# Record Data Fields

Each element of the `records` array is one leaked secret, with device and source context nested as objects.

```json
{
  "uuid": "7c2f1a90-3d4e-4b6a-9f21-0a8d5e6c7b31",
  "domain": "example.com",
  "infected_emails": ["dev@example.com"],
  "crawled_date": "2026-09-05T14:02:11Z",
  "token_type": "ApiKey",
  "service_type": "googlegeminiapikey",
  "matched_string": "AI****************************Xk",
  "secret_parts": { "key": "AI****************************Xk" },
  "verified": true,
  "verification_status": "verified",
  "file_metadata": { "file_name": ".env", "file_extension": "env" },
  "device_info": { "infection_uuid": "63911c30...", "ip_address": "203.0.113.10", "os": "Windows 11", "malware_family": "lumma", "location": { "country": "DE", "city": "Berlin" } },
  "publication_source_info": { "site_domain": "t.me", "is_premium": false, "published_date": "2026-09-04" }
}
```

## Record

| Field | Type | Description |
| --- | --- | --- |
| `uuid` | string | Unique id of the record. |
| `domain` | string | The monitored domain this secret was matched to - the `domain` you queried. |
| `infected_emails` | array | Employee account email(s) found in the same infostealer log. |
| `crawled_date` | string | When Webz.io collected the record. |

## Secret

| Field | Type | Description |
| --- | --- | --- |
| `token_type` | string | Kind of credential, e.g. `ApiKey`, `OauthPAT`, `RefreshToken`, `PrivateKey`. |
| `service_type` | string | Detector / issuing service that matched the secret, e.g. `googleoauth2`. |
| `matched_string` | string | The secret as found. Masked (e.g. `AI****Xk`) unless your account has the view-password permission. |
| `secret_parts` | object | The secret split into its named parts (e.g. `key`, or `client_id` + `client_secret`). Masked under the same rule. |
| `verified` | boolean | `true` when the secret was confirmed live against its issuer. |
| `verification_status` | string | `verified`, `unverified`, or `unknown`. |

## `file_metadata`

| Field | Description |
| --- | --- |
| `file_name` | Name of the file the secret was found in, e.g. `.env`. |
| `file_extension` | File extension. |

## `device_info`

The infected machine the secret was taken from.

| Field | Description |
| --- | --- |
| `infection_uuid` | Id of the infection. Records from the same machine share it - across cookies, secrets, and Data Breaches API credentials. |
| `exfiltration_date` | When the data was exfiltrated from the device. |
| `log_file_name` | Source log file. |
| `hwid` | Device hardware id. |
| `ip_address` | Device IP address. |
| `location` | `country`, `city`, `zip_code`. |
| `computer_username` | Username on the infected machine. |
| `os` | Operating system. |
| `antivirus_software` | Detected antivirus. |
| `malware_family` | Malware family. |
| `malware_path` | Path of the malware on the device. |

## `publication_source_info`

| Field | Description |
| --- | --- |
| `file_name`, `file_link` | Source file name and link (when your plan includes file info). |
| `site_domain` | Domain where the data was found. |
| `is_premium` | Whether the source is premium. |
| `published_date` | When the source published the data. |