---
updatedAt: 2026-06-03T02:42:17.000Z
agentTools:
projectIndex: https://docs.recordedfuture.com/llms.txt
---
# Detections
Retrieve identity exposure detections with novel-only filtering and malware family attribution.
### What this endpoint does
Retrieves compromised credential exposures discovered across breach dumps and stealer malware logs for specified domains. Detections are categorized as "External" (employee credentials found on third-party websites and services outside the organization) or "Workforce" (credentials for the organization's own login portals and services). Use the `novel_only` filter to restrict results to newly discovered exposures not previously seen. Use the [Identity: Search](https://docs.recordedfuture.com/reference/identity-search) endpoint to find exposures by specific identity attributes, or the [Identity: Lookup](https://docs.recordedfuture.com/reference/identity-lookup) endpoint to retrieve a known detection by ID.
### Response data
Each detection includes the compromised identity (username or email), password hash values and complexity properties, the targeted authorization service (login URL, domain, and technology stack such as VPN or webmail), any stolen browser cookies, the malware family responsible for the theft, and breach source metadata including exfiltration date. Results are paginated via a cursor-based offset token.
# OpenAPI definition
```json
{
"openapi": "3.1.0",
"info": {
"title": "Recorded Future Identity API",
"version": "1.0.0",
"x-rf-service-id": "service:identity",
"description": "API to lookup identity leaks data.
\n[Identity API](https://support.recordedfuture.com/hc/en-us/articles/4402477586707-Identity-API)
\n[Identity Lookup API Response](https://support.recordedfuture.com/hc/en-us/articles/8914757600403-Identity-Lookup-API-Response)
\n[Integrations](https://support.recordedfuture.com/hc/en-us/articles/20552287586067-Identity-Intelligence-Integrations)\n",
"contact": {
"name": "Identity Intelligence",
"email": "identity-team@recordedfuture.com"
}
},
"tags": [
{
"name": "Detections"
}
],
"paths": {
"/identity/detections": {
"post": {
"operationId": "getDetections",
"summary": "Detections",
"description": "Retrieve identity exposure detections with novel-only filtering and malware family attribution.",
"tags": [
"Detections"
],
"security": [
{
"RecordedFutureOAuth2": []
},
{
"RecordedFutureApiKey": []
}
],
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DetectionsRequest"
}
}
}
},
"responses": {
"200": {
"description": "Success",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DetectionsResponse"
},
"example": {
"total": 396118,
"detections": [
{
"id": "51fd9e2c9b580752b15b71f87b5ad707",
"novel": false,
"type": "Workforce",
"source_type": "MalwareLogs",
"subject": "jordan.jordan@norsegods.online",
"password": {
"type": "clear",
"hashes": [
{
"algorithm": "SHA1",
"hash": "1465901e291d3d7e0bb5b49ca30e8f23ecf8101a"
},
{
"algorithm": "SHA256",
"hash": "ca5275502d9ea63318a04f0f04d16c48aef8cbc701ec537794b3177b20dd7bdc"
},
{
"algorithm": "NTLM",
"hash": "aa2a03d64366cb33750ebeae0578bc31"
},
{
"algorithm": "MD5",
"hash": "bd55f770e6676d31e4e5697cf3665c91"
}
],
"properties": [
"Letter",
"Number",
"Symbol",
"UpperCase",
"LowerCase",
"AtLeast12Characters"
],
"cleartext_hint": "wt"
},
"authorization_service": {
"url": "https://norsegods.online/user/account",
"domain": "norsegods.online",
"fqdn": "norsegods.online",
"technology": [],
"protocols": [
