{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/recorded-future/main/json-schema/recorded-future-credentials-lookup-request-schema.json",
  "title": "CredentialsLookupRequest",
  "x-generated": "2026-10-20",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/recorded-future-identity-api-openapi.yml#/components/schemas/CredentialsLookupRequest",
  "type": "object",
  "properties": {
    "organization_id": {
      "$ref": "#/$defs/UhashId"
    },
    "subjects": {
      "type": "array",
      "maxItems": 100,
      "items": {
        "type": "string",
        "maxLength": 100,
        "pattern": ".+"
      },
      "description": "Email addresses to look up (e.g., user@example.com)"
    },
    "subjects_sha1": {
      "type": "array",
      "maxItems": 100,
      "items": {
        "type": "string",
        "maxLength": 100,
        "pattern": ".+"
      },
      "description": "SHA1 hashes of email addresses for privacy-preserving lookups"
    },
    "subjects_login": {
      "type": "array",
      "maxItems": 100,
      "items": {
        "$ref": "#/$defs/DomainLogin"
      },
      "description": "Domain + login pairs for authorization-domain lookups"
    },
    "filter": {
      "$ref": "#/$defs/IdentityRequestFilter",
      "description": "Filter options (same as Search)"
    },
    "limit": {
      "type": "integer",
      "format": "int32",
      "minimum": 0,
      "maximum": 1000,
      "description": "Maximum number of results to return"
    },
    "offset": {
      "type": "string",
      "maxLength": 100,
      "pattern": ".+",
      "description": "Pagination token from a previous response's next_offset"
    }
  },
  "$defs": {
    "BreachProperties": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "maxLength": 100,
          "pattern": ".+"
        },
        "date": {
          "type": "string",
          "format": "date-time",
          "maxLength": 29
        }
      }
    },
    "DomainLogin": {
      "type": "object",
      "properties": {
        "login": {
          "type": "string",
          "maxLength": 100,
          "pattern": ".+"
        },
        "login_sha1": {
          "type": "string",
          "maxLength": 100,
          "pattern": ".+"
        },
        "domain": {
          "type": "string",
          "maxLength": 100,
          "pattern": ".+"
        }
      },
      "required": [
        "domain"
      ]
    },
    "DumpProperties": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "maxLength": 100,
          "pattern": ".+"
        },
        "date": {
          "type": "string",
          "format": "date-time",
          "maxLength": 29
        }
      }
    },
    "IdentityRequestFilter": {
      "type": "object",
      "properties": {
        "first_downloaded_gte": {
          "type": "string",
          "format": "date-time",
          "maxLength": 29,
          "description": "The first date when these credentials were received and indexed by Recorded Future."
        },
        "latest_downloaded_gte": {
          "type": "string",
          "format": "date-time",
          "maxLength": 29,
          "description": "Latest date when these credentials were received and indexed by Recorded Future. It is not unusual for the same credentials to be exposed multiple times, in data from different dumps and/or logs."
        },
        "exfiltration_date_gte": {
          "type": "string",
          "format": "date-time",
          "maxLength": 29,
          "description": "The date when data was exfiltrated (stolen) from the victim. Note: Only applicable for malware-based exposures."
        },
        "properties": {
          "type": "array",
          "maxItems": 100,
          "items": {
            "$ref": "#/$defs/PasswordProperty"
          },
          "description": "Password property filters"
        },
        "username_properties": {
          "type": "array",
          "maxItems": 100,
          "items": {
            "$ref": "#/$defs/UsernameProperty"
          }
        },
        "breach_properties": {
          "$ref": "#/$defs/BreachProperties"
        },
        "dump_properties": {
          "$ref": "#/$defs/DumpProperties"
        },
        "authorization_technologies": {
          "type": "array",
          "maxItems": 100,
          "items": {
            "type": "string",
            "maxLength": 100,
            "pattern": ".+"
          },
          "description": "Filter results by specific authorization technologies (e.g., SAML, LDAP)"
        },
        "authorization_protocols": {
          "type": "array",
          "maxItems": 100,
          "items": {
            "type": "string",
            "maxLength": 100,
            "pattern": ".+"
          }
        },
        "malware_families": {
          "type": "array",
          "maxItems": 100,
          "items": {
            "type": "string",
            "maxLength": 100,
            "pattern": ".+"
          },
          "description": "Filter by malware family names"
        }
      }
    },
    "PasswordProperty": {
      "type": "string",
      "enum": [
        "Letter",
        "Number",
        "Symbol",
        "UpperCase",
        "LowerCase",
        "MixedCase",
        "AtLeast8Characters",
        "AtLeast10Characters",
        "AtLeast12Characters",
        "AtLeast16Characters",
        "AtLeast24Characters",
        "Cookies",
        "UnexpiredCookies",
        "AuthorizationTechnology",
        "MalwareOnly"
      ]
    },
    "UhashId": {
      "type": "string",
      "maxLength": 20,
      "pattern": "^uhash:[a-zA-Z0-9]+$"
    },
    "UsernameProperty": {
      "type": "string",
      "enum": [
        "Email"
      ]
    }
  }
}