Investigate Stealer Data with JSON Body

curl --request POST \
  --url https://oathnet.org/api/service/v2/stealer/investigation/search \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "q": "example.com",
  "scope": "all",
  "include": [
    "credentials",
    "victims",
    "evidence",
    "files",
    "related_credentials"
  ],
  "compact": true,
  "view": "enriched",
  "page_size": 25,
  "search_id": "sess_0123456789abcdef",
  "filters": {
    "credentials": {
      "domain": [
        "example.com"
      ],
      "has_log_id": true
    },
    "victims": {
      "service": [
        "discord"
      ],
      "country": [
        "US"
      ]
    },
    "evidence": {
      "service": "discord",
      "confidence": [
        "high"
      ]
    },
    "files": {
      "kind": "cookies"
    }
  },
  "cursors": {
    "credentials": null,
    "victims": null,
    "evidence": null,
    "files": null,
    "related_credentials": null
  }
}
'

import requests

url = "https://oathnet.org/api/service/v2/stealer/investigation/search"

payload = {
    "q": "example.com",
    "scope": "all",
    "include": ["credentials", "victims", "evidence", "files", "related_credentials"],
    "compact": True,
    "view": "enriched",
    "page_size": 25,
    "search_id": "sess_0123456789abcdef",
    "filters": {
        "credentials": {
            "domain": ["example.com"],
            "has_log_id": True
        },
        "victims": {
            "service": ["discord"],
            "country": ["US"]
        },
        "evidence": {
            "service": "discord",
            "confidence": ["high"]
        },
        "files": { "kind": "cookies" }
    },
    "cursors": {
        "credentials": None,
        "victims": None,
        "evidence": None,
        "files": None,
        "related_credentials": None
    }
}
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    q: 'example.com',
    scope: 'all',
    include: ['credentials', 'victims', 'evidence', 'files', 'related_credentials'],
    compact: true,
    view: 'enriched',
    page_size: 25,
    search_id: 'sess_0123456789abcdef',
    filters: {
      credentials: {domain: ['example.com'], has_log_id: true},
      victims: {service: ['discord'], country: ['US']},
      evidence: {service: 'discord', confidence: ['high']},
      files: {kind: 'cookies'}
    },
    cursors: {
      credentials: null,
      victims: null,
      evidence: null,
      files: null,
      related_credentials: null
    }
  })
};

fetch('https://oathnet.org/api/service/v2/stealer/investigation/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://oathnet.org/api/service/v2/stealer/investigation/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'q' => 'example.com',
    'scope' => 'all',
    'include' => [
        'credentials',
        'victims',
        'evidence',
        'files',
        'related_credentials'
    ],
    'compact' => true,
    'view' => 'enriched',
    'page_size' => 25,
    'search_id' => 'sess_0123456789abcdef',
    'filters' => [
        'credentials' => [
                'domain' => [
                                'example.com'
                ],
                'has_log_id' => true
        ],
        'victims' => [
                'service' => [
                                'discord'
                ],
                'country' => [
                                'US'
                ]
        ],
        'evidence' => [
                'service' => 'discord',
                'confidence' => [
                                'high'
                ]
        ],
        'files' => [
                'kind' => 'cookies'
        ]
    ],
    'cursors' => [
        'credentials' => null,
        'victims' => null,
        'evidence' => null,
        'files' => null,
        'related_credentials' => null
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://oathnet.org/api/service/v2/stealer/investigation/search"

	payload := strings.NewReader("{\n  \"q\": \"example.com\",\n  \"scope\": \"all\",\n  \"include\": [\n    \"credentials\",\n    \"victims\",\n    \"evidence\",\n    \"files\",\n    \"related_credentials\"\n  ],\n  \"compact\": true,\n  \"view\": \"enriched\",\n  \"page_size\": 25,\n  \"search_id\": \"sess_0123456789abcdef\",\n  \"filters\": {\n    \"credentials\": {\n      \"domain\": [\n        \"example.com\"\n      ],\n      \"has_log_id\": true\n    },\n    \"victims\": {\n      \"service\": [\n        \"discord\"\n      ],\n      \"country\": [\n        \"US\"\n      ]\n    },\n    \"evidence\": {\n      \"service\": \"discord\",\n      \"confidence\": [\n        \"high\"\n      ]\n    },\n    \"files\": {\n      \"kind\": \"cookies\"\n    }\n  },\n  \"cursors\": {\n    \"credentials\": null,\n    \"victims\": null,\n    \"evidence\": null,\n    \"files\": null,\n    \"related_credentials\": null\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://oathnet.org/api/service/v2/stealer/investigation/search")
