Stealer Export
curl --request POST \
--url https://api.orelys.io/v1/search/stealer-export \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"system_id": "8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47"
}
'import requests
url = "https://api.orelys.io/v1/search/stealer-export"
payload = { "system_id": "8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({system_id: '8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47'})
};
fetch('https://api.orelys.io/v1/search/stealer-export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));"<string>"{
"error": {
"code": "invalid_request",
"message": "The request has invalid fields.",
"details": [
"Max results must be a whole number between 1 and 1000.",
"Sort must be one of: relevance, date_asc, date_desc."
]
}
}{
"error": {
"code": "invalid_api_key",
"message": "This API key is not valid. It may have been regenerated or revoked."
}
}{
"error": {
"code": "plan_required",
"message": "API access comes with the Professional and Enterprise plans. This account is on Starter."
}
}{
"error": {
"code": "file_not_found",
"message": "No file matches this identifier."
}
}{
"error": {
"code": "payload_too_large",
"message": "The request body is larger than 16 KB."
}
}{
"error": {
"code": "unsupported_media_type",
"message": "Send the body as JSON with `Content-Type: application/json`."
}
}{
"error": {
"code": "rate_limited",
"message": "An account on the Professional plan can make at most 60 searches a minute."
}
}{
"error": {
"code": "file_withheld",
"message": "This file mentions a selector removed at its owner's request (orelys.io/data-removal), so it is not delivered."
}
}{
"error": {
"code": "source_error",
"message": "The search service returned an error."
}
}{
"error": {
"code": "service_unavailable",
"message": "Search is temporarily unavailable."
}
}{
"error": {
"code": "source_timeout",
"message": "The search service did not answer within 30 seconds."
}
}Search
Stealer Export
The stealer-log archive of a System ID, as a .zip file of up to 50 MB. The archive is opened and checked against data-removal requests before it is delivered.
POST
/
v1
/
search
/
stealer-export
Stealer Export
curl --request POST \
--url https://api.orelys.io/v1/search/stealer-export \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"system_id": "8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47"
}
'import requests
url = "https://api.orelys.io/v1/search/stealer-export"
payload = { "system_id": "8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({system_id: '8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47'})
};
fetch('https://api.orelys.io/v1/search/stealer-export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));"<string>"{
"error": {
"code": "invalid_request",
"message": "The request has invalid fields.",
"details": [
"Max results must be a whole number between 1 and 1000.",
"Sort must be one of: relevance, date_asc, date_desc."
]
}
}{
"error": {
"code": "invalid_api_key",
"message": "This API key is not valid. It may have been regenerated or revoked."
}
}{
"error": {
"code": "plan_required",
"message": "API access comes with the Professional and Enterprise plans. This account is on Starter."
}
}{
"error": {
"code": "file_not_found",
"message": "No file matches this identifier."
}
}{
"error": {
"code": "payload_too_large",
"message": "The request body is larger than 16 KB."
}
}{
"error": {
"code": "unsupported_media_type",
"message": "Send the body as JSON with `Content-Type: application/json`."
}
}{
"error": {
"code": "rate_limited",
"message": "An account on the Professional plan can make at most 60 searches a minute."
}
}{
"error": {
"code": "file_withheld",
"message": "This file mentions a selector removed at its owner's request (orelys.io/data-removal), so it is not delivered."
}
}{
"error": {
"code": "source_error",
"message": "The search service returned an error."
}
}{
"error": {
"code": "service_unavailable",
"message": "Search is temporarily unavailable."
}
}{
"error": {
"code": "source_timeout",
"message": "The search service did not answer within 30 seconds."
}
}The answer is a
.zip. Save it as a file:
curl https://api.orelys.io/v1/search/stealer-export \
-H "Authorization: Bearer $ORELYS_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "system_id": "8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47" }' \
-o export.zip
Stealer logs can hold malware samples. Open archives in an isolated environment.
Authorizations
Your API key, from https://orelys.io/account/api. It starts with orl_ (keys made before the rename start with fly_ and keep working). X-API-Key: <key> works too. A key in the URL is refused.
Body
application/json
A System ID, xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx — the system_id of an Intelligence Search record.
Pattern:
^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$Example:
"8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47"
Response
The archive.
The response is of type file.