"https"
]
},
"cookies": [],
"malware_family": {
"name": "LummaC2",
"id": "nlflWX"
},
"dump": {
"name": "Stealer Malware Logs 2026-06-02",
"source": "s3://rf-id-outbox/malware_logs/raw/2026-06-02/ID-DEMO-MALWARE-LOG-06-02-26/ID-DEMO-MALWARE-LOG-06-02-26/lumma/754749a1c667a771c32e77d0b4295646aa0b54353d92e5ce94173d6843e81f38.zip",
"description": "This credential data was derived from stealer malware logs. These logs are legally obtained through proprietary methods from multiple underground sources. Most data is available within 48 hours after the infection. Refer to exfiltration date for each specific exposure.",
"downloaded": "2026-06-02T15:30:37.000Z",
"compromise": {
"exfiltration_date": "2026-06-02T12:45:00.000Z",
"os": "Windows 10 Pro (10.0.19045) x64",
"os_username": "demo_user_hwattt",
"malware_file": "C:\\Users\\demo_user_hwattt\\Desktop\\Release\\Nеw-Inst[x64].exe",
"timezone": "UTC+02:00",
"computer_name": "DEMO-PC-K3OCF7OT",
"antivirus": [
"Windows Defender"
]
},
"infrastructure": {
"ip": "203.0.113.234"
},
"location": {
"country": {
"name": "Poland",
"displayName": "Poland",
"countryCode": "616",
"alpha2Code": "PL",
"alpha3Code": "POL"
}
}
},
"created": "2026-06-02T15:45:19.173Z"
},
{
"id": "6bfef2aafe63ba8ad9752f29e7fcfbb9",
"novel": false,
"type": "Workforce",
"source_type": "MalwareLogs",
"subject": "aegir.ymirsson@norsegods.online",
"password": {
"type": "clear",
"hashes": [
{
"algorithm": "SHA1",
"hash": "6a17e39be9a5221db7da61e99dd4789f8b1298ee"
},
{
"algorithm": "SHA256",
"hash": "b82d246ebad8fc78379486182ac64721df39ab8d9cf7115f0e3b158ad190d87f"
},
{
"algorithm": "NTLM",
"hash": "0eda17a1607b2e519a7f2baf3884dfc6"
},
{
"algorithm": "MD5",
"hash": "1981967177da4cb9843500633b24d5f7"
}
],
"properties": [
"Letter",
"Number",
"UpperCase",
"LowerCase",
"AtLeast12Characters"
],
"cleartext_hint": "ja"
},
"authorization_service": {
"url": "https://norsegods.online/DesktopWeb/",
"domain": "norsegods.online",
"fqdn": "norsegods.online",
"technology": [
{
"name": "Virtual Desktop",
"id": "Ig409I"
},
{
"name": "Citrix Virtual Apps and Desktops",
"id": "ZNkiC2",
"category": "Ig409I"
}
],
"protocols": [
"https"
]
},
"cookies": [],
"malware_family": {
"name": "Vidar",
"id": "YuDlEm"
},
"dump": {
"name": "Stealer Malware Logs 2026-06-02",
"source": "s3://rf-id-outbox/malware_logs/raw/2026-06-02/ID-DEMO-MALWARE-LOG-06-02-26/ID-DEMO-MALWARE-LOG-06-02-26/vidar/9ab54b58ef4ee748b24892177346667bc9e350c9736f22e38e62585936661c77.zip",
"description": "This credential data was derived from stealer malware logs. These logs are legally obtained through proprietary methods from multiple underground sources. Most data is available within 48 hours after the infection. Refer to exfiltration date for each specific exposure.",
"downloaded": "2026-06-02T15:30:37.000Z",
"compromise": {
"exfiltration_date": "2026-06-02T12:45:00.000Z",
"os": "Windows 10 Enterprise",
"os_username": "demo_user_sxwxml",
"malware_file": "C:\\Users\\demo_user_sxwxml\\AppData\\Local\\Temp\\46109461997\\WXslz2L.exe",
"timezone": "UTC+05:00",
"computer_name": "DEMO-ANNHDOFG",
"antivirus": [
"Windows Defender"
]
},
"infrastructure": {
"ip": "198.51.100.137"
},
"location": {
"country": {
"name": "France",
"displayName": "France",
"countryCode": "250",
"alpha2Code": "FR",
"alpha3Code": "FRA"
}
}
},
"created": "2026-06-02T15:45:19.097Z"
},
{
"id": "7e6ec12affde9ea28efdf081f6012221",
"novel": false,
"type": "External",
"source_type": "MalwareLogs",