  .header("x-api-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"q\": \"example.com\",\n  \"scope\": \"all\",\n  \"include\": [\n    \"credentials\",\n    \"victims\",\n    \"evidence\",\n    \"files\",\n    \"related_credentials\"\n  ],\n  \"compact\": true,\n  \"view\": \"enriched\",\n  \"page_size\": 25,\n  \"search_id\": \"sess_0123456789abcdef\",\n  \"filters\": {\n    \"credentials\": {\n      \"domain\": [\n        \"example.com\"\n      ],\n      \"has_log_id\": true\n    },\n    \"victims\": {\n      \"service\": [\n        \"discord\"\n      ],\n      \"country\": [\n        \"US\"\n      ]\n    },\n    \"evidence\": {\n      \"service\": \"discord\",\n      \"confidence\": [\n        \"high\"\n      ]\n    },\n    \"files\": {\n      \"kind\": \"cookies\"\n    }\n  },\n  \"cursors\": {\n    \"credentials\": null,\n    \"victims\": null,\n    \"evidence\": null,\n    \"files\": null,\n    \"related_credentials\": null\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://oathnet.org/api/service/v2/stealer/investigation/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"q\": \"example.com\",\n  \"scope\": \"all\",\n  \"include\": [\n    \"credentials\",\n    \"victims\",\n    \"evidence\",\n    \"files\",\n    \"related_credentials\"\n  ],\n  \"compact\": true,\n  \"view\": \"enriched\",\n  \"page_size\": 25,\n  \"search_id\": \"sess_0123456789abcdef\",\n  \"filters\": {\n    \"credentials\": {\n      \"domain\": [\n        \"example.com\"\n      ],\n      \"has_log_id\": true\n    },\n    \"victims\": {\n      \"service\": [\n        \"discord\"\n      ],\n      \"country\": [\n        \"US\"\n      ]\n    },\n    \"evidence\": {\n      \"service\": \"discord\",\n      \"confidence\": [\n        \"high\"\n      ]\n    },\n    \"files\": {\n      \"kind\": \"cookies\"\n    }\n  },\n  \"cursors\": {\n    \"credentials\": null,\n    \"victims\": null,\n    \"evidence\": null,\n    \"files\": null,\n    \"related_credentials\": null\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "message": "<string>",
  "data": {
    "query": "<string>",
    "scope": "<string>",
    "sections": {
      "credentials": {
        "items": [
          {
            "id": "<string>",
            "log_id": "<string>",
            "url_str": "<string>",
            "domain": [
              "<string>"
            ],
            "subdomain": [
              "<string>"
            ],
            "email_domains": [
              "<string>"
            ],
            "path": [
              "<string>"
            ],
            "username": "<string>",
            "password": "<string>",
            "email": [
              "<string>"
            ],
            "log": "<string>",
            "source_type": "<string>",
            "password_hash": "<string>",
            "archive_hash": "<string>",
            "canonical_credential_id": "<string>",
            "investigation_labels": [
              "<string>"
            ],
            "investigation_link_types": [
              "<string>"
            ],
            "is_related_credential": true,
            "pwned_at": "2023-11-07T05:31:56Z",
            "indexed_at": "2023-11-07T05:31:56Z"
          }
        ],
        "meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "next_cursor": "<string>",
        "victims": [
          {
            "log_id": "<string>",
            "device_users": [
              "<string>"
            ],
            "hwids": [
              "<string>"
            ],
            "device_ips": [
              "<string>"
            ],
            "device_emails": [
              "<string>"
            ],
            "discord_ids": [
              "<string>"
            ],
            "total_docs": 123,
            "pwned_at": "2023-11-07T05:31:56Z",
            "indexed_at": "2023-11-07T05:31:56Z",
            "phone_numbers": [
              "<string>"
            ],
            "steam_ids": [
              "<string>"
            ],
