List leak events

Lists leak events page by page, with filtering and sorting. An event groups leaks that share a trait such as domain, credential or source.

GET/v1/leak-events

GETList leak events

curl -X GET "https://api.darkradar.com/api/public/v1/leak-events" \
  -H "x-api-key: $DARKRADAR_API_KEY"

Response

Success · From a real response, values anonymised

{
  "success": true,
  "message": "OK",
  "data": {
    "events": [
      {
        "_id": "64b1f0c2a9e4d21f8c3b9005",
        "firm": "64b1f0c2a9e4d21f8c3b9004",
        "protectionResourceGroupId": null,
        "eventId": "64b1f0c2a9e4d21f8c3b9005",
        "leakType": "email",
        "type": "employee",
        "severity": "high",
        "mainValue": null,
        "stealerFamily": "GENERIC STEALER",
        "stealerFamilies": [],
        "eventDate": "2026-09-18T14:54:04.834Z",
        "status": "open",
        "actionTaken": false,
        "actions": [],
        "metadata": {},
        "leakMetadata": {
          "username": null,
          "password": null,
          "domain": null,
          "usernameDomain": null
        },
        "relationCount": 0
      }
    ]
  }
}

Access

Scopeleak-events:read

Plan entitlementintel_customer

Query parameters

Fields	Values
`page` · integer · optional	Page number for pagination · Example: `1`
`limit` · integer · optional	Number of results per page · Example: `50`
`leakType` · string · optional	Filter by leak type (credential, cookie, token, etc.) · Values: domain, email, username, ip, hwid, application · Example: `email`
`type` · string · optional	Filter by event classification/category · `customer` requires 360; without it the list is empty. · Values: employee, third-party, customer · Example: `employee`
`search` · string · optional	Text search across event fields · Example: `admin`
`domain` · string · optional	Filter by domain name · Example: `example.com`
`subdomain` · string · optional	Filter by subdomain · Example: `app.example.com`
`status` · string · optional	Filter by event status · Values: open, ack, solved, closed, re-open, blocked · Example: `open`
`sortBy` · string · optional	Sort field and order · By event date: `date-desc` newest first (default), `date-asc` oldest first. An unrecognised value does not fail; it falls back to the default. · Values: date-desc, date-asc · Example: `date-desc`
`actionTaken` · boolean · optional	Filter by whether action has been taken · Example: `false`
`startDate` · string · optional	Filter events created after this date (ISO 8601 format) · Applies to the event date (`eventDate`). · Example: `2026-09-01T00:00:00Z`
`endDate` · string · optional	Filter events created before this date (ISO 8601 format) · Applies to the event date (`eventDate`). · Example: `2026-09-30T23:59:59Z`
`groupId` · string · optional	Filter by group identifier · Example: `507f1f77bcf86cd799439011`
`groupBy` · string · optional	Group events by field · Example: `domain`
`cursor` · string · optional	Opaque next-page cursor; date sorting only

Responses

200Success

400Invalid request (malformed id, missing or invalid field)

401Key missing, invalid, expired or revoked

403Insufficient scope, no API access in plan, or product not enabled

404Record not found or not owned by this key’s firm

408The request exceeded its maximum response time

429Rate limit exceeded; retry after a minute

Leak eventResponse model

Response limits

Page sizelimit · default 50 · max 100

Rate limit500 requests per 15 min · per IP