Nord Security Email Intelligence API

openapi: 3.2.0
info:
  title: NordStellar Enterprise Data Email Intelligence API
  description: '## Overview

    The NordStellar Enterprise Data API provides comprehensive access to our data breach intelligence platform, enabling organizations to integrate real-time security monitoring and alerting capabilities directly into their existing infrastructure.

    This API allows you to proactively protect your users by detecting when their sensitive information has been compromised in data breaches across the internet.


    **Key Features**:

    - **Real-time Breach Monitoring**: Receive immediate notifications when user data appears in newly discovered data breaches.

    - **Zero-Knowledge Architecture**: Search for compromised sensitive data (credit cards, national identification numbers) using secure hash-based methods that never transmit the actual sensitive information.

    - **Comprehensive Data Sources**: Access intelligence from multiple sources including corporate data breaches, malware infection logs, and stolen credential lists.

    - **Flexible Integration Options**: Support for webhook notifications, bulk operations, and subscription management to fit your organization''s unique requirements.

    - **Enterprise-Grade Security**: Secure authentication methods, rate limiting, and quota management to ensure responsible and controlled API usage.'
  version: '3.1'
servers:
- url: /api/v3/data
security:
- ApiKeyAuth: []
- BasicAuth: []
tags:
- name: Email Intelligence
  description: 'Endpoints for comprehensive email address monitoring in data breaches, including detailed breach information, password exposure, and statistical analysis.

    These operations enable robust email security protection, account takeover prevention, and exposure assessment at both individual and domain-wide levels.'
paths:
  /email/domain/{domain}:
    get:
      tags:
      - Email Intelligence
      summary: Domain search
      description: "Used for looking up all email addresses and their data for a specific domain.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.\nIf a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned\nand the rest of its malware data truncated. Truncated data contains malware IDs that can be used\nto retrieve data using **data-source** endpoints*\n\nDefault is the maximum limit of **100** records \n(If the response returns exactly 100 records, it indicates the potential presence of more records. Initiate a subsequent request to retrieve any additional results)\n\n**Rate limit: 20 per second.**"
      operationId: domain
      parameters:
      - $ref: '#/components/parameters/Domain'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Offset'
      - name: last-id
        in: query
        description: A faster pagination alternative to offset. Set this instead of offset to get response for further pages quicker.
        required: false
        schema:
          type: string
      - $ref: '#/paths/~1email/post/parameters/0'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailsSample'
        '206':
          description: Returns partial found data, with **errors** field on truncated records
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/paths/~1email/post/responses/206/content/application~1json/schema'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
      security:
      - ApiKeyAuth: []
  /email/domain/{domain}/lite:
    get:
      tags:
      - Email Intelligence
      summary: Lite Domain search
      description: "Used for looking up all email addresses and their data for a specific domain.\n\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.\nIf a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned\nand the rest of its malware data truncated. Truncated data contains malware IDs that can be used\nto retrieve data using **data-source** endpoints*\n\nDefault is the maximum limit of **100** records \n(If the response returns exactly 100 records, it indicates the potential presence of more records. Initiate a subsequent request to retrieve any additional results)\n\n**Lite version of /email/domain endpoint, which only includes credentials from malware logs.**\n\n**Rate limit: 100 per second.**"
      operationId: domainLite
      parameters:
      - $ref: '#/components/parameters/Domain'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Offset'
      - $ref: '#/paths/~1email~1domain~1%7Bdomain%7D/get/parameters/3'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailsLiteSample'
        '206':
          description: Returns partial found data, with **errors** field on truncated records
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/EmailLiteSample'
                  limit:
                    type: integer
                    example: 10
                  offset:
                    type: integer
                    example: 0
                  errors:
                    type: object
                    properties:
                      body:
                        type: string
                    description: Contains errors signifying partial data
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
      security:
      - ApiKeyAuth: []
  /email/{email-sha256}:
    get:
      tags:
      - Email Intelligence
      summary: Email Lookup
      description: 'Used for looking up email addresses and their data.

        These email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.


        The returned sections can be narrowed using the **inclusive-projection** and **exclusive-projection** query parameters

        (see the parameter descriptions for the available sections, e.g. `databases`, `combo_lists`, `malware_logs`).