            "steam_names": [
              "<string>"
            ],
            "services": [
              "<string>"
            ],
            "service_count": 123,
            "identity_state": "<string>",
            "device_os": "<string>",
            "device_country": "<string>",
            "device_city": "<string>",
            "infection_path": "<string>",
            "antivirus": [
              "<string>"
            ],
            "domains": [
              "<string>"
            ],
            "subdomains": [
              "<string>"
            ],
            "email_domains": [
              "<string>"
            ],
            "victim_ip": "<string>",
            "geo_country": "<string>",
            "geo_city": "<string>"
          }
        ],
        "victims_meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "victims_next_cursor": "<string>",
        "credential_stats": {
          "direct_total": 123,
          "direct_loaded": 123,
          "linked_total": 123,
          "linked_loaded": 123,
          "total": 123,
          "loaded": 123
        }
      },
      "victims": {
        "items": [
          {
            "log_id": "<string>",
            "device_users": [
              "<string>"
            ],
            "hwids": [
              "<string>"
            ],
            "device_ips": [
              "<string>"
            ],
            "device_emails": [
              "<string>"
            ],
            "discord_ids": [
              "<string>"
            ],
            "total_docs": 123,
            "pwned_at": "2023-11-07T05:31:56Z",
            "indexed_at": "2023-11-07T05:31:56Z",
            "phone_numbers": [
              "<string>"
            ],
            "steam_ids": [
              "<string>"
            ],
            "steam_names": [
              "<string>"
            ],
            "services": [
              "<string>"
            ],
            "service_count": 123,
            "identity_state": "<string>",
            "device_os": "<string>",
            "device_country": "<string>",
            "device_city": "<string>",
            "infection_path": "<string>",
            "antivirus": [
              "<string>"
            ],
            "domains": [
              "<string>"
            ],
            "subdomains": [
              "<string>"
            ],
            "email_domains": [
              "<string>"
            ],
            "victim_ip": "<string>",
            "geo_country": "<string>",
            "geo_city": "<string>"
          }
        ],
        "meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "next_cursor": "<string>"
      },
      "evidence": {
        "items": [
          {
            "log_id": "<string>",
            "property_id": "<string>",
            "property_type": "<string>",
            "service": "<string>",
            "identity_kind": "<string>",
            "account_id": "<string>",
            "username": "<string>",
            "display_name": "<string>",
            "value": "<string>",
            "domain": "<string>",
            "active": true,
            "source_type": "<string>",
            "source_path": "<string>",
            "source_file_id": "<string>",
            "confidence": 123,
            "confidence_label": "<string>",
            "confidence_score": 123,
            "indexed_at": "2023-11-07T05:31:56Z"
          }
        ],
        "meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "next_cursor": "<string>",
        "policy_redacted": true,
        "upgrade_required": true,
        "redaction_marker": "<string>"
      },
      "files": {
        "items": [
          {
            "log_id": "<string>",
            "file_id": "<string>",
            "name": "<string>",
            "folder": "<string>",
            "path": "<string>",
            "ext": "<string>",
            "kind": "<string>",
            "size_bytes": 123
          }
        ],
        "meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "next_cursor": "<string>",
        "policy_redacted": true,
        "upgrade_required": true,
        "redaction_marker": "<string>"
      },
      "related_credentials": {
        "items": [
          {
            "id": "<string>",
            "log_id": "<string>",
            "url_str": "<string>",
            "domain": [
              "<string>"
            ],
            "subdomain": [
              "<string>"
            ],
