Skip to content

Commit 2bca7d2

Browse files
author
Mariano Martin
committed
add documentation for credentials global search api
1 parent 356dace commit 2bca7d2

File tree

6 files changed

+179
-163
lines changed

6 files changed

+179
-163
lines changed

‎docs/api-reference/astp/endpoints/post-credentials-search.mdx‎

Lines changed: 4 additions & 156 deletions
Original file line numberDiff line numberDiff line change
@@ -5,167 +5,15 @@ authMethod: "bearer"
55
---
66

77
import GatedAccessFeatureAstp from '/snippets/gated-access-feature-astp.mdx';
8+
import CrendentialSearchCommon from '/snippets/endpoint-credential-search-common.mdx';
9+
import CrendentialSearchDescription from '/snippets/endpoint-credential-search-description.mdx';
810

911
<GatedAccessFeatureAstp />
10-
11-
Returns a list of credentials matching the query provided.
12-
13-
<ResponseExample>
14-
15-
```json Response Example
16-
{
17-
"items": [
18-
{
19-
"domain": "scatterholt.com",
20-
"hash": "B@dPassw0rd",
21-
"hash_type": null,
22-
"id": 33880703907,
23-
"identity_name": "ryan.howard@scatterholt.com",
24-
"imported_at": "2024-07-22T19:25:52.893439+00:00",
25-
"known_password_id": null,
26-
"source": {
27-
"breached_at": null,
28-
"description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
29-
"description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
30-
"id": "combolists",
31-
"is_alert_enabled": true,
32-
"leaked_at": null,
33-
"name": "Combolists"
34-
},
35-
"source_id": "combolists"
36-
},
37-
{
38-
"domain": "scatterholt.com",
39-
"hash": "1qaz2wsx",
40-
"hash_type": "unknown",
41-
"id": 33880703906,
42-
"identity_name": "ryan.howard@scatterholt.com",
43-
"imported_at": "2024-07-22T19:25:52.893439+00:00",
44-
"known_password_id": null,
45-
"source": {
46-
"breached_at": null,
47-
"description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
48-
"description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
49-
"id": "combolists",
50-
"is_alert_enabled": true,
51-
"leaked_at": null,
52-
"name": "Combolists"
53-
},
54-
"source_id": "combolists"
55-
}
56-
],
57-
"next": "WyJjb20uc2NhdHRlcmhvbHQiLCAxNjczNjg4ODg4NV0"
58-
}
59-
```
60-
61-
</ResponseExample>
62-
63-
## Paging
64-
65-
This endpoint supports the
66-
[Flare standard paging pattern <Icon icon="book" size={16} />](/concepts/paging).
12+
<CrendentialSearchDescription/>
6713

6814
## Guides
6915

7016
See the guide for using this endpoint:
7117
[Exporting a Domain's Credentials <Icon icon="book" size={16} />](/guides/credentials-export-domain).
7218

