# Response Fields

## Request

| Field | Description |
| --- | --- |
| requestUuid | Unique identifier for the report request. |
| domain | Domain that was analyzed. |
| periodFrom | Start of the analyzed period. |
| periodTo | End of the analyzed period. |
| status | Report status. REPORT_READY indicates that the report is available. |
| report | Domain exposure report. |

## Summary

The `report.summary` object provides the main exposure metrics.

```json
{ "total_events": 28, "infostealer_events": 8, "data_breach_events": 20, "employee_events": 0, "client_events": 28, "first_seen": "2025-08-27", "last_seen": "2026-07-22" }
```

| Field | Description |
| --- | --- |
| total_events | Total credential exposure events associated with the domain. |
| infostealer_events | Events originating from infostealer data. |
| data_breach_events | Events originating from breach or combo-list data. |
| employee_events | Exposure events associated with employees of the domain. |
| client_events | Exposure events involving users accessing services on the domain. |
| first_seen | Date of the earliest exposure in the reporting period. |
| last_seen | Date of the most recent exposure in the reporting period. |

## Exposure Subject Breakdown

exposure\_subject\_breakdown separates employee exposure from client exposure.

```json
{ "employee": { "total_events": 0, "infostealer_events": 0, "data_breach_events": 0, "first_seen": null, "last_seen": null }, "client": { "total_events": 28, "infostealer_events": 8, "data_breach_events": 20, "first_seen": "2025-08-27", "last_seen": "2026-07-22" } }
```

This lets you distinguish between compromise of the organization's own accounts and compromise of customers or other users interacting with the organization's services.

## Monthly Timeline

`monthly_timeline` shows how exposure changed during the reporting period.

```json
{ "month": "2026-06", "total_events": 11, "infostealer_events": 8, "data_breach_events": 3, "employee": { "total_events": 0, "infostealer_events": 0, "data_breach_events": 0 }, "client": { "total_events": 11, "infostealer_events": 8, "data_breach_events": 3 } }
```

Each month includes totals separated by source and exposure subject.

## Event Family Breakdown

event\_family\_breakdown compares infostealer exposure with data-breach exposure.

```json
{ "infostealer": { "events": 8, "share_of_total_percent": 28.6, "employee_events": 0, "client_events": 8, "first_seen": "2026-06-10", "last_seen": "2026-06-18" }, "data_breach": { "events": 20, "share_of_total_percent": 71.4, "employee_events": 0, "client_events": 20, "first_seen": "2025-08-27", "last_seen": "2026-07-22" } }
```

## Infostealer Summary

`infostealer_summary` summarizes credentials associated with malware-infected devices.

```json
{ "total_events": 8, "employee_events": 0, "client_events": 8, "malware_families_observed": 0, "events_with_os_context": 0, "first_seen": "2026-06-10", "last_seen": "2026-06-18" }
```

Additional infostealer-related fields include:

malware\_family\_breakdown — exposure grouped by detected malware family.

os\_breakdown — operating systems observed on infected devices.

antivirus\_breakdown — antivirus products observed in available device context.

service\_classification\_breakdown — services associated with exposed credentials.

Fields can return empty arrays when the underlying events do not contain that context.

## Data Breach Summary

data\_breach\_summary summarizes exposure originating from breach datasets.

```json
{ "total_events": 20, "employee_events": 0, "client_events": 20, "known_breach_sources_count": 0, "events_from_known_breach_sources": 0, "events_from_combolist_sources": 20, "first_seen": "2025-08-27", "last_seen": "2026-07-22" }
```

The API also provides a data\_breach\_source\_type\_breakdown:

```json
{ "combolists": { "events": 20, "employee_events": 0, "client_events": 20, "share_of_data_breach_events_percent": 100.0 }, "database_dump": { "events": 0, "employee_events": 0, "client_events": 0, "share_of_data_breach_events_percent": 0.0 } }
```

## Top Login URLs

top\_login\_urls shows the login URLs most frequently associated with compromised credentials.

```json
[ { "url": "http://myaccount.autobarn.net/login.php", "events": 10, "employee_events": 0, "client_events": 10 }, { "url": "myaccount.autobarn.net/login.php", "events": 4, "employee_events": 0, "client_events": 4 } ]
```

This is useful for identifying which applications, portals, and authentication endpoints are most commonly associated with exposed credentials.

## Country Breakdown

`country_breakdown` provides geographic information when country context is available in the underlying exposure data.

An empty array means no geographic context was available for the events included in the report.