Filters narrow the records returned for your domain. Add them as query parameters. Values are case-insensitive.
| Filter | Values | Meaning |
|---|---|---|
token_type | e.g. ApiKey, OauthPAT, RefreshToken, AccessKey, SessionToken, PrivateKey, WebhookSigningKey, PublicClientKey | Kind of credential. Repeat the parameter for OR. |
service_type | e.g. googleoauth2, auth0oauth, azurerefreshtoken, vercel, netlify, virustotal | Detector / issuing service that matched the secret. Repeat for OR. |
| Filter | Values | Meaning |
|---|---|---|
verification_status | verified, unverified, unknown | verified = confirmed live against the issuer when checked. unverified = checked and rejected, or not checkable. unknown = not checked. Repeat for OR. |
Start with verification_status=verified - those are the secrets known to work.
Epoch milliseconds, UTC. No default - without these, a query covers all collected data.
| Filter | Meaning |
|---|---|
crawled_from, crawled_to | When Webz.io collected the record. |
breach_from, breach_to | When the data was exfiltrated from the device. |
| Parameter | Values | Default |
|---|---|---|
sort_by | crawled, breached | breached |
order_by | asc, desc | asc |
Results are tie-broken by record uuid. Keep sort_by and order_by fixed while paging - see Pagination.
