curl --request POST \
--url https://api.orelys.io/v1/search/intelligent \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"query": "john@example.com"
}
'import requests
url = "https://api.orelys.io/v1/search/intelligent"
payload = { "query": "john@example.com" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({query: 'john@example.com'})
};
fetch('https://api.orelys.io/v1/search/intelligent', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"mode": "intelligent",
"request": {
"query": "john@example.com",
"max_results": "50",
"sort_order": "date_desc",
"date_from": "01/01/2020",
"date_to": "31/12/2024"
},
"count": 1,
"results": [
{
"name": "combolist_2023_part4.txt",
"system_id": "8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47",
"bucket": "leaks.logs",
"date": "2023-06-14T08:21:05Z",
"size_bytes": 184320
}
],
"charged": true,
"quota": {
"limit": 500,
"used": 13,
"remaining": 487,
"resets_at": "2026-09-26T00:00:00.000Z"
}
}{
"error": {
"code": "invalid_request",
"message": "The request has invalid fields.",
"details": [
"Max results must be a whole number between 1 and 1000.",
"Sort must be one of: relevance, date_asc, date_desc."
]
}
}{
"error": {
"code": "invalid_api_key",
"message": "This API key is not valid. It may have been regenerated or revoked."
}
}{
"error": {
"code": "plan_required",
"message": "API access comes with the Professional and Enterprise plans. This account is on Starter."
}
}{
"error": {
"code": "payload_too_large",
"message": "The request body is larger than 16 KB."
}
}{
"error": {
"code": "unsupported_media_type",
"message": "Send the body as JSON with `Content-Type: application/json`."
}
}{
"error": {
"code": "rate_limited",
"message": "An account on the Professional plan can make at most 60 searches a minute."
}
}{
"error": {
"code": "source_error",
"message": "The search service returned an error."
}
}{
"error": {
"code": "service_unavailable",
"message": "Search is temporarily unavailable."
}
}{
"error": {
"code": "source_timeout",
"message": "The search service did not answer within 30 seconds."
}
}Intelligence Search
Search the archive by email address, username, domain or free text, with optional date and sort filters. Returns a list of records; a record’s system_id opens its content with UUID Search or Stealer Export.
curl --request POST \
--url https://api.orelys.io/v1/search/intelligent \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"query": "john@example.com"
}
'import requests
url = "https://api.orelys.io/v1/search/intelligent"
payload = { "query": "john@example.com" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({query: 'john@example.com'})
};
fetch('https://api.orelys.io/v1/search/intelligent', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"mode": "intelligent",
"request": {
"query": "john@example.com",
"max_results": "50",
"sort_order": "date_desc",
"date_from": "01/01/2020",
"date_to": "31/12/2024"
},
"count": 1,
"results": [
{
"name": "combolist_2023_part4.txt",
"system_id": "8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47",
"bucket": "leaks.logs",
"date": "2023-06-14T08:21:05Z",
"size_bytes": 184320
}
],
"charged": true,
"quota": {
"limit": 500,
"used": 13,
"remaining": 487,
"resets_at": "2026-09-26T00:00:00.000Z"
}
}{
"error": {
"code": "invalid_request",
"message": "The request has invalid fields.",
"details": [
"Max results must be a whole number between 1 and 1000.",
"Sort must be one of: relevance, date_asc, date_desc."
]
}
}{
"error": {
"code": "invalid_api_key",
"message": "This API key is not valid. It may have been regenerated or revoked."
}
}{
"error": {
"code": "plan_required",
"message": "API access comes with the Professional and Enterprise plans. This account is on Starter."
}
}{
"error": {
"code": "payload_too_large",
"message": "The request body is larger than 16 KB."
}
}{
"error": {
"code": "unsupported_media_type",
"message": "Send the body as JSON with `Content-Type: application/json`."
}
}{
"error": {
"code": "rate_limited",
"message": "An account on the Professional plan can make at most 60 searches a minute."
}
}{
"error": {
"code": "source_error",
"message": "The search service returned an error."
}
}{
"error": {
"code": "service_unavailable",
"message": "Search is temporarily unavailable."
}
}{
"error": {
"code": "source_timeout",
"message": "The search service did not answer within 30 seconds."
}
}YYYY-MM-DD or DD/MM/YYYY. Open a record with UUID Search or Stealer Export, using its system_id.
name and the other fields come from leaked data. Treat them as untrusted text: never render them as HTML or follow their links automatically.Authorizations
Your API key, from https://orelys.io/account/api. It starts with orl_ (keys made before the rename start with fly_ and keep working). X-API-Key: <key> works too. A key in the URL is refused.
Body
An email address, a username, a domain or free text.
1 - 200"john@example.com"
How many records to return, 1 to 1000. A numeric string is accepted too.
1 <= x <= 100050
Restrict the search to one media type. Leave it out for every type.
200Order of the records. Case does not matter.
relevance, date_asc, date_desc "relevance"
Earliest date, YYYY-MM-DD or DD/MM/YYYY.
"2020-01-01"
Latest date, YYYY-MM-DD or DD/MM/YYYY. Not before date_from.
"2024-12-31"
Response
The records found. charged tells whether the search took a request.
intelligent, phonebook, identity-portal, uuid, storage, stealer-export The search as sent to the archive, after normalisation: dates as DD/MM/YYYY, choices in lower case, numbers as strings.
Show child attributes
Show child attributes
Number of items in results.
Show child attributes
Show child attributes
Whether this search took 1 request from the daily quota. When the archive answers "no results", nothing is charged, within a daily allowance (your daily quota, at least 10); a search that completes with an empty list is charged, as in the dashboard.
Today's quota. It resets every day at 02:00 Paris time.
Show child attributes
Show child attributes
Only present when records were removed because they contain a removed selector.
Other fields the archive sent next to the list (a total, for example), passed through unchanged.

