# Filters

Filters narrow the records selected by your [Search Scope](data-breach-scope). Add them as query parameters.

## Source type

| Filter | Values | Meaning |
| --- | --- | --- |
| `data_type` | `infostealer`, `data_breach` | Source category. Repeat the parameter for OR. |
| `sub_type` | `database_dump`, `data_breach_combo_list`, `stealer_logs`, `stealers_combo_list` | Finer source type. Repeat for OR. |

## Credential content

| Filter | Example | Meaning |
| --- | --- | --- |
| `has_password` | `has_password=true` | Only records that have (`true`) or lack (`false`) a password. |
| `password_type` | `password_type=plaintext` | Filter by password type. Repeat for OR. |
| `is_premium` | `is_premium=true` | Data from premium (paid) sources. |

## Service classification

Records carry the kind of service the login belongs to, derived from the login URL.

| Filter | Example | Meaning |
| --- | --- | --- |
| `service_category` | `service_category=VPN` | Broad service class. |
| `service_name` | `service_name=Fortinet` | Specific application. |

## Breach & URL

| Filter | Example | Meaning |
| --- | --- | --- |
| `breach_uuid` | `breach_uuid=0a1b...4567` | Records from one breach (40-char hex). Still needs a domain or email scope. See [Breach Catalog](data-breach-catalog). |
| `breach_name` | `breach_name=example leak` | Free-text match on the breach name (all words must match). |
| `login_url` | `login_url=portal.example.com` | Free-text match on the login URL. |

## Sorting

| Parameter | Values | Default |
| --- | --- | --- |
| `sort_by` | `crawled`, `breached` | `crawled` |
| `order_by` | `asc`, `desc` | `asc` |

Results are tie-broken by record `uuid`. Keep `sort_by` and `order_by` fixed while paging - see [Pagination](data-breach-pagination).