UUID Search takes a System ID and returns the file it names, as plain text, not JSON. A System ID is the system_id of an Intelligence Search record: a UUID such as 8b2c4e1a-7d3f-4c9b-a1e5-0f6d2c8b9a47. Use it to read a file you found. For a stealer log as a whole archive, use Stealer Export. With a Storage ID and its bucket instead, use Storage ID Search.

When to use it

  • An Intelligence Search record looks relevant, and you want to read the file.
  • You have a System ID from intelx.io: in the address of a result, or under Expert Information in its details.
  • A Storage ID search answered 404 file_not_found, and you have the record’s System ID.

Request

POST /v1/search/uuid, with a JSON body. Any other field is refused with 400 invalid_request, and nothing is charged.
A file takes longer than a list. The search service has 85 seconds to start answering, then the file comes through as fast as it can: a large one can take a minute or more. The API answers once it holds the whole file, because it reads it against data-removal requests first. Set your HTTP client’s timeout to a few minutes: 300 seconds, as above, is a safe value. A transfer that stops moving for 30 seconds is cut, with 504 source_timeout.

What you get back

The file itself, as text/plain; charset=utf-8:
When the archive gives the content as JSON, you get that JSON as text, indented. Errors are JSON, with the usual envelope: check the status before you save the answer. Large files. A file over 32 MB is either cut at 32 MB, with X-Orelys-Truncated: true, or refused with 502 response_too_large when the search service gives its size in advance. The refusal costs nothing.
A raw file is leaked data. Show it as text, never as HTML, and do not follow its links automatically.

Cost and limits

  • Plans: Professional (500 requests a day) and Enterprise (1,500). Both include UUID Search.
  • Per account: 60 searches a minute and 3 at the same time on Professional, 120 and 5 on Enterprise, shared with all your other searches. A file holds one of your simultaneous slots while it is fetched.
  • Per address: 120 calls a minute, whatever the plan.
See Limits for the details.

Errors

Tips

  • Save it, do not parse it. The answer is the file, not JSON. Write it to disk, then read it as text.
  • Check X-Orelys-Truncated. A cut file is still charged. When it says true, you only have the first 32 MB.
  • Two ways to the same file. When UUID Search answers 404 file_not_found and you have the file’s Storage ID and bucket, Storage ID Search looks the file up another way. Each try is a search of its own.
  • Stealer logs come whole with Stealer Export. Stealer Export gives the full archive of a stealer log, as a .zip.
  • Do not hang up early. A file you cancel after it was sent is given back only within the daily allowance.

Reference

UUID Search

Request and response schemas, every error, and a playground to try it.