> ## Documentation Index > Fetch the complete documentation index at: https://docs.oathnet.org/llms.txt > Use this file to discover all available pages before exploring further. # Investigate Stealer Data with JSON Body > Run an investigation request with a JSON body. This form is best when each section needs its own filters, pagination cursor, or response controls. ## OpenAPI ````yaml /openapi.yaml post /service/v2/stealer/investigation/search openapi: 3.1.0 info: title: OathNet Service API version: 2.0.0 description: > # OathNet Service API Documentation Welcome to the OathNet Service API. This API provides breach search, stealer search, victims exploration, file search, exports, bulk search, scanners, and OSINT enrichment. ## Authentication Most `/api/service/*` endpoints require authentication via API key. Include your API key in the `x-api-key` header. ``` x-api-key: YOUR_API_KEY ``` You can obtain an API key from your dashboard at https://oathnet.org/dashboard?tab=account ## Rate Limiting & Quotas - Each request consumes from your daily lookup quota - Quota limits depend on your subscription plan - The `_meta.lookups` object in responses shows remaining daily lookups - Service-specific quotas may apply to certain endpoints ## Search Sessions For optimal quota management, initialize a search session before making service calls: 1. Call `/service/search/init` with your query 2. Use the returned `session.id` as `search_id` in subsequent service calls 3. This groups related lookups and provides better quota tracking ## Structured Filters V2 search endpoints share one structured filter contract: - use `GET` for simple searches and URL-friendly flat filters - use `POST` on the same search route when you have an AI/manual structured filter, a saved `filter_id`, or a filter tree that is awkward to URL-encode - `filter` is a JSON-encoded filter tree on query-string endpoints and a real JSON object on POST endpoints - POST search routes still take pagination, sorting, date range, `view`, and `search_id` as query parameters; the JSON body is for `filter` and `filter_id` - `filter_id` is a 24-character transient context ID returned by the AI filter flow or prior searches - explicit `filter` overrides a stored `filter_id` context, and flat params may still be used in the same request - the same filter objects are reused by AI filter responses, exports, bulk search, and scanners - advanced filters use leaf rules with `field`, `operator`, and `value`, plus `and` / `or` groups for boolean logic - supported operators are `eq`, `neq`, `contains`, `starts_with`, `ends_with`, `wildcard`, `gt`, `gte`, `lt`, `lte`, `exists`, `in`, and `not_in` See the `StructuredFilterNode` schema and `/guides/structured-filters` for the full operator list and examples. ## Success Response Patterns Successful responses use three main patterns: - Envelope JSON: Common on search-session and OSINT endpoints, plus `v2/stealer/search`, `v2/breach/search`, `v2/victims/search`, `v2/stealer/subdomain`, and `v2/bulk-search` create. - Raw JSON: Common on `v2/breach/autocomplete*`, `v2/ai/filter*`, `v2/files/search`, `v2/victims/*/properties`, `v2/victims/*/summary`, `v2/file-search*`, `v2/exports*`, `v2/bulk-search` list and status, `v2/victims/{log_id}`, `v2/phonebook`, and most scanner endpoints. - File or text stream: Victim file downloads, victim archive downloads, export downloads, and bulk-search downloads. ## Error Handling API-generated errors generally return with `success: false` and include: - `message`: Human-readable error description - `errors`: Object with field-specific or general error details Common HTTP status codes: - `200`: Success - `202`: Async job accepted - `400`: Bad Request (invalid parameters) - `401`: Unauthorized (missing or invalid token) - `403`: Forbidden (Cloudflare block or quota exceeded) - `404`: Not Found - `409`: Conflict - `429`: Too Many Requests - `500`: Internal Server Error - `502`: Bad Gateway - `503`: Service Unavailable contact: name: OathNet Support url: https://oathnet.org/support license: name: Proprietary url: https://oathnet.org/terms servers: - url: https://oathnet.org/api description: Production API Server security: - ApiKeyAuth: [] tags: - name: Search Session description: Initialize and manage search sessions for grouped lookups - name: Breach Search description: Search across breach databases for leaked credentials and data - name: Stealer Search description: Original stealer search route for simple credential lookups - name: V2 Stealer description: Enhanced V2 stealer search with advanced filtering and pagination - name: V2 Investigation description: >- Multi-section investigation across credentials, victims, evidence, files, and related credentials - name: V2 Breach description: Current breach search, autocomplete, and filter workflows - name: V2 Victims description: Search and explore victim profiles and their associated files - name: V2 File Search description: Search within victim files using regex, literal, or wildcard patterns - name: V2 File Metadata description: Search victim file metadata without fetching file bytes - name: V2 Export description: Export search results to JSONL or CSV format - name: V2 Bulk Search description: Batch many terms into an asynchronous export-style search job - name: Scanners description: >- Automated monitoring and delivery management for stealer and breach scanners - name: OSINT Lookups description: Open Source Intelligence lookups for various platforms - name: Utility description: Utility endpoints for autocomplete and other helpers paths: /service/v2/stealer/investigation/search: post: tags: - V2 Investigation summary: Investigate Stealer Data with JSON Body description: | Run an investigation request with a JSON body. This form is best when each section needs its own filters, pagination cursor, or response controls. operationId: