# Post Data Fields

Each element of the `cyberDocs` array is one post from the deep or dark web, with its source site, thread, and enrichments nested as objects.

A complete cyber post as the API returns it (all values anonymized):

```json
{
  "url": "https://t.me/combo_market_chat#e460f13fe13f165326d8ab599725515a",
  "uuid": "cfe5ea0aa2e06ad01fed82efd3734462a2b20000",
  "parent_uuid": "adeccf0b36b520bef5da8d653ba4ccc8dc080000",
  "title": "combo_market_chat",
  "text": "[{\"date\": \"2026-04-28T07:25:52+00:00\", \"text\": \"Selling fresh combo list acme.com - 15k lines, emails + passwords, escrow accepted ...\"}]",
  "highlightText": "",
  "highlightTitle": "",
  "author": [
    "darkseller01",
    "cryptok1ng"
  ],
  "author_extended": [
    {
      "display_name": "darkseller01",
      "user_id": "7000000001",
      "adversary_group": null,
      "user_link": "https://t.me/darkseller01"
    },
    {
      "display_name": "cryptok1ng",
      "user_id": "7000000002",
      "adversary_group": null,
      "user_link": null
    }
  ],
  "language": "english",
  "referring_url": null,
  "referring_file_type": null,
  "rating": null,
  "published": "2026-04-28T10:25:00.000+03:00",
  "site": {
    "name": "combo_market_chat",
    "is_live": true,
    "domain": "t.me",
    "current_domain": "t.me",
    "type": "chat",
    "country": null,
    "categories": [
      "group"
    ]
  },
  "thread": {
    "url": "https://t.me/combo_market_chat",
    "uuid": "adeccf0b36b520bef5da8d653ba4ccc8dc080000",
    "title": "combo_market_chat",
    "full_title": "combo_market_chat",
    "published": "2026-04-28T10:25:00.000+03:00",
    "site_section": null,
    "section_title": null,
    "replies_count": 0,
    "participants_count": 2,
    "spam_score": 0,
    "main_image": null
  },
  "ord_in_thread": null,
  "extended": {
    "external_links": [
      "https://t.me/combo_lists_daily"
    ],
    "external_images": [],
    "external_videos": [],
    "file_links": [],
    "file_type": null,
    "network": "telegram",
    "required_login": false
  },
  "enriched": {
    "categories": [
      "carding"
    ],
    "persons": null,
    "organizations": null,
    "locations": null,
    "emails": {
      "value": [
        "j.doe@acme.com",
        "s.smith@acme.com"
      ],
      "count": 2
    },
    "phones": {
      "value": [
        "+15550100"
      ],
      "count": 1
    },
    "credit_cards": null,
    "ssns": null,
    "wallet_ids": null,
    "ips": null,
    "domains": {
      "value": [
        "acme.com",
        "t.me"
      ],
      "count": 2
    },
    "cve": null,
    "cyber_risk": {
      "value": 6,
      "site_risk": 6,
      "content_risk": 6
    }
  },
  "crawled": "2026-04-28T10:26:27.024+03:00",
  "updated": "2026-04-28T10:26:27.024+03:00",
  "cache_link": null
}
```

## Post

| Field | Type | Description |
| --- | --- | --- |
| `uuid` | string | Unique id of the post |
| `url` | string | URL of the post |
| `parent_uuid` | string | Id of the parent post in the thread |
| `title` | string | Post title |
| `text` | string | Full extracted text |
| `author` | array | Author names |
| `author_extended` | array | Author details - see below |
| `language` | string | Post language |
| `published` | string | Publication time, ISO 8601 |
| `ord_in_thread` | integer | Position in the thread |
| `rating` | number | Rating, when the source provides one |
| `referring_url` | string | URL that led the crawler to this post |
| `referring_file_type` | string | File type of the referring resource |
| `crawled` | string | When the post was crawled |
| `updated` | string | When the post was last updated |
| `cache_link` | string | Ready-made `/dark-cache` URL of the cached page, or `null` - see [Dark Cache & Images](cyber-api-cache-images) |
| `highlightText` / `highlightTitle` | string | Matched fragments, only with `highlight=true` |

## `author_extended`

| Field | Description |
| --- | --- |
| `display_name` | Author display name |
| `user_id` | Author id on the source site |
| `user_link` | Author profile URL |
| `adversary_group` | Known adversary groups associated with the author |

## `site`

| Field | Type | Description |
| --- | --- | --- |
| `name` | string | Site name |
| `domain` | string | Site domain |
| `current_domain` | string | Current domain, when the site has moved |
| `is_live` | boolean | Site was live at last check |
| `type` | string | Type of the site |
| `country` | string | Site country |
| `categories` | array | Categories of the site |

## `thread`

| Field | Type | Description |
| --- | --- | --- |
| `uuid`, `url` | string | Thread id and URL |
| `title`, `full_title` | string | Thread title |
| `published` | string | Thread publication time |
| `site_section`, `section_title` | string | Site section and its title |
| `replies_count` | integer | Replies in the thread |
| `participants_count` | integer | Distinct participants |
| `spam_score` | number | Spam score of the thread |
| `main_image` | string | Main image URL |

## `extended`

| Field | Type | Description |
| --- | --- | --- |
| `network` | string | Source network, e.g. `tor`, `telegram`, `openweb` |
| `external_links` | array | Links found in the post |
| `external_images` | array | Images found in the post - each has `url` (a ready-made `/cyber-image` link), `uuid`, and `text` extracted from the image |
| `external_videos` | array | Video links found in the post |
| `file_links` | array | File links found in the post |
| `file_type` | string | Type of the crawled file |
| `required_login` | boolean | Source required a login |

## `enriched`

Entities extracted from the post. Each entity object has a `value` array and a `count`.

| Field | Description |
| --- | --- |
| `categories` | Content classification of the post |
| `persons`, `organizations`, `locations` | Named entities mentioned |
| `emails`, `phones`, `ips`, `domains` | Contact and infrastructure entities |
| `credit_cards`, `ssns` | Financial and identity entities |
| `wallet_ids` | Crypto wallets - an `ids` array of `{ "type", "value" }` plus `count` |
| `cve` | CVE identifiers |
| `cyber_risk` | Risk scores: `value` (overall), `site_risk`, `content_risk` |