# Filters

Filters narrow the records returned for your `domain`. Add them as query parameters. Values are case-insensitive.

## Cookie

| Filter | Values | Meaning |
| --- | --- | --- |
| `cookie_type` | `auth`, `session`, `refresh`, `unclassified` | Role of the cookie. Repeat the parameter for OR. |
| `browser` | `chrome`, `edge`, `opera`, `firefox`, `safari`, `unknown` | Browser the cookie was taken from. Repeat for OR. |
| `expiration_status` | `active`, `expired` | `active` returns cookies that have not expired yet (or have no expiration); `expired` the rest. |

## Service

| Filter | Example | Meaning |
| --- | --- | --- |
| `service_host` | `service_host=portal.example.com` | Exact host the cookie belongs to. Repeat for OR. |

> [!TIP]
> `expiration_status=active` together with `cookie_type=session` or `cookie_type=auth` gives you the cookies an attacker can still use right now.

## Time window

Epoch milliseconds, UTC. No default - without these, a query covers all collected data.

| Filter | Meaning |
| --- | --- |
| `crawled_from`, `crawled_to` | When Webz.io collected the record. |
| `breach_from`, `breach_to` | When the data was exfiltrated from the device. |

## Sorting

| Parameter | Values | Default |
| --- | --- | --- |
| `sort_by` | `crawled`, `breached` | `crawled` |
| `order_by` | `asc`, `desc` | `asc` |

Results are tie-broken by record `uuid`. Keep `sort_by` and `order_by` fixed while paging - see [Pagination](leaked-cookies-pagination).