Storage ID Search

Storage ID Search takes a Storage ID, 128 or 129 hexadecimal characters, and the bucket the file lives in, and returns the file as plain text, not JSON. It reads the same files as UUID Search, by another key. A Storage ID only works with the right bucket. With a System ID, use UUID Search instead: it needs no bucket.

When to use it

You have a file’s Storage ID and its bucket, for example from intelx.io.
UUID Search answered 404 file_not_found for a System ID, and you have the same file’s Storage ID and bucket.

Where to find a Storage ID

On intelx.io, open the record and unfold Expert Information in its details: the Storage ID is there, 128 or 129 hexadecimal characters. The bucket is the record’s category, such as leaks.logs or pastes. An Intelligence Search record gives its bucket in bucket. A record with an empty Storage ID is not stored as a file: only its System ID, with UUID Search, can fetch anything.

Request

POST /v1/search/storage, with a JSON body.

Parameter	Type	Required	What it does
`storage_id`	string	Yes	The Storage ID: 128 or 129 hexadecimal characters.
`bucket`	string	Yes	The bucket the file lives in: one of the twelve from `GET /v1/buckets`, such as `leaks.logs`, or the `bucket` of a record as it is, such as `leaks.private.comb`. Lowercase letters and digits, in parts separated by dots, 100 characters at most.

Any other field is refused with 400 invalid_request, and nothing is charged.

curl https://api.orelys.io/v1/search/storage \
  -H "Authorization: Bearer $ORELYS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "storage_id": "a3f1c9e07b2d48f6a3f1c9e07b2d48f6a3f1c9e07b2d48f6a3f1c9e07b2d48f6a3f1c9e07b2d48f6a3f1c9e07b2d48f6a3f1c9e07b2d48f6a3f1c9e07b2d48f6", "bucket": "leaks.logs" }' \
  --max-time 300 \
  -o file.txt

import { writeFile } from "node:fs/promises";

const storageId = "a3f1c9e07b2d48f6".repeat(8);

const response = await fetch("https://api.orelys.io/v1/search/storage", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ORELYS_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ storage_id: storageId, bucket: "leaks.logs" }),
  signal: AbortSignal.timeout(300_000),
});

if (!response.ok) {
  const { error } = await response.json();
  throw new Error(`${error.code}: ${error.message}`);
}

await writeFile("file.txt", await response.text());
if (response.headers.get("X-Orelys-Truncated") === "true") console.warn("The file was cut at 32 MB.");
console.log("Requests left today:", response.headers.get("X-Quota-Remaining"));

import os
import requests

storage_id = "a3f1c9e07b2d48f6" * 8

response = requests.post(
    "https://api.orelys.io/v1/search/storage",
    headers={"Authorization": f"Bearer {os.environ['ORELYS_API_KEY']}"},
    json={"storage_id": storage_id, "bucket": "leaks.logs"},
    timeout=300,
)
if not response.ok:
    error = response.json()["error"]
    raise RuntimeError(f"{error['code']}: {error['message']}")

with open("file.txt", "wb") as file:
    file.write(response.content)
print("Requests left today:", response.headers.get("X-Quota-Remaining"))

A file takes longer than a list. The search service has 85 seconds to start answering, then the file comes through as fast as it can: a large one can take a minute or more. The API answers once it holds the whole file, because it reads it against data-removal requests first. Set your HTTP client’s timeout to a few minutes: 300 seconds, as above, is a safe value. A transfer that stops moving for 30 seconds is cut, with 504 source_timeout.

What you get back

The file itself, as text/plain; charset=utf-8:

https://accounts.example.com/login
USER: john.doe
PASS: correct-horse-battery

When the archive gives the content as JSON, you get that JSON as text, indented. Errors are JSON, with the usual envelope: check the status before you save the answer.

Header	What it is
`X-Request-Charged`	`true` when the search took a request, `false` otherwise.
`X-Quota-Remaining`, `X-Quota-Reset`	Your quota after this search, and its next reset.
`X-Orelys-Truncated`	`true` when the file was over 32 MB and was cut. Absent otherwise.
`X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`	Your searches a minute.

Large files. A file over 32 MB is either cut at 32 MB, with X-Orelys-Truncated: true, or refused with 502 response_too_large when the search service gives its size in advance. The refusal costs nothing.

A raw file is leaked data. Show it as text, never as HTML, and do not follow its links automatically.

Cost and limits

Case	Requests
A file delivered, whole or cut	1, from your daily quota.
An empty file	1, as in the dashboard.
No file with this Storage ID in this bucket (`404 file_not_found`)	0, within a daily allowance (your daily quota, at least 10). Past it, 1.
The file mentions a removed selector (`451 file_withheld`)	0, within the same daily allowance.
A Storage ID removed at its owner’s request (`451 file_withheld`)	0: the archive is not asked.
Connection closed after the search was sent	0, within the same daily allowance.
Invalid input, a limit reached, the search service down, busy or too slow, a file too large	0.

Plans: Professional (500 requests a day) and Enterprise (1,500). Both include Storage ID Search.
Per account: 60 searches a minute and 3 at the same time on Professional, 120 and 5 on Enterprise, shared with all your other searches.
Per address: 120 calls a minute, whatever the plan.

See Limits for the details.

Errors

Status	Code	When
`400`	`invalid_request`	`storage_id` is missing or not 128 or 129 hexadecimal characters, or `bucket` is missing or not shaped like a bucket. `details` lists each problem.
`401`	`missing_api_key`, `invalid_api_key`	No key was sent, or it is not a valid one.
`403`	`plan_required`, `account_blocked`	The account is not on Professional or Enterprise, or it is blocked.
`404`	`file_not_found`	No file matches this Storage ID in this bucket.
`429`	`rate_limited`, `concurrency_limited`, `ip_rate_limited`, `quota_exceeded`	A limit is reached. Wait `Retry-After` seconds.
`451`	`file_withheld`	The file mentions a selector removed at its owner’s request. It is not delivered.
`502`	`response_too_large`	The file is over 32 MB, and its size was known in advance.
`502`	`source_error`, `source_unreachable`	The search service failed. Try again later.
`503`	`service_unavailable`, `source_busy`	Search is down or busy for a moment.
`503`	`module_maintenance`, `module_offline`	The Orelys team has paused this mode, or all of Intelligence X. Nothing is charged. Under maintenance, wait `Retry-After` seconds.
`504`	`source_timeout`	The search service did not start answering within 85 seconds, or the transfer stopped for 30 seconds.

Tips

Send the bucket as the record names it. A precise bucket such as leaks.private.comb is accepted as it is. Do not shorten it to one of the twelve.
Send the value, never the label. leaks.logs, not Leaks » Logs. A bucket in capitals is refused with 400 invalid_request.
A 404 often means the wrong bucket. Check the bucket on the record. If you have the System ID, UUID Search looks the file up another way. Each try is a search of its own.
Remove spaces from a pasted Storage ID. A long ID often wraps when it is copied. Only the 128 or 129 hexadecimal characters count.
Save it, do not parse it. The answer is the file, not JSON.

Reference

Request and response schemas, every error, and a playground to try it.

Get started

Essentials

Intelligence X

OSINT

Data breaches

Privacy