"subject": "admin@vpn.app",
"password": {
"type": "clear",
"hashes": [
{
"algorithm": "SHA1",
"hash": "afa727c8efcb763c885bbdcacff50cef5d7de5ba"
},
{
"algorithm": "SHA256",
"hash": "dbdcf1f7d4f71c4360871917befc36ac0b0b5a572d61d899bc6ce07f51943dcd"
},
{
"algorithm": "NTLM",
"hash": "fb2cd17673638d3c5703627f9c239b3a"
},
{
"algorithm": "MD5",
"hash": "9a9f9217610e7cc776db380ceb4f91f2"
}
],
"properties": [
"Letter",
"Number",
"Symbol",
"UpperCase",
"LowerCase",
"AtLeast12Characters"
],
"cleartext_hint": "Jj"
},
"authorization_service": {
"url": "https://norsegods.online/dana/",
"domain": "norsegods.online",
"fqdn": "norsegods.online",
"technology": [
{
"name": "VPN",
"id": "CAfZv"
},
{
"name": "Pulse",
"id": "OJf1gQ",
"category": "CAfZv"
}
],
"protocols": [
"https"
]
},
"cookies": [],
"malware_family": {
"name": "Vidar",
"id": "YuDlEm"
},
"dump": {
"name": "Stealer Malware Logs 2026-06-02",
"source": "s3://rf-id-outbox/malware_logs/raw/2026-06-02/ID-DEMO-MALWARE-LOG-06-02-26/ID-DEMO-MALWARE-LOG-06-02-26/vidar/9ab54b58ef4ee748b24892177346667bc9e350c9736f22e38e62585936661c77.zip",
"description": "This credential data was derived from stealer malware logs. These logs are legally obtained through proprietary methods from multiple underground sources. Most data is available within 48 hours after the infection. Refer to exfiltration date for each specific exposure.",
"downloaded": "2026-06-02T15:30:37.000Z",
"compromise": {
"exfiltration_date": "2026-06-02T12:45:00.000Z",
"os": "Windows 10 Enterprise",
"os_username": "demo_user_sxwxml",
"malware_file": "C:\\Users\\demo_user_sxwxml\\AppData\\Local\\Temp\\46109461997\\WXslz2L.exe",
"timezone": "UTC+05:00",
"computer_name": "DEMO-ANNHDOFG",
"antivirus": [
"Windows Defender"
]
},
"infrastructure": {
"ip": "198.51.100.137"
},
"location": {
"country": {
"name": "France",
"displayName": "France",
"countryCode": "250",
"alpha2Code": "FR",
"alpha3Code": "FRA"
}
}
},
"created": "2026-06-02T15:45:19.097Z"
},
{
"id": "1aa72057baa1c038225ddb648138a822",
"novel": false,
"type": "External",
"source_type": "MalwareLogs",
"subject": "jordan_support@ironclad.co",
"password": {
"type": "clear",
"hashes": [
{
"algorithm": "SHA1",
"hash": "a4226c6c69fba15d0d4267027012a0ed63fc100c"
},
{
"algorithm": "SHA256",
"hash": "901e78868e905990c8f94affc98348408307a032c63d1ed4ef809108f271198e"
},
{
"algorithm": "NTLM",
"hash": "6a8e81827f4af0cf9b6384236d17e843"
},
{
"algorithm": "MD5",
"hash": "669dd9a76ac3b12c976d6e18462b8c3c"
}
],
"properties": [
"Letter",
"Number",
"Symbol",
"UpperCase",
"LowerCase",
"AtLeast12Characters"
],
"cleartext_hint": "O6"
},
"authorization_service": {
"url": "https://norsegods.online/login",
"domain": "norsegods.online",
"fqdn": "norsegods.online",
"technology": [],
"protocols": [
"https"
]
},
"cookies": [],
"malware_family": {
"name": "LummaC2",
"id": "nlflWX"
},
"dump": {
"name": "Stealer Malware Logs 2026-06-02",
"source": "s3://rf-id-outbox/malware_logs/raw/2026-06-02/ID-DEMO-MALWARE-LOG-06-02-26/ID-DEMO-MALWARE-LOG-06-02-26/lumma/754749a1c667a771c32e77d0b4295646aa0b54353d92e5ce94173d6843e81f38.zip",
"description": "This credential data was derived from stealer malware logs. These logs are legally obtained through proprietary methods from multiple underground sources. Most data is available within 48 hours after the infection. Refer to exfiltration date for each specific exposure.",
"downloaded": "2026-06-02T15:30:37.000Z",
"compromise": {
"exfiltration_date": "2026-06-02T12:45:00.000Z",
