> ## Documentation Index > Fetch the complete documentation index at: https://docs.oathnet.org/llms.txt > Use this file to discover all available pages before exploring further. # Search Stealer Records > Current stealer search surface for credential records. Successful responses use the standard search envelope. Use `GET` for simple query-string filters. Use `POST /service/v2/stealer/search` when you need to send a structured `filter` or `filter_id` in JSON. Dashboard basic filters: - Credentials: `email`, `domain`, `subdomain`, `username`, `password`, `path`, `email_domain`, `source_type`, `password_hash`, `archive_hash`, `canonical_credential_id`. - Victim pivots: `ip`, `hwid`, `discord_id`, `country`, `city`, `os`, `service`, `steam_id`, `steam_name`, `phone`, `identity_state`, `victim_ip`, `antivirus`, `infection_path`. - Files (Enterprise): `files.q`, `files.name`, `files.folder`, `files.kind`, `files.ext`, `files.size_min`, `files.size_max`. - Metadata: `log_id`, date range via `from` / `to` and `date_field` (`pwned_at` or `indexed_at`), plus victim volume via `victims.total_docs`. Advanced structured filter fields: - Common: `log_id`, `domain`, `subdomain`, `email`, `email_domain`, `username`, `pwned_at`, `indexed_at`, `hwid`, `archive_hash`. - Credentials: `credentials.id`, `credentials.log_id`, `credentials.url`, `credentials.domain`, `credentials.subdomain`, `credentials.email`, `credentials.email_domain`, `credentials.username`, `credentials.password`, `credentials.path`, `credentials.source_type`, `credentials.password_hash`, `credentials.archive_hash`, `credentials.canonical_credential_id`. - Victims: `victims.id`, `victims.log_id`, `victims.legacy_log_id`, `victims.victim_id`, `victims.archive_hash`, `victims.country`, `victims.city`, `victims.geo_city`, `victims.ip`, `victims.victim_ip`, `victims.email`, `victims.email_domain`, `victims.username`, `victims.domain`, `victims.subdomain`, `victims.hwid`, `victims.os`, `victims.service`, `victims.service_count`, `victims.total_docs`, `victims.steam_id`, `victims.steam_name`, `victims.discord_id`, `victims.phone`, `victims.identity_state`, `victims.antivirus`, `victims.infection_path`. - Victim properties/evidence: `evidence.q`, `evidence.active`, `evidence.property_type`, `evidence.service`, `evidence.identity_kind`, `evidence.account_id`, `evidence.username`, `evidence.display_name`, `evidence.value`, `evidence.domain`, `evidence.source_type`, `evidence.source_file_id`, `evidence.confidence`, `evidence.confidence_min`. - File metadata (Enterprise): `files.q`, `files.log_id`, `files.file_id`, `files.name`, `files.folder`, `files.path`, `files.kind`, `files.ext`, `files.size_bytes`, `files.size_min`, `files.size_max`. Bare compatibility fields such as `domain`, `subdomain`, `username`, and `archive_hash` are accepted and normalized to the matching credential or victim namespace where needed. ## OpenAPI ````yaml /openapi.yaml get /service/v2/stealer/search openapi: 3.1.0 info: title: OathNet Service API version: 2.0.0 description: > # OathNet Service API Documentation Welcome to the OathNet Service API. This API provides breach search, stealer search, victims exploration, file search, exports, bulk search, scanners, and OSINT enrichment. ## Authentication Most `/api/service/*` endpoints require authentication via API key. Include your API key in the `x-api-key` header. ``` x-api-key: YOUR_API_KEY ``` You can obtain an API key from your dashboard at https://oathnet.org/dashboard?tab=account ## Rate Limiting & Quotas - Each request consumes from your daily lookup quota - Quota limits depend on your subscription plan - The `_meta.lookups` object in responses shows remaining daily lookups - Service-specific quotas may apply to certain endpoints ## Search Sessions For optimal quota management, initialize a search session before making service calls: 1. Call `/service/search/init` with your query 2. Use the returned `session.id` as `search_id` in subsequent service calls 3. This groups related lookups and provides better quota tracking ## Structured Filters V2 search endpoints share one structured filter contract: - use `GET` for simple searches and URL-friendly flat filters - use `POST` on the same search route when you have an AI/manual structured filter, a saved `filter_id`, or a filter tree that is awkward to URL-encode - `filter` is a JSON-encoded filter tree on query-string endpoints and a real JSON object on POST endpoints - POST search routes still take pagination, sorting, date range, `view`, and `search_id` as query parameters; the JSON body is for `filter` and `filter_id` - `filter_id` is a 24-character transient context ID returned by the AI filter flow or prior searches - explicit `filter` overrides a stored `filter_id` context, and flat params may still be used in the same request - the same filter objects are reused by AI filter responses, exports, bulk search, and scanners - advanced filters use leaf rules with `field`, `operator`, and `value`, plus `and` / `or` groups for boolean logic - supported