> ## Documentation Index
> Fetch the complete documentation index at: https://projectdiscovery-feat-gsoc.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Get all leaked credentials

> Returns all leaks (personal, employee, customer) with optional type filtering. Replaces the need for separate endpoint calls.

<Info>
  This is the **new consolidated leaks endpoint** that replaces the deprecated individual endpoints (`/v1/leaks/domain`, `/v1/leaks/email`, `/v1/leaks/domain/customers`).

  It returns all types of leaks (personal, employee, customer) with optional filtering by type.
</Info>

## Overview

The consolidated leaks endpoint provides access to all leaked credentials associated with your account:

* **Personal leaks**: Leaks associated with your personal email address
* **Employee leaks**: Leaks from employees of your verified domains, classified as:
  * `organization_leaks`: Leaks on organization systems (login URL domain matches email domain)
  * `external_vendor_leaks`: Leaks on external vendor systems (login URL domain differs from email domain)
* **Customer leaks**: Leaks from customers using your verified domains

## Key Features

### Advanced Filtering

* Filter by leak type (`personal`, `employee`, `customer`, `external_vendor_leaks`, `organization_leaks`)
* Search across all fields
* Filter by domain, email, status, and date ranges
* Sort by various fields (URL, username, log\_date, country, etc.)

### Grouping & Analytics

Use the `group_by` parameter to get aggregated data:

* Group by URL, country, device\_ip, hostname, email, or hardware\_id
* Returns group summaries instead of individual leak records
* Perfect for analytics and reporting

### Pagination

* Standard pagination with `limit` and `page_number` parameters
* Default limit: 20 results per page

## Response Structure

### Individual Leaks Response

```json theme={null}
{
  "data": [
    {
      "id": "leak_id_hash",
      "url": "https://example.com",
      "username": "user@example.com",
      "password": "masked_or_unmasked",
      "device_ip": "192.168.1.1",
      "hostname": "DESKTOP-ABC123",
      "os": "Windows 10",
      "country": "United States",
      "log_date": "2023-01-15",
      "hardware_id": "hw_12345",
      "domain": "example.com",
      "email_domain": "example.com",
      "url_domain": "example.com",
      "status": "open",
      "user_type": "employee"
    }
  ],
  "total_leaks": 150,
  "total_pages": 8,
  "total_count": 150,
  "summary": {
    "total_leaks": 150,
    "personal_leaks": 25,
    "employee_leaks": 100,
    "customer_leaks": 25,
    "external_vendor_leaks": 60,
    "organization_leaks": 40
  }
}
```

### Grouped Response (when using `group_by`)

```json theme={null}
{
  "group_summary": [
    {
      "url": "https://facebook.com",
      "count": 45
    },
    {
      "url": "https://linkedin.com", 
      "count": 32
    }
  ],
  "total_leaks": 150
}
```

## Privacy & Security

### Access Control

* **Personal leaks**: Always accessible to the authenticated user
* **Employee/Customer leaks**: Requires domain verification
* **Password unmasking**: Requires domain verification

### Data Classification

The API automatically classifies employee leaks:

* **Organization leaks**: Login URL domain matches or is a subdomain of the email domain
* **External vendor leaks**: Login URL domain is completely different from email domain

## Migration from Deprecated Endpoints

If you're currently using the deprecated endpoints, here's how to migrate:

| Deprecated Endpoint              | New Equivalent                |
| -------------------------------- | ----------------------------- |
| `GET /v1/leaks/email`            | `GET /v1/leaks?type=personal` |
| `GET /v1/leaks/domain`           | `GET /v1/leaks?type=employee` |
| `GET /v1/leaks/domain/customers` | `GET /v1/leaks?type=customer` |

## Examples

### Get all leaks

```bash theme={null}
curl -X GET "https://api.projectdiscovery.io/v1/leaks" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

### Get only employee leaks

```bash theme={null}
curl -X GET "https://api.projectdiscovery.io/v1/leaks?type=employee" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

### Get leaks grouped by URL

```bash theme={null}
curl -X GET "https://api.projectdiscovery.io/v1/leaks?group_by=url" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

### Search for specific domain

```bash theme={null}
curl -X GET "https://api.projectdiscovery.io/v1/leaks?domain=example.com" \
  -H "Authorization: Bearer YOUR_API_KEY"
```


## OpenAPI

