> ## Documentation Index > Fetch the complete documentation index at: https://docs.oathnet.org/llms.txt > Use this file to discover all available pages before exploring further. # Search Breach Records > Current breach search surface for new integrations. Supports flat filters plus structured `filter` and `filter_id` flows. The same route also accepts POST when you want to send `filter` or `filter_id` in the JSON request body instead of the query string. Dashboard basic filters: - Identity and account: `email`, `username`, `full_name`, `first_name`, `last_name`, `phone`, `ip`. - Location and source: `country`, `city`, `dbname`. API flat filters: - Core fields: `email`, `email_domain`, `domain`, `username`, `password`, `password_hash`, `ip`, `phone`, `first_name`, `last_name`, `full_name`, `city`, `country`, `state`, `postal_code`, `dbname`, `discord_id`, `iban`, `ssn`, `gender`. - Date of birth range: `date_birth_from`, `date_birth_to`. - Alias families: `name`, `address`, `discord`, `social`, `financial`, and `gaming`. Advanced alias fields: - `name`: `full_name`, `first_name`, `last_name`, `middle_name`, `display_name`, `guardian_name`, `child_firstname`, `child_lastname`. - `password`: `password`, `password_hash`. - `phone`: `phone_national`, `phone_national2`, `phone_number`, `phone_number2`, `phone_number3`, `mobile_phone`, `guardian_phone`, `phone`, `phones`, `cellphone`, `mobilephone`, `login_phone`, `bill_phone`, `company_phone`, `workphone`, `telefone_1`, `telefone_2`, `username_phone`. - `ip`: `ip`, `ip_registration`. - `address`: `address_street`, `address_street2`, `address2`. - `discord`: `discordid`, `discord`, `discord_user`, `discord_displayname`, `discord_id`, `discord_tag`. - `social`: `fb_id`, `facebook`, `facebook_id`, `instagram`, `twitter`, `x`, `tiktok`, `snapchat`, `telegram`, `signal`, `reddit`, `youtube`, `twitch`, `spotify`, `soundcloud`, `pinterest`, `threads`, `onlyfans`, `kick`, `patreon`, `github`, `gitlab`, `lastfm`, `applemusic`, `linkedin`, `linkedin_id`, `vk_id`, `member_url`, plus the Discord fields listed above. - `financial`: `iban`, `bic`, `ssn`, `license`, `license2`, `passport`, `passport_id`, `passport_no`, `passport_number`, `national_id`, `identity_number`, `id_number`, `tax_id`, `cpf`, `cnpj`, `snils`, `inn`, `rfc`, `nric`, `personalausweis`, `pan_id`, `pan_no`, `pan_number`, `drivers_license`, `bank_name`, `paypal`, `cashapp`, `bitcoin`, `eth`, `ltc`, `monero`, `solana`, `xrp`, `wallet`, `crypto_wallet`, `wallet_address`. - `gaming`: `steam`, `steam_id`, `xbl`, `live`, `psn`, `psn_id`, `roblox`, `roblox_username`, `robloxusername`, `bnet`, `epic`, `namemc`, `fivem`, `player_id`. The advanced field picker can also use indexed breach fields discovered by the field autocomplete API. Database autocomplete feeds the `dbname` filter. ## OpenAPI ````yaml /openapi.yaml get /service/v2/breach/search openapi: 3.1.0 info: title: OathNet Service API version: 2.0.0 description: > # OathNet Service API Documentation Welcome to the OathNet Service API. This API provides breach search, stealer search, victims exploration, file search, exports, bulk search, scanners, and OSINT enrichment. ## Authentication Most `/api/service/*` endpoints require authentication via API key. Include your API key in the `x-api-key` header. ``` x-api-key: YOUR_API_KEY ``` You can obtain an API key from your dashboard at https://oathnet.org/dashboard?tab=account ## Rate Limiting & Quotas - Each request consumes from your daily lookup quota - Quota limits depend on your subscription plan - The `_meta.lookups` object in responses shows remaining daily lookups - Service-specific quotas may apply to certain endpoints ## Search Sessions For optimal quota management, initialize a search session before making service calls: 1. Call `/service/search/init` with your query 2. Use the returned `session.id` as `search_id` in subsequent service calls 3. This groups related lookups and provides better quota tracking ## Structured Filters V2 search endpoints share one structured filter contract: - use `GET` for simple searches and URL-friendly flat filters - use `POST` on the same search route when you have an AI/manual structured filter, a saved `filter_id`, or a filter tree that is awkward to URL-encode - `filter` is a JSON-encoded filter tree on query-string endpoints and a real JSON object on POST endpoints - POST search routes still take pagination, sorting, date range, `view`, and `search_id` as query parameters; the JSON body is for `filter` and `filter_id` - `filter_id` is a 24-character transient context ID returned by the AI filter flow or prior searches - explicit `filter` overrides a stored `filter_id` context, and flat params may still be used in the same request - the same filter objects are reused by AI filter responses, exports, bulk search, and scanners - advanced filters use leaf rules with `field`, `operator`, and `value`, plus `and` / `or` groups for boolean logic - supported operators are `eq`, `neq`, `contains`, `starts_with`, `ends_with`, `wildcard`, `gt`, `gte`, `lt`, `lte`, `exists`, `in`, and `not_in` See the `StructuredFilterNode` schema and `/guides/structured-filters` for the full operator list and examples. ## Success Response Patterns Successful responses use three main patterns: - Envelope JSON: Common on search-session and OSINT endpoints, plus `v2/stealer/search`, `v2/breach/search`, `v2/victims/search`, `v2/stealer/subdomain`, and `v2/bulk-search` create. - Raw JSON: Common on `v2/breach/autocomplete*`, `v2/ai/filter*`, `v2/files/search`, `v2/victims/*/properties`, `v2/victims/*/summary`, `v2/file-search*`, `v2/exports*`, `v2/bulk-search` list and status, `v2/victims/{log_id}`, `v2/phonebook`, and most scanner endpoints. - File or text stream: Victim file downloads, victim archive downloads, export downloads, and bulk-search downloads. ## Error Handling API-generated errors generally return with `success: false` and include: - `message`: Human-readable error description - `errors`: Object with field-specific or general error details Common HTTP status codes: - `200`: Success - `202`: Async job accepted - `400`: Bad Request (invalid parameters) - `401`: Unauthorized (missing or invalid token) - `403`: Forbidden (Cloudflare block or quota exceeded) - `404`: Not Found - `409`: Conflict - `429`: Too Many Requests - `500`: Internal Server Error - `502`: Bad Gateway - `503`: Service Unavailable contact: name: OathNet Support url: https://oathnet.org/support license: name: Proprietary url: https://oathnet.org/terms servers: - url: https://oathnet.org/api description: Production API Server security: - ApiKeyAuth: [] tags: - name: Search Session description: Initialize and manage search sessions for grouped lookups - name: Breach Search description: Search across breach databases for leaked credentials and data - name: Stealer Search description: Original stealer search route for simple credential lookups - name: V2 Stealer description: Enhanced V2 stealer search with advanced filtering and pagination - name: V2 Investigation description: >- Multi-section investigation across credentials, victims, evidence, files, and related credentials - name: V2 Breach description: Current breach search, autocomplete, and filter workflows - name: V2 Victims description: Search and explore victim profiles and their associated files - name: V2 File Search description: Search within victim files using regex, literal, or wildcard patterns - name: V2 File Metadata description: Search victim file metadata without fetching file bytes - name: V2 Export description: Export search results to JSONL or CSV format - name: V2 Bulk Search description: Batch many terms into an asynchronous export-style search job - name: Scanners description: >- Automated monitoring and delivery management for stealer and breach scanners - name: OSINT Lookups description: Open Source Intelligence lookups for various platforms - name: Utility description: Utility endpoints for autocomplete and other helpers paths: /service/v2/breach/search: get: tags: - V2 Breach summary: Search Breach Records description: > Current breach search surface for new integrations. Supports flat filters plus structured `filter` and `filter_id` flows. The same route also accepts POST when you want to send `filter` or `filter_id` in the JSON request body instead of the query string. Dashboard basic filters: - Identity and account: `email`, `username`, `full_name`, `first_name`, `last_name`, `phone`, `ip`. - Location and source: `country`, `city`, `dbname`. API flat filters: - Core fields: `email`, `email_domain`, `domain`, `username`, `password`, `password_hash`, `ip`, `phone`, `first_name`, `last_name`, `full_name`, `city`, `country`, `state`, `postal_code`, `dbname`, `discord_id`, `iban`, `ssn`, `gender`. - Date of birth range: `date_birth_from`, `date_birth_to`. - Alias families: `name`, `address`, `discord`, `social`, `financial`, and `gaming`. Advanced alias fields: - `name`: `full_name`, `first_name`, `last_name`, `middle_name`, `display_name`, `guardian_name`, `child_firstname`, `child_lastname`. - `password`: `password`, `password_hash`. - `phone`: `phone_national`, `phone_national2`, `phone_number`, `phone_number2`, `phone_number3`, `mobile_phone`, `guardian_phone`, `phone`, `phones`, `cellphone`, `mobilephone`, `login_phone`, `bill_phone`, `company_phone`, `workphone`, `telefone_1`, `telefone_2`, `username_phone`. - `ip`: `ip`, `ip_registration`. - `address`: `address_street`, `address_street2`, `address2`. - `discord`: `discordid`, `discord`, `discord_user`, `discord_displayname`, `discord_id`, `discord_tag`. - `social`: `fb_id`, `facebook`, `facebook_id`, `instagram`, `twitter`, `x`, `tiktok`, `snapchat`, `telegram`, `signal`, `reddit`, `youtube`, `twitch`, `spotify`, `soundcloud`, `pinterest`, `threads`, `onlyfans`, `kick`, `patreon`, `github`, `gitlab`, `lastfm`, `applemusic`, `linkedin`, `linkedin_id`, `vk_id`, `member_url`, plus the Discord fields listed above. - `financial`: `iban`, `bic`, `ssn`, `license`, `license2`, `passport`, `passport_id`, `passport_no`, `passport_number`, `national_id`, `identity_number`, `id_number`, `tax_id`, `cpf`, `cnpj`, `snils`, `inn`, `rfc`, `nric`, `personalausweis`, `pan_id`, `pan_no`, `pan_number`, `drivers_license`, `bank_name`, `paypal`, `cashapp`, `bitcoin`, `eth`, `ltc`, `monero`, `solana`, `xrp`, `wallet`, `crypto_wallet`, `wallet_address`. - `gaming`: `steam`, `steam_id`, `xbl`, `live`, `psn`, `psn_id`, `roblox`, `roblox_username`, `robloxusername`, `bnet`, `epic`, `namemc`, `fivem`, `player_id`. The advanced field picker can also use indexed breach fields discovered by the field autocomplete API. Database autocomplete feeds the `dbname` filter. operationId: searchBreachV2 parameters: - name: q in: query schema: type: string - name: cursor in: query schema: type: string - name: page_size in: query schema: type: integer - name: sort in: query schema: type: string - name: from in: query schema: type: string format: date-time - name: to in: query schema: type: string format: date-time - name: date_field in: query schema: type: string enum: - indexed_at - pwned_at - name: wildcard in: query schema: type: boolean - name: logic in: query schema: type: string enum: - and - or - $ref: '#/components/parameters/StructuredFilterParam' - $ref: '#/components/parameters/FilterContextIdParam' - name: email[] in: query schema: type: array items: type: string style: form explode: true - name: email_domain[] in: query schema: type: array items: type: string style: form explode: true - name: domain[] in: query schema: type: array items: type: string style: form explode: true - name: username[] in: query schema: type: array items: type: string style: form explode: true - name: password[] in: query schema: type: array items: type: string style: form explode: true - name: password_hash[] in: query schema: type: array items: type: string style: form explode: true - name: ip[] in: query schema: type: array items: type: string style: form explode: true - name: phone[] in: query schema: type: array items: type: string style: form explode: true - name: first_name[] in: query schema: type: array items: type: string style: form explode: true - name: last_name[] in: query schema: type: array items: type: string style: form explode: true - name: full_name[] in: query schema: type: array items: type: string style: form explode: true - name: city[] in: query schema: type: array items: type: string style: form explode: true - name: country[] in: query schema: type: array items: type: string style: form explode: true - name: state[] in: query schema: type: array items: type: string style: form explode: true - name: postal_code[] in: query schema: type: array items: type: string style: form explode: true - name: dbname[] in: query schema: type: array items: type: string style: form explode: true - name: discord_id[] in: query schema: type: array items: type: string style: form explode: true - name: iban[] in: query schema: type: array items: type: string style: form explode: true - name: ssn[] in: query schema: type: array items: type: string style: form explode: true - name: date_birth_from in: query schema: type: string - name: date_birth_to in: query schema: type: string - name: name[] in: query description: Alias for full-name style breach fields. schema: type: array items: type: string style: form explode: true - name: gender[] in: query schema: type: array items: type: string style: form explode: true - name: address[] in: query description: Alias for address-like breach fields. schema: type: array items: type: string style: form explode: true - name: discord[] in: query description: Alias for Discord identifiers found in breach rows. schema: type: array items: type: string style: form explode: true - name: social[] in: query description: Generic social identifier field family. schema: type: array items: type: string style: form explode: true - name: financial[] in: query description: Generic payment or financial identifier field family. schema: type: array items: type: string style: form explode: true - name: gaming[] in: query description: Generic gaming-platform identifier field family. schema: type: array items: type: string style: form explode: true - $ref: '#/components/parameters/FieldsParam' - $ref: '#/components/parameters/SearchIdParam' responses: '200': description: Breach search response content: application/json: schema: $ref: '#/components/schemas/V2BreachSearchResponse' components: parameters: StructuredFilterParam: name: filter in: query description: > JSON-encoded structured filter tree. Use leaf nodes with `field`, `operator`, and `value`, or compound nodes with `and` / `or`. If you would rather send the filter as a real JSON object, use POST on the same `/search` route. See `/guides/structured-filters` for the full grammar, operators, limits, and examples. schema: type: string example: >- {"and":[{"field":"country","operator":"eq","value":"us"},{"field":"email","operator":"ends_with","value":"@gmail.com"}]} FilterContextIdParam: name: filter_id in: query description: > 24-character transient filter context ID returned by `POST /service/v2/ai/filter` or a previous search response. schema: $ref: '#/components/schemas/FilterContextId' example: 0123456789abcdef01234567 FieldsParam: name: fields[] in: query description: Response field whitelist. schema: type: array items: type: string style: form explode: true SearchIdParam: name: search_id in: query description: Search session ID from `POST /service/search/init`. schema: type: string schemas: V2BreachSearchResponse: type: object properties: success: type: boolean message: type: string data: $ref: '#/components/schemas/V2BreachSearchData' FilterContextId: type: string description: 24-character transient filter context ID. pattern: ^[0-9a-fA-F]{24}$ example: 0123456789abcdef01234567 V2BreachSearchData: type: object properties: items: type: array items: $ref: '#/components/schemas/V2BreachResult' meta: $ref: '#/components/schemas/V2SearchMetadata' dbname_info: type: object description: Public metadata keyed by breach `dbname`. additionalProperties: $ref: '#/components/schemas/V2LeakMetadata' next_cursor: type: string _meta: type: object additionalProperties: true V2BreachResult: type: object properties: id: type: string email: type: string email_domain: type: string username: type: string password: type: string password_hash: type: string salt: type: string full_name: type: string first_name: type: string last_name: type: string middle_name: type: string display_name: type: string phone_number: type: string phone_national: type: string address_street: type: string city: type: string state: type: string postal_code: type: string country: type: string date_birth: type: string age: type: integer created_at: type: string last_login: type: string indexed_at: type: string format: date-time ip: type: string discordid: type: string instagram: type: string linkedin: type: string iban: type: string ssn: type: string dbname: type: string gender: type: string language: type: string bio: type: string location: type: string extra: type: object additionalProperties: true V2SearchMetadata: type: object properties: count: type: integer description: Results in this page total: type: integer description: Total matching results took_ms: type: integer description: Query time in milliseconds has_more: type: boolean total_pages: type: integer max_score: type: number filter_id: $ref: '#/components/schemas/FilterContextId' V2LeakMetadata: type: object properties: Title: type: string Domain: type: string BreachDate: type: string PwnCount: type: integer Description: type: string securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: API key for authentication (lowercase header name) ````