operators are `eq`, `neq`, `contains`, `starts_with`, `ends_with`, `wildcard`, `gt`, `gte`, `lt`, `lte`, `exists`, `in`, and `not_in` See the `StructuredFilterNode` schema and `/guides/structured-filters` for the full operator list and examples. ## Success Response Patterns Successful responses use three main patterns: - Envelope JSON: Common on search-session and OSINT endpoints, plus `v2/stealer/search`, `v2/breach/search`, `v2/victims/search`, `v2/stealer/subdomain`, and `v2/bulk-search` create. - Raw JSON: Common on `v2/breach/autocomplete*`, `v2/ai/filter*`, `v2/files/search`, `v2/victims/*/properties`, `v2/victims/*/summary`, `v2/file-search*`, `v2/exports*`, `v2/bulk-search` list and status, `v2/victims/{log_id}`, `v2/phonebook`, and most scanner endpoints. - File or text stream: Victim file downloads, victim archive downloads, export downloads, and bulk-search downloads. ## Error Handling API-generated errors generally return with `success: false` and include: - `message`: Human-readable error description - `errors`: Object with field-specific or general error details Common HTTP status codes: - `200`: Success - `202`: Async job accepted - `400`: Bad Request (invalid parameters) - `401`: Unauthorized (missing or invalid token) - `403`: Forbidden (Cloudflare block or quota exceeded) - `404`: Not Found - `409`: Conflict - `429`: Too Many Requests - `500`: Internal Server Error - `502`: Bad Gateway - `503`: Service Unavailable contact: name: OathNet Support url: https://oathnet.org/support license: name: Proprietary url: https://oathnet.org/terms servers: - url: https://oathnet.org/api description: Production API Server security: - ApiKeyAuth: [] tags: - name: Search Session description: Initialize and manage search sessions for grouped lookups - name: Breach Search description: Search across breach databases for leaked credentials and data - name: Stealer Search description: Original stealer search route for simple credential lookups - name: V2 Stealer description: Enhanced V2 stealer search with advanced filtering and pagination - name: V2 Investigation description: >- Multi-section investigation across credentials, victims, evidence, files, and related credentials - name: V2 Breach description: Current breach search, autocomplete, and filter workflows - name: V2 Victims description: Search and explore victim profiles and their associated files - name: V2 File Search description: Search within victim files using regex, literal, or wildcard patterns - name: V2 File Metadata description: Search victim file metadata without fetching file bytes - name: V2 Export description: Export search results to JSONL or CSV format - name: V2 Bulk Search description: Batch many terms into an asynchronous export-style search job - name: Scanners description: >- Automated monitoring and delivery management for stealer and breach scanners - name: OSINT Lookups description: Open Source Intelligence lookups for various platforms - name: Utility description: Utility endpoints for autocomplete and other helpers paths: /service/v2/stealer/search: get: tags: - V2 Stealer summary: Search Stealer Records description: > Current stealer search surface for credential records. Successful responses use the standard search envelope. Use `GET` for simple query-string filters. Use `POST /service/v2/stealer/search` when you need to send a structured `filter` or `filter_id` in JSON. Dashboard basic filters: - Credentials: `email`, `domain`, `subdomain`, `username`, `password`, `path`, `email_domain`, `source_type`, `password_hash`, `archive_hash`, `canonical_credential_id`. - Victim pivots: `ip`, `hwid`, `discord_id`, `country`, `city`, `os`, `service`, `steam_id`, `steam_name`, `phone`, `identity_state`, `victim_ip`, `antivirus`, `infection_path`. - Files (Enterprise): `files.q`, `files.name`, `files.folder`, `files.kind`, `files.ext`, `files.size_min`, `files.size_max`. - Metadata: `log_id`, date range via `from` / `to` and `date_field` (`pwned_at` or `indexed_at`), plus victim volume via `victims.total_docs`. Advanced structured filter fields: - Common: `log_id`, `domain`, `subdomain`, `email`, `email_domain`, `username`, `pwned_at`, `indexed_at`, `hwid`, `archive_hash`. - Credentials: `credentials.id`, `credentials.log_id`, `credentials.url`, `credentials.domain`, `credentials.subdomain`, `credentials.email`, `credentials.email_domain`, `credentials.username`, `credentials.password`, `credentials.path`, `credentials.source_type`, `credentials.password_hash`, `credentials.archive_hash`, `credentials.canonical_credential_id`. - Victims: `victims.id`, `victims.log_id`, `victims.legacy_log_id`, `victims.victim_id`, `victims.archive_hash`, `victims.country`, `victims.city`, `victims.geo_city`, `victims.ip`, `victims.victim_ip`, `victims.email`, `victims.email_domain`, `victims.username`, `victims.domain`, `victims.subdomain`, `victims.hwid`, `victims.os`, `victims.service`, `victims.service_count`, `victims.total_docs`, `victims.steam_id`, `victims.steam_name`, `victims.discord_id`, `victims.phone`, `victims.identity_state`, `victims.antivirus`, `victims.infection_path`. - Victim