            "email_domains": [
              "<string>"
            ],
            "path": [
              "<string>"
            ],
            "username": "<string>",
            "password": "<string>",
            "email": [
              "<string>"
            ],
            "log": "<string>",
            "source_type": "<string>",
            "password_hash": "<string>",
            "archive_hash": "<string>",
            "canonical_credential_id": "<string>",
            "investigation_labels": [
              "<string>"
            ],
            "investigation_link_types": [
              "<string>"
            ],
            "is_related_credential": true,
            "pwned_at": "2023-11-07T05:31:56Z",
            "indexed_at": "2023-11-07T05:31:56Z"
          }
        ],
        "meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "next_cursor": "<string>",
        "victims": [
          {
            "log_id": "<string>",
            "device_users": [
              "<string>"
            ],
            "hwids": [
              "<string>"
            ],
            "device_ips": [
              "<string>"
            ],
            "device_emails": [
              "<string>"
            ],
            "discord_ids": [
              "<string>"
            ],
            "total_docs": 123,
            "pwned_at": "2023-11-07T05:31:56Z",
            "indexed_at": "2023-11-07T05:31:56Z",
            "phone_numbers": [
              "<string>"
            ],
            "steam_ids": [
              "<string>"
            ],
            "steam_names": [
              "<string>"
            ],
            "services": [
              "<string>"
            ],
            "service_count": 123,
            "identity_state": "<string>",
            "device_os": "<string>",
            "device_country": "<string>",
            "device_city": "<string>",
            "infection_path": "<string>",
            "antivirus": [
              "<string>"
            ],
            "domains": [
              "<string>"
            ],
            "subdomains": [
              "<string>"
            ],
            "email_domains": [
              "<string>"
            ],
            "victim_ip": "<string>",
            "geo_country": "<string>",
            "geo_city": "<string>"
          }
        ],
        "victims_meta": {
          "count": 123,
          "total": 123,
          "took_ms": 123,
          "has_more": true,
          "total_pages": 123,
          "max_score": 123,
          "filter_id": "0123456789abcdef01234567"
        },
        "victims_next_cursor": "<string>",
        "credential_stats": {
          "direct_total": 123,
          "direct_loaded": 123,
          "linked_total": 123,
          "linked_loaded": 123,
          "total": 123,
          "loaded": 123
        }
      }
    },
    "credentials": {
      "items": [
        {
          "id": "<string>",
          "log_id": "<string>",
          "url_str": "<string>",
          "domain": [
            "<string>"
          ],
          "subdomain": [
            "<string>"
          ],
          "email_domains": [
            "<string>"
          ],
          "path": [
            "<string>"
          ],
          "username": "<string>",
          "password": "<string>",
          "email": [
            "<string>"
          ],
          "log": "<string>",
          "source_type": "<string>",
          "password_hash": "<string>",
          "archive_hash": "<string>",
          "canonical_credential_id": "<string>",
          "investigation_labels": [
            "<string>"
          ],
          "investigation_link_types": [
            "<string>"
          ],
          "is_related_credential": true,
          "pwned_at": "2023-11-07T05:31:56Z",
          "indexed_at": "2023-11-07T05:31:56Z"
        }
      ],
      "meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "next_cursor": "<string>",
      "victims": [
        {
          "log_id": "<string>",
          "device_users": [
            "<string>"
          ],
          "hwids": [
            "<string>"
          ],
          "device_ips": [
            "<string>"
          ],
          "device_emails": [
            "<string>"
          ],
          "discord_ids": [
            "<string>"
          ],
          "total_docs": 123,
          "pwned_at": "2023-11-07T05:31:56Z",
          "indexed_at": "2023-11-07T05:31:56Z",
          "phone_numbers": [
            "<string>"
