Recorded Future Identity API

https://docs.recordedfuture.com/reference/identity-lookup
Admin
Recorded Future Identity API enables developers to lookup compromised credentials for specific...
Tokens:1,221
Snippets:4
Trust Score:9.7
Update:5 months ago
Show doc for...
Tokens:
Raw
### Lookup Credentials

Source: https://docs.recordedfuture.com/reference/identity-lookup

Retrieve full exposure history for specific email addresses, usernames, or credential hashes.

```APIDOC
## POST /identity/credentials/lookup

### Description
Retrieve full exposure history for specific email addresses, usernames, or credential hashes.

### Method
POST

### Endpoint
/identity/credentials/lookup

### Request Body
- **credentials** (array) - Required - List of credentials to lookup.
  - **email** (string) - Optional - Email address.
  - **username** (string) - Optional - Username.
  - **hash** (string) - Optional - Credential hash.

### Request Example
{
  "credentials": [
    {
      "email": "test@example.com"
    },
    {
      "username": "testuser"
    },
    {
      "hash": "abcdef1234567890"
    }
  ]
}

### Response
#### Success Response (200)
- **credentials** (array) - List of credential lookup results.
  - **credential** (object) - The credential that was looked up.
    - **email** (string) - Email address.
    - **username** (string) - Username.
    - **hash** (string) - Credential hash.
  - **breaches** (array) - List of breaches associated with the credential.
    - **name** (string) - Name of the breach.
    - **first_downloaded** (string) - The first date when these credentials were received and indexed by Recorded Future.
    - **latest_downloaded** (string) - The latest date when these credentials were received and indexed by Recorded Future.
    - **data_types** (array) - List of data types exposed in the breach.
      - **type** (string) - Type of data exposed.
      - **count** (integer) - Number of occurrences of this data type.

#### Response Example
{
  "credentials": [
    {
      "credential": {
        "email": "test@example.com"
      },
      "breaches": [
        {
          "name": "ExampleBreach",
          "first_downloaded": "2024-01-01T00:00:00Z",
          "latest_downloaded": "2024-01-01T00:00:00Z",
          "data_types": [
            {
              "type": "password",
              "count": 1
            }
          ]
        }
      ]
    }
  ]
}
```

--------------------------------

### Identity Lookup Endpoint

Source: https://docs.recordedfuture.com/reference/identity-lookup

This endpoint allows you to search for leaked identities. You can filter the results using various criteria and paginate through the responses.

```APIDOC
## POST /identity/lookup

### Description
Searches for leaked identities based on provided filter criteria. Supports pagination and limiting results.

### Method
POST

### Endpoint
/identity/lookup

### Parameters
#### Request Body
- **filter** (IdentityRequestFilter) - Required - Filter options for the search. (same as Search)
- **limit** (integer) - Optional - Maximum number of results to return. (0-1000)
- **offset** (string) - Optional - Pagination token from a previous response's next_offset.

### Request Example
```json
{
  "filter": {
    "domain": "example-corp.com"
  },
  "limit": 100,
  "offset": "cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="
}
```

### Response
#### Success Response (200)
- **identities** (array) - An array of LeakedIdentity objects.
- **count** (integer) - The total number of identities found.
- **next_offset** (string) - A token for paginating to the next set of results.

#### Response Example
```json
{
  "identities": [
    {
      "identity": {
        "subjects": [
          "j.doe@example-corp.com"
        ]
      },
      "count": 5,
      "credentials": [
        {
          "subject": "j.doe@example-corp.com",
          "authorization_service": {
            "name": "ExampleAuthService"
          },
          "exposed_secret": {
            "type": "Password",
            "value": "********"
          },
          "cookies": [
            {
              "name": "session_id",
              "value": "abc123xyz789"
            }
          ],
          "malware_family": {
            "name": "Emotet"
          },
          "dumps": [
            {
              "source_type": "DatabaseDumps",
              "source_name": "CustomerDB"
            }
          ],
          "first_downloaded": "2025-07-25T09:30:00Z",
          "latest_downloaded": "2025-07-25T09:30:00Z"
        }
      ]
    }
  ],
  "count": 1,
  "next_offset": "cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="
}
```
```
Tokens:
Raw