe city: Paris masked_fields: [] billed: true usage: plan: Professional plan_expires_at: '2026-10-16T12:00:00.000Z' daily_quota: 800 used: 12 remaining: 788 resets_at: '2026-09-24T00:00:00.000Z' components: schemas: BreachSearchRequest: type: object additionalProperties: false description: >- Free-text `query`, advanced `fields`, or both — at least one is required. `query` searches every identity field at once; `fields` ANDs named fields to narrow to one person. IBAN and SIRET are never a search target. properties: query: type: string minLength: 3 maxLength: 256 description: >- Anything that names a person — email, full name, username, phone. Trimmed; 3–256 characters. examples: - jane.doe@example.com fields: type: object additionalProperties: false description: >- Advanced search: each entry is a separate, required constraint (ANDed). 2–256 characters each, at most 10 fields. An unknown or sensitive key returns 422. properties: full_name: type: string minLength: 2 maxLength: 256 first_name: type: string minLength: 2 maxLength: 256 last_name: type: string minLength: 2 maxLength: 256 username: type: string minLength: 2 maxLength: 256 email: type: string minLength: 2 maxLength: 256 phone: type: string minLength: 2 maxLength: 256 company: type: string minLength: 2 maxLength: 256 city: type: string minLength: 2 maxLength: 256 region: type: string minLength: 2 maxLength: 256 examples: - city: Paris last_name: Dupont first_name: Jean BreachRecordsResponse: type: object required: - module - query - total - returned - truncated - sources - results - billed - usage properties: module: type: string enum: - breach-search query: type: string description: 'The search as run: the free value, or the advanced fields joined.' total: type: integer description: Records found. Capped at 10,000 — see total_is_lower_bound. total_is_lower_bound: type: boolean description: '`true` when the index stopped counting at 10,000.' returned: type: integer truncated: type: boolean description: '`true` when total is greater than returned. There is no next page.' partial: type: boolean description: >- `true` when the index ran out of time; an empty partial result is refunded. sources: type: object additionalProperties: $ref: '#/components/schemas/BreachSource' description: Map of breach_id to the breach it names. results: type: array items: $ref: '#/components/schemas/BreachRecord' billed: type: boolean usage: $ref: '#/components/schemas/Usage' BreachSource: type: object required: - id properties: id: type: string description: Breach identifier (the map key). name: type: - string - 'null' description: Breach name. site: type: - string - 'null' description: Site the breach relates to. description: type: - string - 'null' date: type: - string - 'null' description: Breach date, as the index gives it. date_kind: type: - string - 'null' enum: - disclosed - occurred - null description: What `date` means. BreachRecord: type: object required: - breach_id - record - masked_fields properties: breach_id: type: string description: Key into `sources`. Empty string when the index did not name it. breach_name: type: - string - 'null' breach_date: type: - string - 'null' record: type: object additionalProperties: type: string description: >- Free object of field: value. Columns vary from one breach to the next. Never contains a password. masked_fields: type: array items: type: string description: >- Keys in `record` returned partially (an IBAN as its last four characters). Usage: type: object description: Quota of the account, after the call. required: - plan - plan_expires_at - daily_quota - used - remaining - resets_at properties: plan: type: string enum: - Free - Starter - Professional - Enterprise plan_expires_at: type: - string - 'null' format: date-time description: End of the paid plan. `null` on Free. daily_quota: type: integer description: 'Requests per day: 500 on Professional, 1,500 on Enterprise.' used: type: integer description: Requests used today, dashboard and API combined. remaining: type: integer description: Requests left today. resets_at: type: string format: date-time description: Next reset, 02:00 Europe/Paris. headers: CacheControl: description: Always `no-store`. schema: type: string const: no-store XRequestBilled: description: >- `true` if this call used one request from the daily quota, otherwise `false`. schema: type: string enum: - 'true' - 'false' XQuotaLimit: description: >- Daily quota of the plan. Sent whenever the account quota is known (not on authentication or IP-limit errors). schema: type: string examples: - '500' XQuotaRemaining: description: Requests left today, after this call. schema: type: string examples: - '487' XQuotaReset: description: ISO 8601 time of the next reset (02:00 Europe/Paris). schema: type: string format: date-time securitySchemes: bearerAuth: type: http scheme: bearer description: >- `Authorization: Bearer fly_live_…`. Takes precedence when both headers are sent. apiKeyHeader: type: apiKey in: header name: X-API-Key description: >- `X-API-Key: fly_live_…`. Used only when no `Authorization` header is sent. ````