V2 Stealer

Search Stealer Records with JSON Filter

Same response and flat query parameters as GET /service/v2/stealer/search, but sends filter or filter_id in a JSON body.

Use POST for the same flows as the web app: AI filters, advanced manual filters, saved filter contexts, or long filter trees. Keep regular search controls such as q, cursor, page_size, sort, from, to, view, and search_id in the query string.

Supports the same basic and advanced stealer filter fields documented on GET /service/v2/stealer/search.

POST

https://oathnet.org/api

service

stealer

curl --request POST \
  --url https://oathnet.org/api/service/v2/stealer/search \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "filter": {
    "and": [
      {
        "field": "domain",
        "operator": "eq",
        "value": "example.com"
      },
      {
        "field": "has_log_id",
        "operator": "eq",
        "value": "true"
      }
    ]
  }
}
'

{
  "success": true,
  "message": "<string>",
  "data": {
    "items": [
      {
        "id": "<string>",
        "log_id": "<string>",
        "url_str": "<string>",
        "domain": [
          "<string>"
        ],
        "subdomain": [
          "<string>"
        ],
        "email_domains": [
          "<string>"
        ],
        "path": [
          "<string>"
        ],
        "username": "<string>",
        "password": "<string>",
        "email": [
          "<string>"
        ],
        "log": "<string>",
        "source_type": "<string>",
        "password_hash": "<string>",
        "archive_hash": "<string>",
        "canonical_credential_id": "<string>",
        "investigation_labels": [
          "<string>"
        ],
        "investigation_link_types": [
          "<string>"
        ],
        "is_related_credential": true,
        "pwned_at": "2023-11-07T05:31:56Z",
        "indexed_at": "2023-11-07T05:31:56Z"
      }
    ],
    "meta": {
      "count": 123,
      "total": 123,
      "took_ms": 123,
      "has_more": true,
      "total_pages": 123,
      "max_score": 123,
      "filter_id": "0123456789abcdef01234567"
    },
    "next_cursor": "<string>",
    "victims": [
      {
        "log_id": "<string>",
        "device_users": [
          "<string>"
        ],
        "hwids": [
          "<string>"
        ],
        "device_ips": [
          "<string>"
        ],
        "device_emails": [
          "<string>"
        ],
        "discord_ids": [
          "<string>"
        ],
        "total_docs": 123,
        "pwned_at": "2023-11-07T05:31:56Z",
        "indexed_at": "2023-11-07T05:31:56Z",
        "phone_numbers": [
          "<string>"
        ],
        "steam_ids": [
          "<string>"
        ],
        "steam_names": [
          "<string>"
        ],
        "services": [
          "<string>"
        ],
        "service_count": 123,
        "identity_state": "<string>",
        "device_os": "<string>",
        "device_country": "<string>",
        "device_city": "<string>",
        "infection_path": "<string>",
        "antivirus": [
          "<string>"
        ],
        "domains": [
          "<string>"
        ],
        "subdomains": [
          "<string>"
        ],
        "email_domains": [
          "<string>"
        ],
        "victim_ip": "<string>",
        "geo_country": "<string>",
        "geo_city": "<string>"
      }
    ],
    "victims_meta": {
      "count": 123,
      "total": 123,
      "took_ms": 123,
      "has_more": true,
      "total_pages": 123,
      "max_score": 123,
      "filter_id": "0123456789abcdef01234567"
    },
    "victims_next_cursor": "<string>",
    "credential_stats": {
      "direct_total": 123,
      "direct_loaded": 123,
      "linked_total": 123,
      "linked_loaded": 123,
      "total": 123,
      "loaded": 123
    }
  }
}

{
  "success": false,
  "message": "Discord user not found.",
  "errors": {
    "error": "Discord user not found.",
    "status_code": 404,
    "_meta": {
      "user": {
        "plan": "Pro",
        "plan_type": "pro",
        "is_plan_active": true
      },
      "lookups": {
        "used_today": 5,
        "left_today": 995,
        "daily_limit": 1000,
        "is_unlimited": false
      },
      "service": {
        "name": "Service Name",
        "id": "service-id",
        "category": "general",
        "is_premium": false,
        "is_available": true,
        "session_quota": 10
      },
      "performance": {
        "duration_ms": 508.81,
        "timestamp": "2026-01-06T01:07:27.981019"
      }
    }
  }
}

Authorizations

x-api-key

string

header

required

API key for authentication (lowercase header name)

Query Parameters

cursor

string

Cursor token from the previous response's next_cursor.

page_size

integer

Number of results to return.

Required range: 1 <= x <= 200

sort

string

from

string<date-time>

date_field

enum<string>

Available options:

indexed_at,

pwned_at

fields[]

string[]

Response field whitelist.

search_id

string

Search session ID from POST /service/search/init.

view

enum<string>

Available options:

enriched

Body

application/json

JSON body used by POST variants of V2 search endpoints.