          ],
          "steam_ids": [
            "<string>"
          ],
          "steam_names": [
            "<string>"
          ],
          "services": [
            "<string>"
          ],
          "service_count": 123,
          "identity_state": "<string>",
          "device_os": "<string>",
          "device_country": "<string>",
          "device_city": "<string>",
          "infection_path": "<string>",
          "antivirus": [
            "<string>"
          ],
          "domains": [
            "<string>"
          ],
          "subdomains": [
            "<string>"
          ],
          "email_domains": [
            "<string>"
          ],
          "victim_ip": "<string>",
          "geo_country": "<string>",
          "geo_city": "<string>"
        }
      ],
      "victims_meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "victims_next_cursor": "<string>",
      "credential_stats": {
        "direct_total": 123,
        "direct_loaded": 123,
        "linked_total": 123,
        "linked_loaded": 123,
        "total": 123,
        "loaded": 123
      }
    },
    "victims": {
      "items": [
        {
          "log_id": "<string>",
          "device_users": [
            "<string>"
          ],
          "hwids": [
            "<string>"
          ],
          "device_ips": [
            "<string>"
          ],
          "device_emails": [
            "<string>"
          ],
          "discord_ids": [
            "<string>"
          ],
          "total_docs": 123,
          "pwned_at": "2023-11-07T05:31:56Z",
          "indexed_at": "2023-11-07T05:31:56Z",
          "phone_numbers": [
            "<string>"
          ],
          "steam_ids": [
            "<string>"
          ],
          "steam_names": [
            "<string>"
          ],
          "services": [
            "<string>"
          ],
          "service_count": 123,
          "identity_state": "<string>",
          "device_os": "<string>",
          "device_country": "<string>",
          "device_city": "<string>",
          "infection_path": "<string>",
          "antivirus": [
            "<string>"
          ],
          "domains": [
            "<string>"
          ],
          "subdomains": [
            "<string>"
          ],
          "email_domains": [
            "<string>"
          ],
          "victim_ip": "<string>",
          "geo_country": "<string>",
          "geo_city": "<string>"
        }
      ],
      "meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "next_cursor": "<string>"
    },
    "evidence": {
      "items": [
        {
          "log_id": "<string>",
          "property_id": "<string>",
          "property_type": "<string>",
          "service": "<string>",
          "identity_kind": "<string>",
          "account_id": "<string>",
          "username": "<string>",
          "display_name": "<string>",
          "value": "<string>",
          "domain": "<string>",
          "active": true,
          "source_type": "<string>",
          "source_path": "<string>",
          "source_file_id": "<string>",
          "confidence": 123,
          "confidence_label": "<string>",
          "confidence_score": 123,
          "indexed_at": "2023-11-07T05:31:56Z"
        }
      ],
      "meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "next_cursor": "<string>",
      "policy_redacted": true,
      "upgrade_required": true,
      "redaction_marker": "<string>"
    },
    "properties": {
      "items": [
        {
          "log_id": "<string>",
          "property_id": "<string>",
          "property_type": "<string>",
          "service": "<string>",
          "identity_kind": "<string>",
          "account_id": "<string>",
          "username": "<string>",
          "display_name": "<string>",
          "value": "<string>",
          "domain": "<string>",
          "active": true,
          "source_type": "<string>",
          "source_path": "<string>",
          "source_file_id": "<string>",
          "confidence": 123,
          "confidence_label": "<string>",
          "confidence_score": 123,
          "indexed_at": "2023-11-07T05:31:56Z"
        }
      ],
      "meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "next_cursor": "<string>",
      "policy_redacted": true,
      "upgrade_required": true,
      "redaction_marker": "<string>"
    },
    "files": {
      "items": [
        {
          "log_id": "<string>",
          "file_id": "<string>",