````yaml get /v1/leaks
openapi: 3.1.0
info:
  title: PDCP API
  version: '1.0'
  summary: ProjectDiscovery Cloud Platform
  description: >-
    For more details, checkout
    https://docs.projectdiscovery.io/api-reference/editor/scan
servers:
  - url: https://api.projectdiscovery.io
    description: Production
  - url: https://api.dev.projectdiscovery.io
    description: Development
  - url: http://localhost:8085
    description: Localhost
security:
  - X-API-Key: []
paths:
  /v1/leaks:
    get:
      tags: []
      summary: Get all leaked credentials
      description: >-
        Returns all leaks (personal, employee, customer) with optional type
        filtering. Replaces the need for separate endpoint calls.
      operationId: get-v1-leaks
      parameters:
        - schema:
            type: string
            enum:
              - all
              - personal
              - employee
              - customer
              - external_vendor_leaks
              - organization_leaks
            default: all
          in: query
          name: type
          description: Filter by specific leak type (single value only)
        - schema:
            type: string
          in: query
          name: domain
          description: Filter leaks by specific domain (applies to employee/customer leaks)
        - schema:
            type: string
          in: query
          name: email
          description: >-
            Filter leaks by specific email (can be personal, employee, or
            customer email from user's authorized results)
        - schema:
            type: string
          in: query
          name: search
          description: Search query to filter results across all fields
        - schema:
            type: number
          in: query
          name: limit
          description: Number of results per page for pagination
        - schema:
            type: number
          in: query
          name: page_number
          description: Page number for pagination (starts from 1)
        - schema:
            type: string
            format: date
          in: query
          name: start_date
          description: time filter start date
        - schema:
            type: string
            default: all_time
            enum:
              - all_time
              - current_month
              - last_month
              - last_3_months
              - last_6_months
              - last_12_months
          in: query
          name: time_range
        - schema:
            type: string
            format: date
          in: query
          name: end_date
          description: time filter end date
        - schema:
            type: string
            enum:
              - url
              - username
              - log_date
              - country
              - device_ip
              - host_username
              - hostname
              - os
              - hardware_id
              - malware_path
          in: query
          name: sort_by
          description: supported sort fields
        - schema:
            type: string
            enum:
              - asc
              - desc
          in: query
          name: sort_order
          description: supported sort order (asc or desc)
        - schema:
            type: string
            enum:
              - fixed
              - open
          in: query
          name: status
          description: supported status (fixed or open)
        - schema:
            type: string
            enum:
              - url
              - country
              - device_ip
              - hostname
              - email
              - hardware_id
          in: query
          name: group_by
          description: >-
            Group results by field - returns group summaries when used without
            field-specific filtering
        - schema:
            type: string
          in: query
          name: url
          description: Filter by specific URL (used with group_by for drill-down)
        - schema:
            type: string
          in: query
          name: country
          description: Filter by specific country (used with group_by for drill-down)
        - schema:
            type: string
          in: query
          name: device_ip
          description: Filter by specific device IP (used with group_by for drill-down)
        - schema:
            type: string
          in: query
          name: hostname
          description: Filter by specific hostname (used with group_by for drill-down)
        - schema:
            type: string
          in: query
          name: hardware_id
          description: Filter by specific hardware ID (used with group_by for drill-down)
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        url:
                          type: string
                        username:
                          type: string
                        password:
                          type: string
                        device_ip:
                          type: string
                        hostname:
                          type: string
                        os:
                          type: string
                        malware_path:
                          type: string
                        country:
                          type: string
                        log_date:
                          type: string
                        hardware_id:
                          type: string
                        domain:
                          type: string
                        email_domain:
                          type: string
                        url_domain:
                          type: string
                        fetched_at:
                          type: string
                        status:
                          type: string
                        user_type:
                          type: string
                          description: >-
                            Classification of leak type (personal, employee,
                            customer, external_vendor_leaks, organization_leaks)
                  total_leaks:
                    type: number
                  total_pages:
                    type: number
                  total_count:
                    type: number
                  summary:
                    type: object
                    properties:
                      total_leaks:
                        type: number
                      personal_leaks:
                        type: number
                      employee_leaks:
                        type: number
                      customer_leaks:
                        type: number
                      external_vendor_leaks:
                        type: number
                        description: >-
                          Employee leaks on external vendor systems (login URL
                          domain != email domain)
                      organization_leaks:
                        type: number
                        description: >-
                          Employee leaks on organization systems (login URL
                          domain == email domain)
                  group_summary:
                    type: array
                    description: Group summary data when group_by parameter is used
                    items:
                      type: object
                      additionalProperties: true
                      description: Dynamic group summary with field name as key and count
        '400':
          $ref: '#/components/responses/MessageResponse'
        '401':
          $ref: '#/components/responses/MessageResponse'
        '403':
          $ref: '#/components/responses/MessageResponse'
        '404':
          $ref: '#/components/responses/MessageResponse'
        '500':
          $ref: '#/components/responses/MessageResponse'
        default:
          $ref: '#/components/responses/ErrorResponse'
components:
  responses:
    MessageResponse:
      description: Example response
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            required:
              - message
    ErrorResponse:
      description: Example response
      content:
        application/json:
          schema:
            type: object
            required:
              - message
            properties:
              message:
                type: string
              kind:
                type: string
              code:
                type: string
              error:
                type: string
              error_id:
                type: string
              param:
                type: string
              status:
                type: integer
  securitySchemes:
    X-API-Key:
      name: X-API-Key
      type: apiKey
      in: header

````