Modules and inputs

Every search is a POST with a JSON object body:

POST https://findly.icu/api/v1/search/{module}

`{module}`	What it returns	Body fields	`?format=txt`
`intelligence-search`	Records matching free text	`query`, `max_results`, `media_type`, `sort_order`, `date_from`, `date_to`	No
`phonebook`	Emails, subdomains or URLs for a domain	`type`, `query`	Yes: one selector per line
`identity-portal`	Records for an email, domain or selector	`query`	No
`system-id`	A raw file, by its System ID	`system_id`	Yes: the file
`storage-id`	A raw file, by storage ID and bucket	`storage_id`, `bucket`	Yes: the file

Professional and Enterprise include all five modules. An unknown slug returns 404 unknown_module.

Rules that apply to every body

The body must be a JSON object of 16 KB or less (400 invalid_json, 413 body_too_large). Content-Type: application/json is recommended but not required.
Unknown fields are rejected with 422 invalid_input, so a typo such as systemId is reported instead of ignored.
Values are strings. max_results also accepts a JSON number. null counts as absent.
Leading and trailing spaces are trimmed. Text fields are limited to 200 characters.
Invalid input returns 422 invalid_input with one message per field in error.fields, and is never billed.
GET is not supported: a search value in a URL would end up in logs.

Intelligence Search

Free-text search by email, username, domain or keyword.

string

required

Email, username, domain or text. 200 characters max.

number | string

Whole number from 1 to 1000.

string

Media type filter, passed as is. 200 characters max.

string

relevance, date_asc or date_desc (case-insensitive).

string

Start date, YYYY-MM-DD. Must be a real calendar date.

string

End date, YYYY-MM-DD, on or after date_from.

curl https://findly.icu/api/v1/search/intelligence-search \
  -H "Authorization: Bearer fly_live_XXXX" \
  -H "Content-Type: application/json" \
  -d '{"query": "example.com", "max_results": 200, "date_from": "2024-01-01", "date_to": "2024-12-31"}'

Phonebook

Every known selector for a domain. type decides both what you get back and the shape query must have.

string

required

email, domain or url (case-insensitive).

string

required

Depends on type. Sent lowercased.

`type`	You get	`query` must look like
`email`	Email addresses at the domain	`@example.com`
`domain`	Subdomains	`example.com`
`url`	URLs	`https://example.com` (http or https, no credentials)

The domain must be a real domain name: IP addresses, localhost and non-ASCII names are refused.

curl https://findly.icu/api/v1/search/phonebook \
  -H "Authorization: Bearer fly_live_XXXX" \
  -H "Content-Type: application/json" \
  -d '{"type": "email", "query": "@example.com"}'

Identity Portal

string

required

Email address, domain or other selector. 200 characters max.

curl https://findly.icu/api/v1/search/identity-portal \
  -H "Authorization: Bearer fly_live_XXXX" \
  -H "Content-Type: application/json" \
  -d '{"query": "john.doe@example.com"}'

System ID

Downloads the raw file behind a result.

string

required

UUID (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx), usually results[].system_id from Intelligence Search or Identity Portal. Case-insensitive.

Storage ID

Downloads a raw file by storage ID.

string

required

128 or 129 hexadecimal characters. Spaces and line breaks are removed, so a wrapped copy-paste works (1,000 characters max as sent).

string

required

One of the exact values below.

`bucket`
`leaks.private.general`	`leaks.private`	`leaks.logs`
`leaks.public`	`documents.public`	`web.public`
`pastes`	`darknet`	`dns`
`whois`	`usenet`	`dumpster`

Both file modules are covered in Raw files and text output.

Responses

Every successful JSON response has module, billed and usage.

Records
Selectors
File

Intelligence Search and Identity Portal.

string

The query as searched.

number

Results found.

number

Results in results, 5,000 max.

boolean

true if total is greater than returned.

object[]

Show record

string

Name of the source.

string | null

ISO 8601 date, or null if unreadable.

string | null

Date as received.

string | null

Bucket of the source.

number | null

Size in bytes.

string | null

Media type.

string | null

Lowercase UUID for System ID. null if missing or malformed.

string | null

Matching excerpt, up to 2,000 characters.

boolean

true if line was cut.

Phonebook. Same query, total, returned and truncated, plus type.

string

email, domain or url.

object[]

Show selector

string

The email, domain or URL.

string | null

ISO 8601 date, or null.

string | null

Date as received.

System ID (system_id) and Storage ID (storage_id, bucket).

object | null

null when the file is empty or not found.

Show file

string

Suggested file name.

number

UTF-8 size of text.

number

Lines in text.

boolean

true if text is only the first 8 MB.

number | null

Size of the whole file, null if over 16 MB.

string

File content.

An empty result is a normal 200: total: 0 and results: [] for lists, file: null for files. See Billing and quotas for when it is billed.

Results come from leaked and public data. Treat every string (name, line, selector, file text) as untrusted: escape it before displaying it in HTML and never execute it.

Get started

Guides

API reference

Rules that apply to every body

Intelligence Search

Phonebook

Identity Portal

System ID

Storage ID

Responses

​Rules that apply to every body

​Intelligence Search

​Phonebook

​Identity Portal

​System ID

​Storage ID

​Responses

Rules that apply to every body

Intelligence Search

Phonebook

Identity Portal

System ID

Storage ID

Responses