73-
## Body Parameters
74-
75-
<ParamField body="size" type="number">
76-
Maximum size of the JSON object that will be returned (maximum 10 000)
77-
</ParamField>
78-
79-
<ParamField body="from" type="string">
80-
The `next` value from the last response.
81-
</ParamField>
82-
83-
<ParamField body="order" type="string" default="desc">
84-
The order in which the results will be returned. (`asc` or `desc`)
85-
</ParamField>
86-
87-
<ParamField body="query" type="object">
88-
One of the supported queries.
89-
<Tabs>
90-
91-
<Tab title="Domain Query">
92-
```json
93-
{
94-
"type": "domain",
95-
"fqdn": "<string>"
96-
}
97-
```
98-
</Tab>
99-
100-
<Tab title="Auth Domain Query" >
101-
This query will match the domain of the service that this credential might have been used to log in to.
102-
```json
103-
{
104-
"type": "auth_domain",
105-
"fqdn": "<string>"
106-
}
107-
```
108-
</Tab>
109-
110-
<Tab title="Password Query">
111-
```json
112-
{
113-
"type": "secret",
114-
"secret": "<string>"
115-
}
116-
```
117-
</Tab>
118-
119-
<Tab title="Email Query">
120-
```json
121-
{
122-
"type": "email",
123-
"email": "<string>"
124-
}
125-
```
126-
</Tab>
127-
128-
<Tab title="Keyword Query" >
129-
This query will match with the credential's username, which is the portion of the `identity_name` that preceeds `@`.
130-
```json
131-
{
132-
"type": "keyword",
133-
"keyword": "<string>"
134-
}
135-
```
136-
</Tab>
137-
138-
</Tabs>
139-
</ParamField>
140-
141-
<ParamField body="filters" type="object">
142-
<Expandable defaultOpen>
143-
<ParamField body="imported_at" type="object">
144-
<Note>
145-
This filter only works for Auth Domain Queries. It will be ignored if used with other query types.
146-
</Note>
147-
148-
<Expandable>
149-
<ParamField
150-
body="gte"
151-
type="string"
152-
placeholder="Example: 2024-01-01T00:00:00+00:00"
153-
>
154-
Matches values greater than or equal to the specified timestamp.
155-
156-
Format: ISO-8601
157-
</ParamField>
158-
159-
<ParamField
160-
body="lte"
161-
type="string"
162-
placeholder="Example: 2024-01-01T00:00:00+00:00"
163-
>
164-
Matches values lesser than or equal to the specified timestamp.
165-
166-
Format: ISO-8601
167-
</ParamField>
168-
</Expandable>
169-
</ParamField>
170-
</Expandable>
171-
</ParamField>
19+
<CrendentialSearchCommon />

‎docs/api-reference/v4/endpoints/credentials-global-search.mdx‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: "Search Credentials"
3+
api: "POST https://api.flare.io/firework/v4/credentials/_search"
4+
---
5+
6+
import CrendentialSearchCommon from '/snippets/endpoint-credential-search-common.mdx';
7+
import GlobalSearchApiQuotaNote from '/snippets/global-search-api-quota-note.mdx';
8+
import CrendentialSearchDescription from '/snippets/endpoint-credential-search-description.mdx';
9+
10+
<GlobalSearchApiQuotaNote />
11+
<CrendentialSearchDescription />
12+
<CrendentialSearchCommon />

‎docs/api-reference/v4/endpoints/global-search.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: "Search"
2+
title: "Search Events"
33
api: "POST https://api.flare.io/firework/v4/events/global/_search"
44
authMethod: "bearer"
55
---

‎docs/docs.json‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -91,15 +91,16 @@
9191
"api-reference/v4/endpoints/identifier-feed",
9292
"api-reference/v4/endpoints/identifier-group-feed"
9393
]
94-
},
95-
{
96-
"group": "Global Search",
97-
"pages": [
98-
"api-reference/v4/endpoints/global-search"
99-
]
10094
}
10195
]
10296
},
97+
{
98+
"group": "Global Search API",
99+
"pages": [
100+
"api-reference/v4/endpoints/global-search",
101+
"api-reference/v4/endpoints/credentials-global-search"
102+
]
103+
},
103104
{
104105
"group": "Account and Session Takeover Prevention (ASTP) API",
105106
"pages": [