"os": "Windows 10 Pro (10.0.19045) x64",
"os_username": "demo_user_hwattt",
"malware_file": "C:\\Users\\demo_user_hwattt\\Desktop\\Release\\Nеw-Inst[x64].exe",
"timezone": "UTC+02:00",
"computer_name": "DEMO-PC-K3OCF7OT",
"antivirus": [
"Windows Defender"
]
},
"infrastructure": {
"ip": "203.0.113.234"
},
"location": {
"country": {
"name": "Poland",
"displayName": "Poland",
"countryCode": "616",
"alpha2Code": "PL",
"alpha3Code": "POL"
}
}
},
"created": "2026-06-02T15:45:19.097Z"
},
{
"id": "8fe5827ccd3871571de9ee1ca74a886a",
"novel": false,
"type": "External",
"source_type": "MalwareLogs",
"subject": "svc-sam@oakbridge.com",
"password": {
"type": "clear",
"hashes": [
{
"algorithm": "SHA1",
"hash": "5785a22c3364eb22d4470a4082a634eef9773303"
},
{
"algorithm": "SHA256",
"hash": "ab7d6d2b30193718607897ccc4e3bd267135bad061123b6cd0dcf011d9d413a4"
},
{
"algorithm": "NTLM",
"hash": "44ce9e2e1cdc02379fe12aa46beb7d34"
},
{
"algorithm": "MD5",
"hash": "1e92308d26625c855211f7df87f943c9"
}
],
"properties": [
"Letter",
"Number",
"Symbol",
"UpperCase",
"LowerCase",
"AtLeast16Characters"
],
"cleartext_hint": "$1"
},
"authorization_service": {
"url": "https://norsegods.online/user/account",
"domain": "norsegods.online",
"fqdn": "norsegods.online",
"technology": [],
"protocols": [
"https"
]
},
"cookies": [],
"malware_family": {
"name": "Acreed Stealer",
"id": "6CRpeB"
},
"dump": {
"name": "Stealer Malware Logs 2026-06-02",
"source": "s3://rf-id-outbox/malware_logs/raw/2026-06-02/ID-DEMO-MALWARE-LOG-06-02-26/ID-DEMO-MALWARE-LOG-06-02-26/acreed/ca9da8d35a2552d787960a3015e55265f7f08bbff0922b0209a4ab9c45902657.zip",
"description": "This credential data was derived from stealer malware logs. These logs are legally obtained through proprietary methods from multiple underground sources. Most data is available within 48 hours after the infection. Refer to exfiltration date for each specific exposure.",
"downloaded": "2026-06-02T15:30:37.000Z",
"compromise": {
"exfiltration_date": "2026-06-02T15:30:37.000Z",
"os": "Windows 10",
"os_username": "demo_user_qigmwh",
"computer_name": "DEMO-HZJ5JKS"
},
"infrastructure": {
"ip": "203.0.113.184"
},
"location": {
"country": {
"name": "United Kingdom of Great Britain and Northern Ireland (the)",
"displayName": "United Kingdom of Great Britain and Northern Ireland",
"countryCode": "826",
"alpha2Code": "GB",
"alpha3Code": "GBR"
},
"postal_code": "71751"
}
},
"created": "2026-06-02T15:45:19.097Z"
}
],
"next_offset": "MTc4MDQxNTExOTA5Nw==:MjAyNi0wNi0wMlQxNTozMDozNzoyNjM5NDBhYmY2MWJlMjA4ZjRiNjQ2NTFhZDMxZWZiMQ=="
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"text/plain": {
"schema": {
"$ref": "#/components/schemas/BadRequestResponse"
}
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"text/plain": {
"schema": {
"$ref": "#/components/schemas/UnauthorizedResponse"
}
}
}
},
"403": {
"description": "Forbidden",
"content": {
"text/plain": {
"schema": {
"$ref": "#/components/schemas/ForbiddenResponse"
}
}
}
},
"500": {
"description": "Internal Server Error",
"content": {
"text/plain": {
"schema": {
"$ref": "#/components/schemas/InternalServerErrorResponse"
}
}
}
},
"default": {
"$ref": "#/components/responses/DefaultResponse"
}
}
}
}
},
"components": {
"responses": {
"DefaultResponse": {
"description": "Error",
"content": {
"text/plain": {
"schema": {
"type": "string",
"maxLength": 200,
"pattern": ".+",
"example": "An unexpected error occurred while processing the request."
