Stealer Export

Stealer Export takes a System ID and returns the stealer-log archive behind it, as a .zip file of up to 50 MB. Before it is delivered, Orelys opens the archive and reads its files against data-removal requests: an archive that mentions a removed selector, or one Orelys cannot read in full, is not delivered. To read a single file as text, use UUID Search instead.

When to use it

An Intelligence Search record is a stealer log, and you want the whole archive.
You have a System ID from intelx.io: in the address of a result, or in its Metadata tab under “Show Expert Information”.

Request

POST /v1/search/stealer-export, with a JSON body.

Parameter	Type	Required	What it does
`system_id`	string	Yes	The System ID of the stealer log: a UUID, `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`.

Any other field is refused with 400 invalid_request, and nothing is charged.

curl https://api.orelys.io/v1/search/stealer-export \
  -H "Authorization: Bearer $ORELYS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "system_id": "8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47" }' \
  --max-time 300 \
  -o export.zip

import { writeFile } from "node:fs/promises";

const response = await fetch("https://api.orelys.io/v1/search/stealer-export", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ORELYS_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ system_id: "8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47" }),
  signal: AbortSignal.timeout(300_000),
});

if (!response.ok) {
  const { error } = await response.json();
  throw new Error(`${error.code}: ${error.message}`);
}

await writeFile("export.zip", Buffer.from(await response.arrayBuffer()));
console.log("Requests left today:", response.headers.get("X-Quota-Remaining"));

import os
import requests

response = requests.post(
    "https://api.orelys.io/v1/search/stealer-export",
    headers={"Authorization": f"Bearer {os.environ['ORELYS_API_KEY']}"},
    json={"system_id": "8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47"},
    timeout=300,
)
if not response.ok:
    error = response.json()["error"]
    raise RuntimeError(f"{error['code']}: {error['message']}")

with open("export.zip", "wb") as file:
    file.write(response.content)
print("Requests left today:", response.headers.get("X-Quota-Remaining"))

An export takes longer than a list. The search service has 85 seconds to start answering, then the archive comes through as fast as it can, and the API answers once it has checked the whole archive. Set your HTTP client’s timeout to a few minutes: 300 seconds, as above, is a safe value. A transfer that stops moving for 30 seconds is cut, with 504 source_timeout.

What you get back

The archive, as application/zip, with:

Header	What it is
`Content-Disposition`	`attachment; filename="stealer-export-<system_id>.zip"`.
`X-Request-Charged`	`true` when the export took a request, `false` otherwise.
`X-Quota-Remaining`, `X-Quota-Reset`	Your quota after this export, and its next reset.
`X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`	Your searches a minute.

An archive is never cut: one over 50 MB is refused with 502 response_too_large, and that costs nothing. Errors are JSON, with the usual envelope: check the status before you save the answer.

Stealer logs can hold malware samples. Open archives in an isolated environment, and never run what they contain.

Cost and limits

Case	Requests
An archive delivered	1, from your daily quota.
No archive for this System ID (`404 file_not_found`), or no archive in the search service’s reply (`502 source_error`)	0, within a daily allowance (your daily quota, at least 10). Past it, 1.
The archive mentions a removed selector (`451 file_withheld`)	0, within the same daily allowance.
Orelys cannot check the archive (`451 archive_unchecked`)	0 for the first 10 a day. Past them, within the same daily allowance.
The same archive asked again the same day after a `451`	0: the same `451` at once, and the archive is not asked.
A System ID removed at its owner’s request (`451 file_withheld`)	0: the archive is not asked.
Too many archives being checked (`503 scanner_busy`)	0, or within the daily allowance when another export of yours was being checked.
Connection closed after the export was sent	0, within the same daily allowance.
Invalid input, a limit reached, the search service down, busy or too slow, an archive over 50 MB	0.

Plans: Professional (500 requests a day) and Enterprise (1,500). Both include Stealer Export.
Per account: 60 searches a minute and 3 at the same time on Professional, 120 and 5 on Enterprise, shared with all your other searches. One archive at a time is checked for your account.
Per address: 120 calls a minute, whatever the plan.

See Limits for the details.

Errors

Status	Code	When
`400`	`invalid_request`	`system_id` is missing, or is not a UUID. `details` says which.
`401`	`missing_api_key`, `invalid_api_key`	No key was sent, or it is not a valid one.
`403`	`plan_required`, `account_blocked`	The account is not on Professional or Enterprise, or it is blocked.
`404`	`file_not_found`	No archive matches this System ID.
`429`	`rate_limited`, `concurrency_limited`, `ip_rate_limited`, `quota_exceeded`	A limit is reached. Wait `Retry-After` seconds.
`451`	`file_withheld`	The archive mentions a selector removed at its owner’s request. It is not delivered.
`451`	`archive_unchecked`	The archive cannot be checked: it is encrypted, in a format Orelys cannot open, or too large once unpacked. It is not delivered.
`502`	`response_too_large`	The archive is over 50 MB.
`502`	`source_error`, `source_unreachable`	The search service failed, or did not send an archive. Try again later.
`503`	`scanner_busy`	Too many archives are being checked. Wait `Retry-After` seconds (10).
`503`	`service_unavailable`, `source_busy`	Search is down or busy for a moment.
`503`	`module_maintenance`, `module_offline`	The Orelys team has paused this mode, or all of Intelligence X. Nothing is charged. Under maintenance, wait `Retry-After` seconds.
`504`	`source_timeout`	The search service did not start answering within 85 seconds, or the transfer stopped for 30 seconds.

Tips

Run exports one after the other. Your account has one archive checked at a time: a second export sent meanwhile can answer 503 scanner_busy. Wait for the first, then send the next.
Do not retry a 451. The same archive asked again the same day gets the same answer, at once.
Save the bytes as they are. Read the answer as binary (arrayBuffer, response.content). Decoding it as text corrupts the archive.
Check the status first. An error comes back as JSON, not as a .zip: do not save it under a .zip name.
Need one file only? UUID Search gives a file as text.

Reference

Request and response schemas, every error, and a playground to try it.

Get started

Essentials

Intelligence X

OSINT

Data breaches

Privacy

Stealer Export

When to use it

Request

What you get back

Cost and limits

Errors

Tips

Reference

Stealer Export

​When to use it

​Request

​What you get back

​Cost and limits

​Errors

​Tips

​Reference

Stealer Export

When to use it

Request

What you get back

Cost and limits

Errors

Tips

Reference