# Filters

Filters narrow the records returned for your `domain`. Add them as query parameters. Values are case-insensitive.

## Secret

| Filter | Values | Meaning |
| --- | --- | --- |
| `token_type` | e.g. `ApiKey`, `OauthPAT`, `RefreshToken`, `AccessKey`, `SessionToken`, `PrivateKey`, `WebhookSigningKey`, `PublicClientKey` | Kind of credential. Repeat the parameter for OR. |
| `service_type` | e.g. `googleoauth2`, `auth0oauth`, `azurerefreshtoken`, `vercel`, `netlify`, `virustotal` | Detector / issuing service that matched the secret. Repeat for OR. |

## Verification

| Filter | Values | Meaning |
| --- | --- | --- |
| `verification_status` | `verified`, `unverified`, `unknown` | `verified` = confirmed live against the issuer when checked. `unverified` = checked and rejected, or not checkable. `unknown` = not checked. Repeat for OR. |

> [!TIP]
> Start with `verification_status=verified` - those are the secrets known to work.

## Time window

Epoch milliseconds, UTC. No default - without these, a query covers all collected data.

| Filter | Meaning |
| --- | --- |
| `crawled_from`, `crawled_to` | When Webz.io collected the record. |
| `breach_from`, `breach_to` | When the data was exfiltrated from the device. |

## Sorting

| Parameter | Values | Default |
| --- | --- | --- |
| `sort_by` | `crawled`, `breached` | `breached` |
| `order_by` | `asc`, `desc` | `asc` |

Results are tie-broken by record `uuid`. Keep `sort_by` and `order_by` fixed while paging - see [Pagination](nhi-pagination).