properties/evidence: `evidence.q`, `evidence.active`, `evidence.property_type`, `evidence.service`, `evidence.identity_kind`, `evidence.account_id`, `evidence.username`, `evidence.display_name`, `evidence.value`, `evidence.domain`, `evidence.source_type`, `evidence.source_file_id`, `evidence.confidence`, `evidence.confidence_min`. - File metadata (Enterprise): `files.q`, `files.log_id`, `files.file_id`, `files.name`, `files.folder`, `files.path`, `files.kind`, `files.ext`, `files.size_bytes`, `files.size_min`, `files.size_max`. Bare compatibility fields such as `domain`, `subdomain`, `username`, and `archive_hash` are accepted and normalized to the matching credential or victim namespace where needed. operationId: searchStealerV2 parameters: - name: q in: query description: Search query schema: type: string - name: cursor in: query schema: type: string - name: page_size in: query schema: type: integer - name: sort in: query schema: type: string - name: from in: query schema: type: string format: date-time - name: to in: query schema: type: string format: date-time - name: date_field in: query schema: type: string enum: - indexed_at - pwned_at - name: log_id in: query schema: type: string - name: has_log_id in: query schema: type: boolean - name: wildcard in: query schema: type: boolean - name: logic in: query schema: type: string enum: - and - or - $ref: '#/components/parameters/StructuredFilterParam' - $ref: '#/components/parameters/FilterContextIdParam' - name: domain[] in: query schema: type: array items: type: string style: form explode: true - name: subdomain[] in: query schema: type: array items: type: string style: form explode: true - name: username[] in: query schema: type: array items: type: string style: form explode: true - name: password[] in: query schema: type: array items: type: string style: form explode: true - name: password_hash[] in: query schema: type: array items: type: string style: form explode: true - name: path[] in: query schema: type: array items: type: string style: form explode: true - name: email[] in: query schema: type: array items: type: string style: form explode: true - name: email_domain[] in: query schema: type: array items: type: string style: form explode: true - name: ip[] in: query schema: type: array items: type: string style: form explode: true - name: hwid[] in: query schema: type: array items: type: string style: form explode: true - name: discord_id[] in: query schema: type: array items: type: string style: form explode: true - name: source_type[] in: query schema: type: array items: type: string style: form explode: true - name: archive_hash[] in: query schema: type: array items: type: string style: form explode: true - name: canonical_credential_id[] in: query schema: type: array items: type: string style: form explode: true - name: fields[] in: query description: Response field whitelist schema: type: array items: type: string style: form explode: true - name: search_id in: query schema: type: string - name: view in: query schema: type: string enum: - enriched responses: '200': description: Stealer search response content: application/json: schema: $ref: '#/components/schemas/V2StealerSearchResponse' '400': description: Invalid request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: parameters: StructuredFilterParam: name: filter in: query description: > JSON-encoded structured filter tree. Use leaf nodes with `field`, `operator`, and `value`, or compound nodes with `and` / `or`. If you would rather send the filter as a real JSON object, use POST on the same `/search` route. See `/guides/structured-filters` for the full grammar, operators, limits, and examples. schema: type: string example: >- {"and":[{"field":"country","operator":"eq","value":"us"},{"field":"email","operator":"ends_with","value":"@gmail.com"}]} FilterContextIdParam: name: filter_id in: query description: > 24-character transient filter context ID returned by `POST /service/v2/ai/filter` or a previous search response. schema: $ref: '#/components/schemas/FilterContextId' example: 0123456789abcdef01234567 schemas: V2StealerSearchResponse: type: object properties: success: type: boolean message: type: string data: $ref: '#/components/schemas/V2StealerSearchData' ErrorResponse: type: object description: > Standard error response format. All errors return `success: false`. **Common error messages by endpoint:** - Search endpoints: "'q' parameter is required.", "No results found." - IP Info: "ip_address parameter is required", "Invalid IP address format provided to ip-api." - Steam: "steam_id parameter is required", "Steam user not found or profile is private" - Discord: "discord_id parameter is required", "Invalid Discord ID: Discord ID must be 14-19 digits long", "Discord user not found." - Xbox: "xbl_id parameter is required", "Xbox user not found." - Roblox: "Either 'username' or 'user_id' parameter is required.", "Roblox user not found." - Holehe: "email parameter is