What this endpoint does

Submits a bulk data request for compromised full payment card records (card number, expiration, CVV, cardholder name, issuing bank) scoped to your organization. Use queryRange with Elasticsearch date math against timeStampAdded for periodic collection (e.g., "from": "now-1d/d", "to": "now/d"). Set dryRun: true to preview counts without creating a task. When a task is created (201), poll with PFI: Task Status and retrieve results via PFI: Pickup Data. Zero-count queries return 200 with no task.

Response data

Returns 200 with count only (dry run or zero results) or 201 with count and task ID (task created). The dual status code pattern tells you whether there's a task to poll: if you got 201, use the task ID; if 200, there's nothing to download.