Developer reference

Infostealer Logs API

Use the same exposure search from your backend, scripts, or Postman. Paid plans include a bearer key; the data-provider key stays on the server.

Quickstart

Send JSON to the same origin as the application. Replace the placeholder key with the key shown in your account.

curl -X POST https://infostealerlogs.com/api/search \
  -H 'Authorization: Bearer lk_live_...' \
  -H 'Content-Type: application/json' \
  --data '{"query":"example.com","type":"email_domain"}'

Keys are prefixed with lk_live_. Keep them secret: anyone with the key can spend the account quota.

Authentication

Every request uses the Authorization header:

Authorization: Bearer lk_live_...

API keys are issued when a paid plan is active. You can copy or regenerate the key from Account. Keys stop working when the plan expires; they work again after a renewal.

Requests without a valid key return 401. Keys with no active plan return 403 plan_required.

Search

POST /api/search

Returns one page of 25 records. Paid plans can paginate a cached result without spending another search; credit accounts receive page 1 only.

{
  "query": "example.com",
  "type": "email_domain",
  "page": 1
}

type is one of url, email, email_domain, username, password, or ip. domain is accepted as an alias for query.

Response fields include mode, access, canBulk, canPaginate, credits, limits, totalReported, and hits.

{
  "domain": "example.com",
  "mode": "authenticated",
  "access": "plan",
  "canBulk": true,
  "canPaginate": true,
  "page": 1,
  "pageSize": 25,
  "totalReported": 10000,
  "hasNextPage": true,
  "hits": [
    {
      "account": "[email protected]",
      "password": "example",
      "originHost": "portal.example.com",
      "source": "Batch label",
      "postedAt": "2026-10-18T10:00:00.000Z",
      "recordType": "credential"
    }
  ],
  "notice": "Full results. Coverage may be limited and the total does not guarantee unique records."
}

Bulk download

POST /api/search/all returns every record for a query in one response. Paid plans only. It costs one search and is served from the account cache when available.

curl -X POST https://infostealerlogs.com/api/search/all \
  -H 'Authorization: Bearer lk_live_...' \
  -H 'Content-Type: application/json' \
  --data '{"query":"example.com","type":"email_domain"}'

Account and quota

GET /api/me returns the plan, daily usage, remaining searches, and reset time. It does not consume a search.

curl https://infostealerlogs.com/api/me \
  -H 'Authorization: Bearer lk_live_...'

Search types

Type	Example	Notes
email_domain	example.com	Bare domain, no protocol or path.
email	[email protected]	Normalized to lowercase.
url	https://example.com/login	HTTP or HTTPS.
username	analyst	Up to 64 characters.
password	example	Up to 128 characters; results may still be masked.
ip	203.0.113.10	IPv4 or IPv6.

Errors and limits

Errors use a JSON envelope:

{ "error": { "code": "daily_limit", "message": "...", "retryAfterSeconds": 3600 } }

400 invalid search type, query, or page.
401 missing or invalid API key.
402 no credits left.
403 plan required, expired, or pagination/bulk outside the plan.
415 body is not JSON.
429 daily quota or local rate limit; honor retryAfterSeconds.

Daily quotas reset at 00:00 UTC. Paid-plan requests use the priority lane; credit requests are serialized.