}
},
"application/json": {
"schema": {
"$ref": "#/components/schemas/ApiError"
}
}
}
}
},
"schemas": {
"ApiError": {
"type": "object",
"properties": {
"status_code": {
"type": "integer",
"format": "int32",
"minimum": 100,
"maximum": 599
},
"message": {
"type": "string",
"maxLength": 200,
"pattern": ".+",
"example": "The provided organization ID does not exist."
},
"trace_id": {
"type": "string",
"maxLength": 36,
"minLength": 36,
"format": "uuid",
"example": "fa1d4940-f35f-4dc1-84d1-de2f27a8b95e"
}
},
"required": [
"status_code",
"message",
"trace_id"
]
},
"DetectionsRequest": {
"type": "object",
"properties": {
"organization_id": {
"type": "array",
"maxItems": 100,
"items": {
"$ref": "#/components/schemas/UhashId"
},
"description": "Organization IDs to scope the detections query"
},
"include_enterprise_level": {
"type": "boolean",
"description": "Include enterprise-level detections across all organizations"
},
"filter": {
"$ref": "#/components/schemas/DetectionsFilter",
"description": "Detection-specific filters"
},
"limit": {
"type": "integer",
"format": "int32",
"minimum": 0,
"maximum": 1000,
"description": "Maximum number of detections to return"
},
"offset": {
"type": "string",
"maxLength": 200,
"pattern": ".+",
"example": "cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U",
"description": "Pagination token for next page"
}
}
},
"DetectionsResponse": {
"type": "object",
"properties": {
"total": {
"type": "integer",
"format": "int32",
"minimum": 0,
"maximum": 1000
},
"detections": {
"type": "array",
"maxItems": 100,
"items": {
"$ref": "#/components/schemas/Detection"
}
},
"next_offset": {
"type": "string",
"maxLength": 200,
"pattern": ".+",
"example": "cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U"
}
},
"required": [
"total",
"detections"
]
},
"DetectionsFilter": {
"type": "object",
"properties": {
"novel_only": {
"type": "boolean"
},
"malware_only": {
"type": "boolean"
},
"domains": {
"type": "array",
"maxItems": 100,
"items": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "example-corp.com"
}
},
"detection_types": {
"type": "array",
"maxItems": 100,
"items": {
"$ref": "#/components/schemas/DetectionType"
}
},
"source_type": {
"type": "array",
"maxItems": 100,
"items": {
"$ref": "#/components/schemas/SourceType"
}
},
"detection_type": {
"$ref": "#/components/schemas/DetectionType"
},
"authorization_technology": {
"$ref": "#/components/schemas/DetectionsAuthTechnologyFilter"
},
"cookies": {
"type": "string",
"enum": [
"Cookies",
"UnexpiredCookies"
]
},
"created": {
"$ref": "#/components/schemas/DetectionsDateFilter"
}
}
},
"DetectionsAuthTechnologyFilter": {
"type": "object",
"properties": {
"any": {
"type": "boolean"
},
"id": {
"type": "array",
"maxItems": 100,
"items": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "tech-okta-sso"
}
},
"name": {
"type": "array",
"maxItems": 100,
"items": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Okta Single Sign-On"
}
}
}
},
"DetectionsDateFilter": {
"type": "object",
"properties": {
"gte": {
"type": "string",
"format": "date-time",
"maxLength": 29,
"example": "2024-07-20T10:00:00Z"
},
"lt": {
"type": "string",
"format": "date-time",
"maxLength": 29,
"example": "2024-07-25T10:00:00Z"
}
}
},
"Detection": {
"type": "object",
"properties": {
"id": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "f47ac10b58cc4372a5670e02b2c3d479"
},
"organization_id": {
"$ref": "#/components/schemas/UhashId"
},
"novel": {
"type": "boolean"
},
"type": {
"$ref": "#/components/schemas/DetectionType"
},
"source_type": {
"$ref": "#/components/schemas/SourceType"
},
"subject": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "john.smith@example-corp.com"
},
"password": {
"$ref": "#/components/schemas/DetectionsLeakedPassword"
},
"authorization_service": {
"$ref": "#/components/schemas/AuthorizationService"
},
"cookies": {
"type": "array",