          "name": "<string>",
          "folder": "<string>",
          "path": "<string>",
          "ext": "<string>",
          "kind": "<string>",
          "size_bytes": 123
        }
      ],
      "meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "next_cursor": "<string>",
      "policy_redacted": true,
      "upgrade_required": true,
      "redaction_marker": "<string>"
    },
    "related_credentials": {
      "items": [
        {
          "id": "<string>",
          "log_id": "<string>",
          "url_str": "<string>",
          "domain": [
            "<string>"
          ],
          "subdomain": [
            "<string>"
          ],
          "email_domains": [
            "<string>"
          ],
          "path": [
            "<string>"
          ],
          "username": "<string>",
          "password": "<string>",
          "email": [
            "<string>"
          ],
          "log": "<string>",
          "source_type": "<string>",
          "password_hash": "<string>",
          "archive_hash": "<string>",
          "canonical_credential_id": "<string>",
          "investigation_labels": [
            "<string>"
          ],
          "investigation_link_types": [
            "<string>"
          ],
          "is_related_credential": true,
          "pwned_at": "2023-11-07T05:31:56Z",
          "indexed_at": "2023-11-07T05:31:56Z"
        }
      ],
      "meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "next_cursor": "<string>",
      "victims": [
        {
          "log_id": "<string>",
          "device_users": [
            "<string>"
          ],
          "hwids": [
            "<string>"
          ],
          "device_ips": [
            "<string>"
          ],
          "device_emails": [
            "<string>"
          ],
          "discord_ids": [
            "<string>"
          ],
          "total_docs": 123,
          "pwned_at": "2023-11-07T05:31:56Z",
          "indexed_at": "2023-11-07T05:31:56Z",
          "phone_numbers": [
            "<string>"
          ],
          "steam_ids": [
            "<string>"
          ],
          "steam_names": [
            "<string>"
          ],
          "services": [
            "<string>"
          ],
          "service_count": 123,
          "identity_state": "<string>",
          "device_os": "<string>",
          "device_country": "<string>",
          "device_city": "<string>",
          "infection_path": "<string>",
          "antivirus": [
            "<string>"
          ],
          "domains": [
            "<string>"
          ],
          "subdomains": [
            "<string>"
          ],
          "email_domains": [
            "<string>"
          ],
          "victim_ip": "<string>",
          "geo_country": "<string>",
          "geo_city": "<string>"
        }
      ],
      "victims_meta": {
        "count": 123,
        "total": 123,
        "took_ms": 123,
        "has_more": true,
        "total_pages": 123,
        "max_score": 123,
        "filter_id": "0123456789abcdef01234567"
      },
      "victims_next_cursor": "<string>",
      "credential_stats": {
        "direct_total": 123,
        "direct_loaded": 123,
        "linked_total": 123,
        "linked_loaded": 123,
        "total": 123,
        "loaded": 123
      }
    },
    "links": [
      {
        "relation_type": "<string>",
        "display_label": "<string>",
        "log_id": "<string>",
        "source": {
          "section": "<string>",
          "id": "<string>",
          "log_id": "<string>"
        },
        "target": {
          "section": "<string>",
          "id": "<string>",
          "log_id": "<string>"
        },
        "matched_field": "<string>",
        "matched_value_label": "<string>",
        "credential_id": "<string>",
        "property_id": "<string>",
        "file_id": "<string>",
        "confidence": 123,
        "reason": "<string>"
      }
    ],
    "relations": [
      {
        "type": "<string>",
        "log_id": "<string>",
        "credential_id": "<string>",
        "property_id": "<string>",
        "file_id": "<string>",
        "reason": "<string>",
        "evidence": "<string>"
      }
    ],
    "section_errors": {},
    "intersection": {
      "mode": "<string>",
      "applied": true,
      "constraints": {},
      "candidate_cap": 123,
      "truncated": true
    },
    "policy_redacted": true,
    "upgrade_required": true,
    "redaction_marker": "<string>"
  }
}