| Field | Description |
|---|---|
| requestUuid | Unique identifier for the report request. |
| domain | Domain that was analyzed. |
| periodFrom | Start of the analyzed period. |
| periodTo | End of the analyzed period. |
| status | Report status. REPORT_READY indicates that the report is available. |
| report | Domain exposure report. |
The report.summary object provides the main exposure metrics.
{
"total_events": 28,
"infostealer_events": 8,
"data_breach_events": 20,
"employee_events": 0,
"client_events": 28,
"first_seen": "2025-08-27",
"last_seen": "2026-07-22"
}| Field | Description |
|---|---|
| total_events | Total credential exposure events associated with the domain. |
| infostealer_events | Events originating from infostealer data. |
| data_breach_events | Events originating from breach or combo-list data. |
| employee_events | Exposure events associated with employees of the domain. |
| client_events | Exposure events involving users accessing services on the domain. |
| first_seen | Date of the earliest exposure in the reporting period. |
| last_seen | Date of the most recent exposure in the reporting period. |
exposure_subject_breakdown separates employee exposure from client exposure.
{
"employee": {
"total_events": 0,
"infostealer_events": 0,
"data_breach_events": 0,
"first_seen": null,
"last_seen": null
},
"client": {
"total_events": 28,
"infostealer_events": 8,
"data_breach_events": 20,
"first_seen": "2025-08-27",
"last_seen": "2026-07-22"
}
}This lets you distinguish between compromise of the organization's own accounts and compromise of customers or other users interacting with the organization's services.
monthly_timeline shows how exposure changed during the reporting period.
{
"month": "2026-06",
"total_events": 11,
"infostealer_events": 8,
"data_breach_events": 3,
"employee": {
"total_events": 0,
"infostealer_events": 0,
"data_breach_events": 0
},
"client": {
"total_events": 11,
"infostealer_events": 8,
"data_breach_events": 3
}
}Each month includes totals separated by source and exposure subject.
event_family_breakdown compares infostealer exposure with data-breach exposure.
{
"infostealer": {
"events": 8,
"share_of_total_percent": 28.6,
"employee_events": 0,
"client_events": 8,
"first_seen": "2026-06-10",
"last_seen": "2026-06-18"
},
"data_breach": {
"events": 20,
"share_of_total_percent": 71.4,
"employee_events": 0,
"client_events": 20,
"first_seen": "2025-08-27",
"last_seen": "2026-07-22"
}
}infostealer_summary summarizes credentials associated with malware-infected devices.
{
"total_events": 8,
"employee_events": 0,
"client_events": 8,
"malware_families_observed": 0,
"events_with_os_context": 0,
"first_seen": "2026-06-10",
"last_seen": "2026-06-18"
}Additional infostealer-related fields include:
malware_family_breakdown — exposure grouped by detected malware family.
os_breakdown — operating systems observed on infected devices.
antivirus_breakdown — antivirus products observed in available device context.
service_classification_breakdown — services associated with exposed credentials.
Fields can return empty arrays when the underlying events do not contain that context.
data_breach_summary summarizes exposure originating from breach datasets.
{
"total_events": 20,
"employee_events": 0,
"client_events": 20,
"known_breach_sources_count": 0,
"events_from_known_breach_sources": 0,
"events_from_combolist_sources": 20,
"first_seen": "2025-08-27",
"last_seen": "2026-07-22"
}The API also provides a data_breach_source_type_breakdown:
{
"combolists": {
"events": 20,
"employee_events": 0,
"client_events": 20,
"share_of_data_breach_events_percent": 100
},
"database_dump": {
"events": 0,
"employee_events": 0,
"client_events": 0,
"share_of_data_breach_events_percent": 0
}
}top_login_urls shows the login URLs most frequently associated with compromised credentials.
[
{
"url": "http://myaccount.autobarn.net/login.php",
"events": 10,
"employee_events": 0,
"client_events": 10
},
{
"url": "myaccount.autobarn.net/login.php",
"events": 4,
"employee_events": 0,
"client_events": 4
}
]This is useful for identifying which applications, portals, and authentication endpoints are most commonly associated with exposed credentials.
country_breakdown provides geographic information when country context is available in the underlying exposure data.
An empty array means no geographic context was available for the events included in the report.