"maxItems": 100,
"items": {
"$ref": "#/components/schemas/Cookie"
}
},
"malware_family": {
"$ref": "#/components/schemas/MalwareFamily"
},
"dump": {
"$ref": "#/components/schemas/DumpMetadata"
},
"created": {
"type": "string",
"format": "date-time",
"maxLength": 29,
"example": "2025-07-25T09:57:39Z"
}
},
"required": [
"id",
"novel",
"type",
"subject",
"dump",
"created"
]
},
"DetectionsLeakedPassword": {
"type": "object",
"properties": {
"type": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Cleartext"
},
"hashes": {
"type": "array",
"maxItems": 100,
"items": {
"$ref": "#/components/schemas/PasswordHash"
}
},
"properties": {
"type": "array",
"maxItems": 100,
"items": {
"$ref": "#/components/schemas/PasswordProperty"
}
},
"cleartext_hint": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Pass"
},
"cleartext": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Passw0rd123!"
}
},
"required": [
"type",
"hashes",
"properties"
]
},
"DetectionType": {
"type": "string",
"enum": [
"Workforce",
"External",
"Vip"
]
},
"PasswordProperty": {
"type": "string",
"enum": [
"Letter",
"Number",
"Symbol",
"UpperCase",
"LowerCase",
"MixedCase",
"AtLeast8Characters",
"AtLeast10Characters",
"AtLeast12Characters",
"AtLeast16Characters",
"AtLeast24Characters",
"Cookies",
"UnexpiredCookies",
"AuthorizationTechnology",
"MalwareOnly"
]
},
"SourceType": {
"type": "string",
"enum": [
"MalwareLogs",
"DatabaseDumps",
"MalwareCombolists",
"DatabaseCombolists"
]
},
"AuthorizationService": {
"type": "object",
"properties": {
"url": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "https://signin.example-corp.com/login"
},
"domain": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "example-corp.com"
},
"fqdn": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "signin.example-corp.com"
},
"protocols": {
"type": "array",
"maxItems": 100,
"items": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "HTTPS"
}
},
"technology": {
"type": "array",
"maxItems": 100,
"items": {
"$ref": "#/components/schemas/Technology"
}
}
},
"required": [
"url",
"domain",
"fqdn",
"protocols",
"technology"
]
},
"Technology": {
"type": "object",
"properties": {
"id": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "tech-wordpress"
},
"name": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "WordPress"
},
"category": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "CMS"
}
},
"required": [
"name"
]
},
"PasswordHash": {
"oneOf": [
{
"$ref": "#/components/schemas/FullPasswordHash"
},
{
"$ref": "#/components/schemas/PrefixPasswordHash"
}
]
},
"FullPasswordHash": {
"type": "object",
"properties": {
"algorithm": {
"$ref": "#/components/schemas/HashAlgorithm"
},
"hash": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8"
}
},
"required": [
"algorithm",
"hash"
]
},
"PrefixPasswordHash": {
"type": "object",
"properties": {
"algorithm": {
"$ref": "#/components/schemas/HashAlgorithm"
},
"hash_prefix": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "5baa6"
}
},
"required": [
"algorithm",
"hash_prefix"
]
},
"Cookie": {
"type": "object",
"properties": {
"dns": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": ".example.com"
},
"name": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "session_id"
},
"http": {
"type": "boolean"
},
"expiration": {
"type": "string",
"format": "date-time",
"maxLength": 29,
"example": "2025-08-25T09:57:39Z"
},
"secure": {
"type": "boolean"
},
"value": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "3a2d5f8b-9e4c-4a1d-b8f9-c6e7d8f9a0b1"
}
},
"required": [
"dns",
"name",
"http",
"expiration",
"secure"
]
},
"MalwareFamily": {
"type": "object",
"properties": {
"id": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "mal-vidar"
},
"name": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Vidar Stealer"
}
},
"required": [
"id",
"name"
]
},
"DumpMetadata": {
"type": "object",
"properties": {