Use this body when the request has an AI/manual structured filter or an existing filter context ID. Regular controls such as q, cursor, page_size, sort, date range, view, and search_id stay in the query string so GET and POST responses remain identical.

filter

object

Inline structured filter tree. The tree can contain leaf rules with field, operator, and value, or compound and / or groups. When both filter and filter_id are sent, the inline filter is the explicit filter for this request.

Option 1
Option 2
Option 3

Show child attributes

Example:

{
  "field": "country",
  "operator": "eq",
  "value": "us"
}

filter_id

string

Transient filter context ID returned by POST /service/v2/ai/filter or by a previous V2 search response. Use it to run the same saved filter without resending the full filter tree.

Pattern: ^[0-9a-fA-F]{24}$

Example:

"0123456789abcdef01234567"

Response

Stealer search response

success

boolean

message

string

data

object

Show child attributes

curl --request POST \
  --url https://oathnet.org/api/service/v2/stealer/search \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "filter": {
    "and": [
      {
        "field": "domain",
        "operator": "eq",
        "value": "example.com"
      },
      {
        "field": "has_log_id",
        "operator": "eq",
        "value": "true"
      }
    ]
  }
}
'

{
  "success": true,
  "message": "<string>",
  "data": {
    "items": [
      {
        "id": "<string>",
        "log_id": "<string>",
        "url_str": "<string>",
        "domain": [
          "<string>"
        ],
        "subdomain": [
          "<string>"
        ],
        "email_domains": [
          "<string>"
        ],
        "path": [
          "<string>"
        ],
        "username": "<string>",
        "password": "<string>",
        "email": [
          "<string>"
        ],
        "log": "<string>",
        "source_type": "<string>",
        "password_hash": "<string>",
        "archive_hash": "<string>",
        "canonical_credential_id": "<string>",
        "investigation_labels": [
          "<string>"
        ],
        "investigation_link_types": [
          "<string>"
        ],
        "is_related_credential": true,
        "pwned_at": "2023-11-07T05:31:56Z",
        "indexed_at": "2023-11-07T05:31:56Z"
      }
    ],
    "meta": {
      "count": 123,
      "total": 123,
      "took_ms": 123,
      "has_more": true,
      "total_pages": 123,
      "max_score": 123,
      "filter_id": "0123456789abcdef01234567"
    },
    "next_cursor": "<string>",
    "victims": [
      {
        "log_id": "<string>",
        "device_users": [
          "<string>"
        ],
        "hwids": [
          "<string>"
        ],
        "device_ips": [
          "<string>"
        ],
        "device_emails": [
          "<string>"
        ],
        "discord_ids": [
          "<string>"
        ],
        "total_docs": 123,
        "pwned_at": "2023-11-07T05:31:56Z",
        "indexed_at": "2023-11-07T05:31:56Z",
        "phone_numbers": [
          "<string>"
        ],
        "steam_ids": [
          "<string>"
        ],
        "steam_names": [
          "<string>"
        ],
        "services": [
          "<string>"
        ],
        "service_count": 123,
        "identity_state": "<string>",
        "device_os": "<string>",
        "device_country": "<string>",
        "device_city": "<string>",
        "infection_path": "<string>",
        "antivirus": [
          "<string>"
        ],
        "domains": [
          "<string>"
        ],
        "subdomains": [
          "<string>"
        ],
        "email_domains": [
          "<string>"
        ],
        "victim_ip": "<string>",
        "geo_country": "<string>",
        "geo_city": "<string>"
      }
    ],
    "victims_meta": {
      "count": 123,
      "total": 123,
      "took_ms": 123,
      "has_more": true,
      "total_pages": 123,
      "max_score": 123,
      "filter_id": "0123456789abcdef01234567"
    },
    "victims_next_cursor": "<string>",
    "credential_stats": {
      "direct_total": 123,
      "direct_loaded": 123,
      "linked_total": 123,
      "linked_loaded": 123,
      "total": 123,
      "loaded": 123
    }
  }
}

{
  "success": false,
  "message": "Discord user not found.",
  "errors": {
    "error": "Discord user not found.",
    "status_code": 404,
    "_meta": {
      "user": {
        "plan": "Pro",
        "plan_type": "pro",
        "is_plan_active": true
      },
      "lookups": {
        "used_today": 5,
        "left_today": 995,
        "daily_limit": 1000,
        "is_unlimited": false
      },
      "service": {
        "name": "Service Name",
        "id": "service-id",
        "category": "general",
        "is_premium": false,
        "is_available": true,
        "session_quota": 10
      },
      "performance": {
        "duration_ms": 508.81,
        "timestamp": "2026-01-06T01:07:27.981019"
      }
    }
  }
}

Overview

Endpoints

Search Stealer Records with JSON Filter

Authorizations

Query Parameters

Body

Response