investigateStealerV2Post requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/V2InvestigationSearchRequest' example: q: example.com scope: all include: - credentials - victims - evidence - files - related_credentials compact: true view: enriched page_size: 25 search_id: sess_0123456789abcdef filters: credentials: domain: - example.com has_log_id: true victims: service: - discord country: - US evidence: service: discord confidence: - high files: kind: cookies cursors: credentials: null victims: null evidence: null files: null related_credentials: null responses: '200': description: Investigation section response content: application/json: schema: $ref: '#/components/schemas/V2InvestigationSearchResponse' components: schemas: V2InvestigationSearchRequest: type: object description: Multi-section investigation request. properties: q: type: string scope: type: string enum: - all - both - credentials - victims - evidence - properties - files - related_credentials include: type: array items: type: string enum: - credentials - victims - evidence - files - related_credentials filter_mode: type: string enum: - fanout - intersect compact: type: boolean description: >- Return sections under `sections` and omit duplicate top-level section aliases. page_size: type: integer view: type: string enum: - enriched search_id: type: string wildcard: type: boolean from: type: string format: date-time to: type: string format: date-time date_field: type: string enum: - indexed_at - pwned_at log_id: type: string has_log_id: type: boolean sort: type: string fields: type: array items: type: string filter: $ref: '#/components/schemas/StructuredFilterNode' filter_id: $ref: '#/components/schemas/FilterContextId' filters: type: object description: Section-specific flat filters. properties: credentials: type: object additionalProperties: $ref: '#/components/schemas/JsonScalarOrArray' victims: type: object additionalProperties: $ref: '#/components/schemas/JsonScalarOrArray' evidence: type: object additionalProperties: $ref: '#/components/schemas/JsonScalarOrArray' files: type: object additionalProperties: $ref: '#/components/schemas/JsonScalarOrArray' cursors: type: object properties: credentials: type: string nullable: true victims: type: string nullable: true evidence: type: string nullable: true properties: type: string nullable: true files: type: string nullable: true related_credentials: type: string nullable: true additionalProperties: true V2InvestigationSearchResponse: type: object description: > Fanout response. Non-compact responses expose each section as a top-level field. Compact responses move included sections under `sections`. properties: success: type: boolean message: type: string data: $ref: '#/components/schemas/V2InvestigationSearchData' StructuredFilterNode: description: | Recursive structured filter tree. Constraints: - maximum nesting depth: 2 - maximum leaf conditions: 50 - each node should use exactly one of `field`, `and`, or `or` oneOf: - $ref: '#/components/schemas/StructuredFilterLeafNode' - $ref: '#/components/schemas/StructuredFilterAndNode' - $ref: '#/components/schemas/StructuredFilterOrNode' FilterContextId: type: string description: 24-character transient filter context ID. pattern: ^[0-9a-fA-F]{24}$ example: 0123456789abcdef01234567 JsonScalarOrArray: description: A scalar value or an array of scalar values. oneOf: - type: string - type: number - type: boolean - type: array items: oneOf: - type: string - type: number - type: boolean V2InvestigationSearchData: type: object properties: query: type: string scope: type: string sections: $ref: '#/components/schemas/V2InvestigationSections' credentials: $ref: '#/components/schemas/V2StealerSearchData' victims: $ref: '#/components/schemas/V2VictimsSearchData' evidence: $ref: '#/components/schemas/V2VictimPropertiesSearchData' properties: $ref: '#/components/schemas/V2VictimPropertiesSearchData' files: $ref: '#/components/schemas/V2FileMetadataSearchData' related_credentials: $ref: '#/components/schemas/V2StealerSearchData' links: type: array items: $ref: '#/components/schemas/V2InvestigationLink' relations: type: array items: $ref: '#/components/schemas/V2InvestigationRelation' section_errors: type: object additionalProperties: $ref: '#/components/schemas/V2InvestigationSectionError' intersection: $ref: '#/components/schemas/V2InvestigationIntersection' policy_redacted: type: boolean upgrade_required: type: boolean redaction_marker: type: string StructuredFilterLeafNode: type: object description: Leaf rule for one field. required: - field - operator properties: field: type: string description: Public field name accepted by the selected endpoint. example: country operator: $ref: '#/components/schemas/FilterOperator' value: $ref: '#/components/schemas/StructuredFilterValue' example: field: country operator: eq value: us StructuredFilterAndNode: type: object description: Compound node that ANDs all child rules. required: - and properties: and: type: array items: $ref: '#/components/schemas/StructuredFilterNode' example: and: - field: country operator: eq value: us - field: dbname operator: eq value: linkedin.com StructuredFilterOrNode: type: object description: Compound node that ORs all child rules. required: - or properties: or: type: array items: $ref: '#/components/schemas/StructuredFilterNode' example: or: - field: email operator: ends_with value: '@gmail.com' - field: email operator: ends_with value: '@outlook.com' V2InvestigationSections: type: object properties: credentials: $ref: '#/components/schemas/V2StealerSearchData' victims: $ref: '#/components/schemas/V2VictimsSearchData' evidence: $ref: '#/components/schemas/V2VictimPropertiesSearchData' files: $ref: '#/components/schemas/V2FileMetadataSearchData' related_credentials: $ref: '#/components/schemas/V2StealerSearchData' V2StealerSearchData: type: object properties: items: type: array items: $ref: '#/components/schemas/V2StealerResult' meta: $ref: '#/components/schemas/V2SearchMetadata' next_cursor: type: string victims: type: array items: $ref: '#/components/schemas/V2VictimResult' victims_meta: $ref: '#/components/schemas/V2SearchMetadata' victims_next_cursor: type: string credential_stats: type: object properties: direct_total: type: integer direct_loaded: type: integer linked_total: type: integer linked_loaded: type: integer total: type: integer loaded: type: integer V2VictimsSearchData: type: object properties: items: type: array items: $ref: '#/components/schemas/V2VictimResult' meta: $ref: '#/components/schemas/V2SearchMetadata' next_cursor: type: string V2VictimPropertiesSearchData: type: object properties: items: type: array items: $ref: '#/components/schemas/V2VictimPropertyResult' meta: $ref: '#/components/schemas/V2SearchMetadata' next_cursor: type: string policy_redacted: type: boolean upgrade_required: type: boolean redaction_marker: type: string V2FileMetadataSearchData: type: object properties: items: type: array items: $ref: '#/components/schemas/V2FileMetadataResult' meta: $ref: '#/components/schemas/V2SearchMetadata' next_cursor: type: string policy_redacted: type: boolean upgrade_required: type: boolean redaction_marker: type: string V2InvestigationLink: type: object properties: relation_type: type: string display_label: type: string log_id: type: string source: $ref: '#/components/schemas/V2InvestigationLinkEndpoint' target: $ref: '#/components/schemas/V2InvestigationLinkEndpoint' matched_field: type: string matched_value_label: type: string credential_id: type: string property_id: type: string file_id: type: string confidence: type: number reason: type: string V2InvestigationRelation: type: object properties: type: type: string log_id: type: string credential_id: type: string property_id: type: string file_id: type: string reason: type: string evidence: type: string V2InvestigationSectionError: type: object properties: section: type: string error: type: string code: type: string reason: type: string V2InvestigationIntersection: type: object properties: mode: type: string applied: type: boolean constraints: type: object additionalProperties: type: integer candidate_cap: type: integer truncated: type: boolean FilterOperator: type: string description: | Structured filter operator. `in` and `not_in` require string arrays. `exists` accepts a boolean and defaults to `true` when omitted. All other operators expect string values. enum: - eq - neq - in - not_in - contains - starts_with - ends_with - gt - gte - lt - lte - exists - wildcard StructuredFilterValue: description: | Filter value payload. Use strings for most operators, string arrays for `in` and `not_in`, and booleans for `exists`. oneOf: - type: string - type: boolean - type: array items: type: string V2StealerResult: type: object properties: id: type: string log_id: type: string url_str: type: string domain: type: array items: type: string subdomain: type: array items: type: string email_domains: type: array items: type: string path: type: array items: type: string username: type: string password: type: string email: type: array items: type: string log: type: string source_type: type: string password_hash: type: string archive_hash: type: string canonical_credential_id: type: string investigation_labels: type: array items: type: string investigation_link_types: type: array items: type: string is_related_credential: type: boolean pwned_at: type: string format: date-time indexed_at: type: string format: date-time V2SearchMetadata: type: object properties: count: type: integer description: Results in this page total: type: integer description: Total matching results took_ms: type: integer description: Query time in milliseconds has_more: type: boolean total_pages: type: integer max_score: type: number filter_id: $ref: '#/components/schemas/FilterContextId' V2VictimResult: type: object properties: log_id: type: string device_users: type: array items: type: string hwids: type: array items: type: string device_ips: type: array items: type: string device_emails: type: array items: type: string discord_ids: type: array items: type: string total_docs: type: integer pwned_at: type: string format: date-time indexed_at: type: string format: date-time phone_numbers: type: array items: type: string steam_ids: type: array items: type: string steam_names: type: array items: type: string services: type: array items: type: string service_count: type: integer identity_state: type: string device_os: type: string device_country: type: string device_city: type: string infection_path: type: string antivirus: type: array items: type: string domains: type: array items: type: string subdomains: type: array items: type: string email_domains: type: array items: type: string victim_ip: type: string geo_country: type: string geo_city: type: string V2VictimPropertyResult: type: object properties: log_id: type: string property_id: type: string property_type: type: string service: type: string identity_kind: type: string account_id: type: string username: type: string display_name: type: string value: type: string domain: type: string active: type: boolean source_type: type: string source_path: type: string source_file_id: type: string confidence: type: number confidence_label: type: string confidence_score: type: number indexed_at: type: string format: date-time V2FileMetadataResult: type: object properties: log_id: type: string file_id: type: string name: type: string folder: type: string path: type: string ext: type: string kind: type: string size_bytes: type: integer V2InvestigationLinkEndpoint: type: object properties: section: type: string id: type: string log_id: type: string securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: API key for authentication (lowercase header name) ````