"name": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Antiscam Log 2024-07-22"
},
"type": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Stealer Log"
},
"source": {
"type": "string",
"maxLength": 200,
"pattern": ".+",
"example": "dump-antiscam-2024-07-22-045"
},
"description": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Log data from Antiscam malware campaign."
},
"infrastructure": {
"$ref": "#/components/schemas/Infrastructure"
},
"compromise": {
"$ref": "#/components/schemas/Compromise"
},
"location": {
"$ref": "#/components/schemas/Location"
},
"breaches": {
"type": "array",
"maxItems": 100,
"items": {
"$ref": "#/components/schemas/BreachMetadata"
}
},
"downloaded": {
"type": "string",
"format": "date-time",
"maxLength": 29,
"example": "2025-07-22T08:00:00Z"
}
},
"required": [
"name",
"source",
"downloaded",
"breaches"
]
},
"Infrastructure": {
"type": "object",
"properties": {
"ip": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "203.0.113.55"
}
},
"required": [
"ip"
]
},
"Compromise": {
"type": "object",
"properties": {
"os": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Windows 11"
},
"os_username": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "victim_user"
},
"malware_file": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "C:\\Windows\\Temp\\update.exe"
},
"timezone": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "(UTC+02:00) Helsinki, Kyiv, Riga, Sofia, Tallinn, Vilnius"
},
"computer_name": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "DESKTOP-A1B2C3D"
},
"uac": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "UAC-Limited"
},
"antivirus": {
"type": "array",
"maxItems": 100,
"items": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Avast"
}
},
"exfiltration_date": {
"type": "string",
"format": "date-time",
"maxLength": 29,
"example": "2025-07-21T12:00:00Z"
}
},
"required": [
"exfiltration_date"
]
},
"Location": {
"type": "object",
"properties": {
"country": {
"$ref": "#/components/schemas/CountryCode"
},
"city": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "New York"
},
"address": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "123 Main Street, Apt 4B"
},
"address1": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "123 Main Street"
},
"address2": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Apt 4B"
},
"state": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "NY"
},
"postal_code": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "10001"
},
"zip": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "10001"
}
}
},
"CountryCode": {
"type": "object",
"properties": {
"name": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "UNITED_STATES"
},
"displayName": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "United States"
},
"countryCode": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "USA"
},
"alpha2Code": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "US"
},
"alpha3Code": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "USA"
}
},
"required": [
"name",
"displayName",
"countryCode",
"alpha2Code",
"alpha3Code"
]
},
"BreachMetadata": {
"type": "object",
"properties": {
"name": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "SocialNet Breach"
},
"domain": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "socialnet.com"
},
"type": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Database Breach"
},
"breached": {
"type": "string",
"format": "date-time",
"maxLength": 29,
"example": "2023-11-01T00:00:00Z"
},
"start": {
"type": "string",
"format": "date-time",
"maxLength": 29,
"example": "2023-10-15T00:00:00Z"
},
"stop": {
"type": "string",
"format": "date-time",
"maxLength": 29,
"example": "2023-10-20T00:00:00Z"
},
"precision": {
"$ref": "#/components/schemas/DateTimePrecision"
},
"description": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "User database with emails and hashed passwords was compromised."
