> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oathnet.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Victim Workflows Guide

> Understand victim summaries, manifests, file retrieval, and archive downloads

## Overview

Victim workflows start after you have a `log_id` from stealer search,
investigation search, file metadata, or a saved result. The victim APIs help you
move from "this log exists" to "what is inside this log?"

There are three response styles to keep straight:

* victim search returns the standard `success`, `message`, `data`, and `_meta` envelope
* manifests return raw JSON because they are file trees, not search result pages
* file reads and archive downloads return raw text, bytes, or ZIP streams

## Search Victim Summaries

Victim search returns aggregated metadata that helps you decide which logs to inspect next.

<CodeGroup>
  ```bash cURL theme={null}
  curl -G "https://oathnet.org/api/service/v2/victims/search" \
    -H "x-api-key: YOUR_API_KEY" \
    --data-urlencode "q=user@example.com" \
    --data-urlencode "total_docs_min=10"
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      "https://oathnet.org/api/service/v2/victims/search",
      params={
          "q": "user@example.com",
          "total_docs_min": 10,
      },
      headers={"x-api-key": "YOUR_API_KEY"},
  )

  payload = response.json()
  for victim in payload["data"]["items"]:
      print(victim["log_id"], victim.get("device_user_str"), victim.get("total_docs"))
  ```
</CodeGroup>

```json Response Example theme={null}
{
  "success": true,
  "message": "Victims search completed",
  "data": {
    "items": [
      {
        "log_id": "vic_002_gamer_dragonslayer",
        "device_user_str": ["xX_DragonSlayer_Xx", "Tyler"],
        "hwids_str": ["GAMER-PC-HWID-9999"],
        "device_ips": ["73.45.123.89"],
        "device_emails_str": ["progamer2024@gmail.com"],
        "discord_ids": ["396488966779392318"],
        "total_docs": 54,
        "pwned_at": "2024-03-15T10:30:00Z",
        "indexed_at": "2024-11-24T12:00:00Z"
      }
    ],
    "meta": {
      "count": 1,
      "total": 1,
      "took_ms": 10,
      "has_more": false,
      "total_pages": 1
    },
    "next_cursor": null
  },
  "_meta": {
    "lookups": {
      "left_today": 9990
    }
  }
}
```

Victim search supports the same structured `filter` and `filter_id` system as the other V2 search endpoints. See [Structured Filters](/guides/structured-filters) for the operator matrix and the victims-specific field aliases.

## Get The Manifest

The manifest endpoint is different: it returns raw JSON with `log_id`, optional `log_name`, and `victim_tree`. There is no `{success, data}` wrapper.
If the log came from a search session, pass the same `search_id` so the follow-up request stays attached to that investigation.

```bash theme={null}
curl -G "https://oathnet.org/api/service/v2/victims/vic_002_gamer_dragonslayer" \
  --data-urlencode "search_id=sess_0123456789abcdef" \
  -H "x-api-key: YOUR_API_KEY"
```

```json theme={null}
{
  "log_id": "vic_002_gamer_dragonslayer",
  "log_name": "xX_DragonSlayer_Xx",
  "victim_tree": {
    "id": "root",
    "name": "StealerLog",
    "type": "directory",
    "children": [
      {
        "id": "creds_passwords",
        "name": "passwords.txt",
        "type": "file",
        "size_bytes": 4521
      }
    ]
  }
}
```

## Get A File

`GET /service/v2/victims/{log_id}/files/{file_id}` returns the file itself. For text files, read `.text`. For binary files, read bytes.
Always URL-encode `log_id` and `file_id` if they contain slashes, spaces, or path-like names from the manifest.

```python theme={null}
import requests

response = requests.get(
    "https://oathnet.org/api/service/v2/victims/vic_002_gamer_dragonslayer/files/creds_passwords",
    params={"search_id": "sess_0123456789abcdef"},
    headers={"x-api-key": "YOUR_API_KEY"},
)

print(response.text)
```

## Download The Archive

`GET /service/v2/victims/{log_id}/archive` streams a ZIP archive. Treat it as a download, not JSON.

```bash theme={null}
curl -G "https://oathnet.org/api/service/v2/victims/vic_002_gamer_dragonslayer/archive" \
  --data-urlencode "search_id=sess_0123456789abcdef" \
  -H "x-api-key: YOUR_API_KEY" \
  -o victim_archive.zip
```

<CardGroup cols={2}>
  <Card title="Stealer Search" icon="search" href="/guides/stealer-search">
    Find credential rows that include `log_id`
  </Card>

  <Card title="File Search" icon="file-search" href="/guides/file-search">
    Search inside selected logs before downloading files
  </Card>

  <Card title="Exports" icon="download" href="/guides/exports">
    Export larger result sets after a search workflow
  </Card>

  <Card title="API Reference" icon="code" href="/api-reference/overview">
    Use OpenAPI for exact paths, parameters, schemas, and stream responses
  </Card>
</CardGroup>