‎docs/snippets/endpoint-credential-search-common.mdx‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
<ResponseExample>
2+
3+
```json Response Example
4+
{
5+
"items": [
6+
{
7+
"domain": "scatterholt.com",
8+
"hash": "B@dPassw0rd",
9+
"hash_type": null,
10+
"id": 33880703907,
11+
"identity_name": "ryan.howard@scatterholt.com",
12+
"imported_at": "2024-07-22T19:25:52.893439+00:00",
13+
"known_password_id": null,
14+
"source": {
15+
"breached_at": null,
16+
"description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
17+
"description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
18+
"id": "combolists",
19+
"is_alert_enabled": true,
20+
"leaked_at": null,
21+
"name": "Combolists"
22+
},
23+
"source_id": "combolists"
24+
},
25+
{
26+
"domain": "scatterholt.com",
27+
"hash": "1qaz2wsx",
28+
"hash_type": "unknown",
29+
"id": 33880703906,
30+
"identity_name": "ryan.howard@scatterholt.com",
31+
"imported_at": "2024-07-22T19:25:52.893439+00:00",
32+
"known_password_id": null,
33+
"source": {
34+
"breached_at": null,
35+
"description_en": "Collection of multiple combo lists (emails and passwords) exchanged on illicit networks.",
36+
"description_fr": "Collection de multiples listes \"combos\" (adresses courriel et mots de passe) \u00e9chang\u00e9es sur des r\u00e9seaux illicites.",
37+
"id": "combolists",
38+
"is_alert_enabled": true,
39+
"leaked_at": null,
40+
"name": "Combolists"
41+
},
42+
"source_id": "combolists"
43+
}
44+
],
45+
"next": "WyJjb20uc2NhdHRlcmhvbHQiLCAxNjczNjg4ODg4NV0"
46+
}
47+
```
48+
49+
</ResponseExample>
50+
51+
## Paging
52+
53+
This endpoint supports the
54+
[Flare standard paging pattern <Icon icon="book" size={16} />](/concepts/paging).
55+
56+
## Body Parameters
57+
58+
<ParamField body="size" type="number">
59+
Maximum size of the JSON object that will be returned (maximum 10 000)
60+
</ParamField>
61+
62+
<ParamField body="from" type="string">
63+
The `next` value from the last response.
64+
</ParamField>
65+
66+
<ParamField body="order" type="string" default="desc">
67+
The order in which the results will be returned. (`asc` or `desc`)
68+
</ParamField>
69+
70+
<ParamField body="query" type="object">
71+
One of the supported queries.
72+
<Tabs>
73+
74+
<Tab title="Domain Query">
75+
```json
76+
{
77+
"type": "domain",
78+
"fqdn": "<string>"
79+
}
80+
```
81+
</Tab>
82+
83+
<Tab title="Auth Domain Query" >
84+
This query will match the domain of the service that this credential might have been used to log in to.
85+
```json
86+
{
87+
"type": "auth_domain",
88+
"fqdn": "<string>"
89+
}
90+
```
91+
</Tab>
92+
93+
<Tab title="Password Query">
94+
```json
95+
{
96+
"type": "secret",
97+
"secret": "<string>"
98+
}
99+
```
100+
</Tab>
101+
102+
<Tab title="Email Query">
103+
```json
104+
{
105+
"type": "email",
106+
"email": "<string>"
107+
}
108+
```
109+
</Tab>
110+
111+
<Tab title="Keyword Query" >
112+
This query will match with the credential's username, which is the portion of the `identity_name` that preceeds `@`.
113+
```json
114+
{
115+
"type": "keyword",
116+
"keyword": "<string>"
117+
}
118+
```
119+
</Tab>
120+
121+
</Tabs>
122+
</ParamField>
123+
124+
<ParamField body="filters" type="object">
125+
<Expandable defaultOpen>
126+
<ParamField body="imported_at" type="object">
127+
<Note>
128+
This filter only works for Auth Domain Queries. It will be ignored if used with other query types.
129+
</Note>
130+
131+
<Expandable>
132+
<ParamField
133+
body="gte"
134+
type="string"
135+
placeholder="Example: 2024-01-01T00:00:00+00:00"
136+
>
137+
Matches values greater than or equal to the specified timestamp.
138+
139+
Format: ISO-8601
140+
</ParamField>
141+
142+
<ParamField
143+
body="lte"
144+
type="string"
145+
placeholder="Example: 2024-01-01T00:00:00+00:00"
146+
>
147+
Matches values lesser than or equal to the specified timestamp.
148+
149+
Format: ISO-8601
150+
</ParamField>
151+
</Expandable>
152+
</ParamField>
153+
</Expandable>
154+
</ParamField>

‎docs/snippets/endpoint-credential-search-description.mdx‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Returns a list of credentials matching the query provided.

0 commit comments

Comments
 (0)