},
"site_description": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Social networking platform."
}
},
"required": [
"name",
"domain",
"type",
"description"
]
},
"HashAlgorithm": {
"type": "string",
"enum": [
"SHA1",
"SHA256",
"HASH32",
"HASH40",
"HASH64",
"HASH96",
"HASH128",
"BCRYPT",
"PHPASS",
"HASHCAT_HEX",
"BASE64",
"SSHA",
"PBKDF2_SHA256",
"BASE64_HASH32",
"BASE64_HASH40",
"BASE64_HASH128",
"BASE64_INTEGER_HASH32",
"BASE64_INTEGER_HASH40",
"BASE64_INTEGER_HASH64",
"BASE64_INTEGER_HASH96",
"BASE64_INTEGER_HASH128",
"MYSQL_SHA_V41PLUS",
"NTLM",
"MD5"
]
},
"DateTimePrecision": {
"type": "string",
"enum": [
"YEAR",
"MONTH",
"DAY"
]
},
"UhashId": {
"type": "string",
"maxLength": 20,
"pattern": "^uhash:[a-zA-Z0-9]+$",
"example": "uhash:a1b2c3d4"
},
"UnauthorizedResponse": {
"type": "string",
"const": "The supplied authentication is invalid"
},
"BadRequestResponse": {
"type": "object",
"properties": {
"message": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Invalid input for 'domains' field."
},
"status_code": {
"type": "integer",
"format": "int32",
"const": 400,
"minimum": 100,
"maximum": 599
},
"trace_id": {
"type": "string",
"format": "uuid",
"maxLength": 36,
"minLength": 36,
"example": "fa1d4940-f35f-4dc1-84d1-de2f27a8b95e"
}
}
},
"ForbiddenResponse": {
"type": "object",
"properties": {
"message": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "Access to the requested resource is forbidden."
},
"status_code": {
"type": "integer",
"format": "int32",
"const": 403,
"minimum": 100,
"maximum": 599
},
"trace_id": {
"type": "string",
"format": "uuid",
"maxLength": 36,
"minLength": 36,
"example": "fa1d4940-f35f-4dc1-84d1-de2f27a8b95e"
}
}
},
"InternalServerErrorResponse": {
"type": "object",
"properties": {
"message": {
"type": "string",
"maxLength": 100,
"pattern": ".+",
"example": "An internal server error occurred."
},
"status_code": {
"type": "integer",
"format": "int32",
"const": 500,
"minimum": 100,
"maximum": 599
},
"trace_id": {
"type": "string",
"format": "uuid",
"maxLength": 36,
"minLength": 36,
"example": "fa1d4940-f35f-4dc1-84d1-de2f27a8b95e"
}
}
}
},
"securitySchemes": {
"RecordedFutureOAuth2": {
"type": "oauth2",
"description": "JWT-based OAuth2 security scheme supporting RFC8725 for OAuth 2.0 Access Tokens.",
"flows": {
"authorizationCode": {
"authorizationUrl": "https://id.recordedfuture.com/authorize",
"tokenUrl": "https://id.recordedfuture.com/token",
"refreshUrl": "https://id.recordedfuture.com/token",
"scopes": {}
}
}
},
"RecordedFutureApiKey": {
"type": "apiKey",
"in": "header",
"name": "X-RFToken"
}
}
},
"servers": [
{
"url": "https://api.recordedfuture.com",
"description": "Recorded Future Production Server",
"x-internal": "false"
}
],
"x-readme": {
"proxy-enabled": true
}
}
```