Read new findings
Pull findings nobody has reviewed yet, across every asset on your watchlist, for a date range.
Build the request
status=new returns only unreviewed findings; from and to set the date range. Walk the pages with page and pageSize; total in the response is the total number of findings.
curl -G "https://api.darkradar.com/api/public/v1/watch/findings" \ -H "x-api-key: $DARKRADAR_API_KEY" \ --data-urlencode "status=new" \ --data-urlencode "from=2026-09-01" \ --data-urlencode "pageSize=50"
Read the response
exposedDataTypes lists the kinds of leaked data and details summarises the infected machine. counts gives the number of findings in each status — independent of the filter. Example response:
{
"success": true,
"data": {
"items": [
{
"id": "64b1f0c2a9e4d21f8c3b9a30",
"status": "new",
"severity": "high",
"source": "DarkRadar",
"exposedDataTypes": [
"password",
"email"
],
"assetId": "64b1f0c2a9e4d21f8c3b9a20",
"assetType": "email",
"assetValue": "[email protected]",
"leakedSecretMasked": "Ya******23",
"contentLocked": false,
"firstSeenAt": "2026-09-10T00:00:00.000Z",
"detectedAt": "2026-09-12T06:00:00.000Z",
"details": {
"computerName": "DESKTOP-***",
"stealerFamily": "Lumma",
"operatingSystem": "Windows 11",
"country": "TR"
}
}
],
"total": 1,
"page": 1,
"pageSize": 50,
"counts": {
"new": 1,
"reviewing": 0,
"closed": 0,
"all": 1
}
}
}