Intelligence Search

Intelligence Search takes an email address, a username, a domain or any text, and lists the records of the Intelligence X archive that match it: leaked databases, stealer logs, pastes, documents, darknet pages and more. Each record names a file, with its system_id. Open the file with UUID Search, or a stealer log with Stealer Export. To list the addresses, subdomains or URLs around a domain, use Phonebook instead. To look a username up on live platforms, use the OSINT Username search.

When to use it

You start from a selector, such as an email address, a username or a domain, and want to know where it appears in leaked data.
You want the files that mention it, the newest first, or within a date range.
You need a system_id to open a file with UUID Search or Stealer Export.

Request

POST /v1/search/intelligent, with a JSON body.

Parameter	Type	Required	What it does
`query`	string	Yes	What to search for: an email address, a username, a domain or free text. 200 characters at most.
`max_results`	integer	No	How many records to return, 1 to 1000. A numeric string such as `"50"` works too.
`sort_order`	string	No	`relevance`, `date_asc` or `date_desc`. Case does not matter.
`media_type`	string	No	Restrict the search to one media type. Leave it out for every type. 200 characters at most.
`date_from`	string	No	Earliest date, `YYYY-MM-DD` or `DD/MM/YYYY`. It must be a real date.
`date_to`	string	No	Latest date, in the same formats. Not before `date_from`.

Any other field is refused with 400 invalid_request, and nothing is charged. A field sent as an empty string counts as left out.

curl https://api.orelys.io/v1/search/intelligent \
  -H "Authorization: Bearer $ORELYS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "query": "john@example.com", "max_results": 50, "sort_order": "date_desc", "date_from": "2020-01-01" }' \
  --max-time 120

const response = await fetch("https://api.orelys.io/v1/search/intelligent", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ORELYS_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ query: "john@example.com", max_results: 50, sort_order: "date_desc" }),
  signal: AbortSignal.timeout(120_000),
});

const data = await response.json();
if (!response.ok) throw new Error(`${data.error.code}: ${data.error.message}`);

for (const record of data.results) {
  console.log(record.date, record.bucket, record.name, record.system_id);
}
console.log(`Charged: ${data.charged}, requests left today: ${data.quota.remaining}`);

import os
import requests

response = requests.post(
    "https://api.orelys.io/v1/search/intelligent",
    headers={"Authorization": f"Bearer {os.environ['ORELYS_API_KEY']}"},
    json={"query": "john@example.com", "max_results": 50, "sort_order": "date_desc"},
    timeout=120,
)
data = response.json()
if not response.ok:
    raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")

for record in data["results"]:
    print(record.get("date"), record.get("bucket"), record.get("name"))
print("Requests left today:", data["quota"]["remaining"])

A list usually comes back in 20 to 40 seconds, sometimes closer to a minute. The search service has 85 seconds to start answering; past that, the API answers 504 source_timeout, which costs nothing. Set your HTTP client’s timeout to at least 100 seconds — 120 seconds, as above, is a safe value.

What you get back

{
  "mode": "intelligent",
  "request": {
    "query": "john@example.com",
    "max_results": "50",
    "sort_order": "date_desc",
    "date_from": "01/01/2020"
  },
  "count": 1,
  "results": [
    {
      "name": "combolist_2023_part4.txt",
      "system_id": "8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47",
      "bucket": "leaks.logs",
      "date": "2023-06-14T08:21:05Z",
      "size_bytes": 184320
    }
  ],
  "charged": true,
  "quota": { "limit": 500, "used": 13, "remaining": 487, "resets_at": "2026-09-26T00:00:00.000Z" }
}

Field	What it is
`mode`	`intelligent`.
`request`	Your search as sent to the archive: dates as `DD/MM/YYYY`, choices in lower case, numbers as strings.
`count`	Number of items in `results`.
`results`	The records found. `[]` when there are none.
`charged`	Whether the search took a request. Also in the `X-Request-Charged` header.
`quota`	Your quota after this search: `limit`, `used`, `remaining` and `resets_at`.
`redacted`	Only there when records were left out because they mention a removed selector.
`source`	Only there when the archive sent other facts with the list, such as a `total`, passed on as they are.

Each record usually has:

Field	What it is
`name`	Usually a file name or a URL.
`system_id`	The record’s System ID. Send it to UUID Search or Stealer Export.
`bucket`	The bucket it is stored in, such as `leaks.logs`.
`date`	When it was indexed.
`size_bytes`	Size of the content, in bytes.

Records are passed on as the archive describes them: any field can be missing, and other fields can appear. Build your code to ignore the fields it does not know.

Names and every other field come from leaked data. Show them as text, never as HTML, and do not follow their links automatically.

Cost and limits

Case	Requests
A search that returns records	1, from your daily quota.
A search that completes with an empty list	1, as in the dashboard.
The archive answers “no results”, or refuses the search (`400 rejected`)	0, within a daily allowance (your daily quota, at least 10). Past it, 1.
Connection closed after the search was sent	0, within the same daily allowance.
A search for a removed selector	0: an empty result, and the archive is not asked.
Invalid input, a limit reached, the search service down, busy or too slow	0.

Plans: Professional (500 requests a day) and Enterprise (1,500). Both include all six Intelligence X modes.
Per account: 60 searches a minute and 3 at the same time on Professional, 120 and 5 on Enterprise. They are shared with your OSINT searches and with your dashboard on orelys.io.
Per address: 120 calls a minute, whatever the plan.

See Limits for the details.

Errors

Status	Code	When
`400`	`invalid_request`	A field is missing, unknown or out of range. `details` lists each problem.
`400`	`rejected`	The search service refused the search. Check the values.
`401`	`missing_api_key`, `invalid_api_key`	No key was sent, or it is not a valid one.
`403`	`plan_required`, `account_blocked`	The account is not on Professional or Enterprise, or it is blocked.
`429`	`rate_limited`, `concurrency_limited`, `ip_rate_limited`, `quota_exceeded`	A limit is reached. Wait `Retry-After` seconds.
`502`	`source_error`, `source_unreachable`, `response_too_large`	The search service failed, or the answer is too large. Try again later, or narrow the search.
`503`	`service_unavailable`, `source_busy`	Search is down or busy for a moment.
`503`	`module_maintenance`, `module_offline`	The Orelys team has paused this mode, or all of Intelligence X. Nothing is charged. Under maintenance, wait `Retry-After` seconds.
`504`	`source_timeout`	The search service did not start answering within 85 seconds.

Errors use the usual envelope: { "error": { "code": "…", "message": "…" } }.

Tips

Open a record with its system_id. UUID Search gives the file as text. For a stealer log, Stealer Export gives the whole archive as a .zip. Each one is a search of its own, and takes another request.
Narrow before you widen. sort_order: "date_desc" with date_from brings the recent records first, and max_results keeps the list short.
Widen with Phonebook. For a domain, Phonebook lists the email addresses, subdomains and URLs the archive knows around it.
Do not hang up early. A search you cancel after it was sent is given back only within the daily allowance. Keep the timeout at 120 seconds or more.
Watch your quota in a batch. quota.remaining comes with every answer. 429 quota_exceeded means it is used up until the reset at 02:00, Paris time.

Reference

Request and response schemas, every error, and a playground to try it.

Get started

Essentials

Intelligence X

OSINT

Data breaches

Privacy