# Query Syntax

The `q` parameter accepts a boolean query. Terms without a field prefix are matched against the post title, text, and thread title - plus text extracted from images and key entity fields, so a bare email address, domain, or CVE id just works.

## Free text searches these fields

`title`, `text`, `thread.title`, `image_text`, `enriched.domain.value`, `enriched.email.value`, `enriched.phone.value`, `enriched.wallet_id.value`, `enriched.cve.value`, `extended.external_link`

## Operators

| Syntax | Example | Matches |
| --- | --- | --- |
| Implicit AND | `bitcoin wallet` | Posts with both terms |
| `OR` | `bitcoin OR "crypto wallet"` | Either term |
| `NOT` or `-` | `bitcoin NOT price`, `bitcoin -price` | First term without the second |
| `( )` | `(leak OR dump) bitcoin` | Grouping |
| `"..."` | `"bitcoin wallet"` | Exact phrase |
| `*` | `crypt*` | Prefix wildcard |
| `$` | `bitcoin$` | Exact term, no stemming. Supported for Arabic, Russian, Spanish, Chinese, Japanese, and Korean. |
| `field:value` | `extended.network:tor` | Field filter - see [Filters](cyber-api-filters) |

## Examples

Bitcoin wallet mentions on Telegram channels:

```
"bitcoin wallet" extended.network:telegram
```

Crypto exchange mentions in posts that contain extracted emails - a leaked-credentials signal:

```
"crypto exchange" enriched.email.value:*
```

## Rules

- Quotes and parentheses must be balanced, or the request fails.
- Operators `AND`, `OR`, `NOT` must be uppercase.
- An invalid query returns `400` - see [Errors, Rate Limits & Credits](cyber-api-errors-limits).

> [!TIP]
> Not sure about a query? Add `warning=true` to your request - potential issues come back in a `warnings` array without failing the request.