Track new leak events
Pull the events that arrived since your last check on a schedule and feed them into your own alerting or ticket queue.
Build the request
Pass your last check time as startDate; the filter applies to the event date (eventDate). status=open returns only events nobody has handled yet. sortBy=date-asc sorts oldest first, so events are processed in the order they happened.
curl -G "https://api.darkradar.com/api/public/v1/leak-events" \ -H "x-api-key: $DARKRADAR_API_KEY" \ --data-urlencode "startDate=2026-09-18T00:00:00Z" \ --data-urlencode "status=open" \ --data-urlencode "sortBy=date-asc" \ --data-urlencode "limit=100"
Read the response
The fields you need from each event: eventId (the id for follow-up calls), leakType (the kind of leaked value), type (employee, third party or customer), severity and eventDate. Example response, shortened:
{
"success": true,
"data": {
"events": [
{
"eventId": "64b1f0c2a9e4d21f8c3b9005",
"leakType": "email",
"type": "employee",
"severity": "high",
"stealerFamily": "GENERIC STEALER",
"eventDate": "2026-09-18T14:54:04.834Z",
"status": "open",
"actionTaken": false
}
]
}
}Walk every page
The event list does not return a total count. Increase page by one; when fewer events than limit come back, you are on the last page.
const since = '2026-09-18T00:00:00Z';
for (let page = 1; ; page++) {
const url = new URL('https://api.darkradar.com/api/public/v1/leak-events');
url.search = new URLSearchParams({ startDate: since, status: 'open', sortBy: 'date-asc', limit: '100', page: String(page) });
const res = await fetch(url, { headers: { 'x-api-key': process.env.DARKRADAR_API_KEY } });
const { data } = await res.json();
for (const event of data.events) await handle(event);
if (data.events.length < 100) break;
}On the next run, use the time this run started as
startDate. De-duplicate on eventId so an event on the boundary is not handled twice.