required" - Extract Subdomain: "domain parameter is required", "No results found." - Auth: "Invalid API key." properties: success: type: boolean example: false message: type: string description: Human-readable error message errors: type: object description: Error details object. May contain `_meta` with quota info. properties: error: type: string description: Error message (for OSINT lookups) detail: type: string description: Error detail (for auth errors) details: type: string description: Additional error details status_code: type: integer description: HTTP status code (for OSINT lookups - 404 for not found) example: 404 _meta: $ref: '#/components/schemas/ResponseMeta' example: success: false message: Discord user not found. errors: error: Discord user not found. status_code: 404 _meta: user: plan: Pro plan_type: pro is_plan_active: true lookups: used_today: 5 left_today: 995 daily_limit: 1000 is_unlimited: false service: name: Service Name id: service-id category: general is_premium: false is_available: true session_quota: 10 performance: duration_ms: 508.81 timestamp: '2026-01-06T01:07:27.981019' FilterContextId: type: string description: 24-character transient filter context ID. pattern: ^[0-9a-fA-F]{24}$ example: 0123456789abcdef01234567 V2StealerSearchData: type: object properties: items: type: array items: $ref: '#/components/schemas/V2StealerResult' meta: $ref: '#/components/schemas/V2SearchMetadata' next_cursor: type: string victims: type: array items: $ref: '#/components/schemas/V2VictimResult' victims_meta: $ref: '#/components/schemas/V2SearchMetadata' victims_next_cursor: type: string credential_stats: type: object properties: direct_total: type: integer direct_loaded: type: integer linked_total: type: integer linked_loaded: type: integer total: type: integer loaded: type: integer ResponseMeta: type: object description: Metadata included in all API responses properties: user: type: object properties: plan: type: string description: User's plan name example: Pro plan_type: type: string description: Plan type identifier example: pro is_plan_active: type: boolean example: true lookups: type: object properties: used_today: type: integer description: Lookups used today example: 5 left_today: type: integer description: Lookups remaining today example: 995 daily_limit: type: integer description: Daily lookup limit example: 1000 is_unlimited: type: boolean example: false service: type: object properties: name: type: string example: Service Name id: type: string example: service-id category: type: string example: general is_premium: type: boolean example: false is_available: type: boolean example: true session_quota: type: integer example: 10 performance: type: object properties: duration_ms: type: number description: Request duration in milliseconds example: 111.47 timestamp: type: string format: date-time example: '2026-01-06T00:44:08.191547' V2StealerResult: type: object properties: id: type: string log_id: type: string url_str: type: string domain: type: array items: type: string subdomain: type: array items: type: string email_domains: type: array items: type: string path: type: array items: type: string username: type: string password: type: string email: type: array items: type: string log: type: string source_type: type: string password_hash: type: string archive_hash: type: string canonical_credential_id: type: string investigation_labels: type: array items: type: string investigation_link_types: type: array items: type: string is_related_credential: type: boolean pwned_at: type: string format: date-time indexed_at: type: string format: date-time V2SearchMetadata: type: object properties: count: type: integer description: Results in this page total: type: integer description: Total matching results took_ms: type: integer description: Query time in milliseconds has_more: type: boolean total_pages: type: integer max_score: type: number filter_id: $ref: '#/components/schemas/FilterContextId' V2VictimResult: type: object properties: log_id: type: string device_users: type: array items: type: string hwids: type: array items: type: string device_ips: type: array items: type: string device_emails: type: array items: type: string discord_ids: type: array items: type: string total_docs: type: integer pwned_at: type: string format: date-time indexed_at: type: string format: date-time phone_numbers: type: array items: type: string steam_ids: type: array items: type: string steam_names: type: array items: type: string services: type: array items: type: string service_count: type: integer identity_state: type: string device_os: type: string device_country: type: string device_city: type: string infection_path: type: string antivirus: type: array items: type: string domains: type: array items: type: string subdomains: type: array items: type: string email_domains: type: array items: type: string victim_ip: type: string geo_country: type: string geo_city: type: string securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: API key for authentication (lowercase header name) ````