# Time Range

Every search covers a time window. By default it is the last **365 days**.

## Time parameters

Timestamps are epoch milliseconds, UTC.

| Parameter | Filters on | Default |
| --- | --- | --- |
| `crawled_from`, `crawled_to` | When Webz.io collected the record | `crawled_from` = 365 days ago |
| `breach_from`, `breach_to` | The breach date, or the infostealer infection date | `breach_from` = 365 days ago |

```bash
https://api.webz.io/breaches?token=YOUR_TOKEN&email_domain=example.com&breach_from=1751630400000
```

## Reaching older data

In the default mode, a `crawled_from` or `breach_from` older than one year returns `400`. To search further back, add `raw=true`. Raw mode has a restricted parameter set:

- Provide exactly one time group: `breach_from` (optionally `breach_to`) **or** `crawled_from` (optionally `crawled_to`) - not both.
- Provide exactly one domain filter: `login_domain` **or** `email_domain`.
- Allowed parameters are only `token`, `raw`, that one time group, that one domain filter, and `next`. Anything else returns `400`.
- Results always come back in ascending order.

```bash
https://api.webz.io/breaches?token=YOUR_TOKEN&raw=true&email_domain=example.com&breach_from=1640995200000
```

> [!WARNING]
> Raw mode is not available to internal integration tokens; such requests return `403`.