        **Rate limit: 200 per second.**'
      operationId: singleEmail
      parameters:
      - $ref: '#/components/parameters/Email'
      - $ref: '#/paths/~1email/post/parameters/0'
      - $ref: '#/paths/~1email/post/parameters/1'
      - $ref: '#/paths/~1email/post/parameters/2'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailSample'
        '206':
          description: Returns partial found data, with **errors** field on truncated records
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    example: 2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3
                  email:
                    type: string
                    example: example@example.com
                  databases:
                    type: array
                    items:
                      $ref: '#/components/schemas/DatabaseDataItem'
                  malware_logs:
                    type: array
                    items:
                      $ref: '#/components/schemas/MalwareDataItem'
                  credential_lists:
                    type: array
                    items:
                      $ref: '#/components/schemas/CredentialDataItem'
                  errors:
                    type: object
                    properties:
                      body:
                        type: string
                    description: Contains errors signifying partial data
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /email/{email-sha256}/lite:
    get:
      tags:
      - Email Intelligence
      summary: Lite Email Lookup
      description: 'Used for looking up email addresses and their data.

        These email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.


        **Lite version of /email endpoint, which only includes credentials from malware logs.**


        **Rate limit: 200 per second.**'
      operationId: singleEmailLite
      parameters:
      - $ref: '#/components/parameters/Email'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailLiteSample'
        '206':
          description: Returns partial found data, with **errors** field on truncated records
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    example: 2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3
                  email:
                    type: string
                    example: example@example.com
                  databases:
                    type: array
                    items:
                      $ref: '#/components/schemas/DatabaseDataItem'
                  malware_logs:
                    type: array
                    items:
                      $ref: '#/components/schemas/MalwareDataItemLite'
                  credential_lists:
                    type: array
                    items:
                      $ref: '#/components/schemas/CredentialDataItem'
                  errors:
                    type: object
                    properties:
                      body:
                        type: string
                    description: Contains errors signifying partial data
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /email/{email-sha256}/databases:
    get:
      tags:
      - Email Intelligence
      summary: Email databases lookup
      description: 'Used for looking up email addresses and their databases.

        These email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.


        **Rate limit: 200 per second.**'
      operationId: singleEmailDatabases
      parameters:
      - $ref: '#/components/parameters/Email'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailDatabasesSample'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /email/{email-sha256}/malware-logs:
    get:
      tags:
      - Email Intelligence
      summary: Email malware logs lookup
      description: 'Used for looking up email addresses and their malware logs.

        These email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.


        **Rate limit: 200 per second.**'
      operationId: singleEmailMalwareLogs
      parameters:
      - $ref: '#/components/parameters/Email'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailMalwareLogsSample'
        '206':
          description: Returns partial found data, with **errors** field on truncated records
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    example: 2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3
                  email:
                    type: string
                    example: example@example.com
                  malware_logs:
                    type: array
                    items:
                      $ref: '#/components/schemas/MalwareDataItem'
                  errors:
                    type: object
                    properties:
                      body:
                        type: string
                    description: Contains errors signifying partial data
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /email/{email-sha256}/credential-lists:
    get:
      tags:
      - Email Intelligence
      summary: Email credential lists lookup
      description: 'Used for looking up email addresses and their credential lists.

        These email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.


        **Rate limit: 200 per second.**'
      operationId: singleEmailCredentialLists
      parameters:
      - $ref: '#/components/parameters/Email'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailCredentialListsSample'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /email/{email-sha256}/password:
    get:
      tags:
      - Email Intelligence
      summary: Single email ATO prevention
      description: 'Used for looking up an email address and its fuzzed passwords. Fuzzed passwords are passwords transformed according to pre-defined rules. The rule set, and thus the number of fuzzed passwords returned depends on the fuzzing_intensity parameter, which ranges from **0** to **10**, **0** being no fuzzing, only original password returned, and **10** being the biggest rule set that returns over 50,000 fuzzed passwords per original password.

        **Rate limit: 10 per second.**'
      operationId: singleEmailPassword
      parameters:
      - $ref: '#/components/parameters/Email'
      - $ref: '#/components/parameters/FuzzingIntensity'
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              $ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailAtoPreventionSample'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
        '404':
          description: No data found
          content: {}
      security:
      - ApiKeyAuth: []
  /email:
    post:
      tags:
      - Email Intelligence
      summary: Bulk Email Lookup
      description: 'Used for looking up email addresses and their data in bulk.

        These email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.


        The data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.


        The returned sections can be narrowed using the **inclusive-projection** and **exclusive-projection** query parameters

        (see the parameter descriptions for the available sections, e.g. `databases`, `combo_lists`, `malware_logs`).


        *Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.

        If a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned

        and the rest of its malware data truncated. Truncated data contains malware IDs that can be used

        to retrieve data using **data-source** endpoints*


        **Rate limit: 10 per second.**'
      operationId: email
      parameters:
      - name: recommendations_enabled
        in: query
        description: If you need data breach resolution recommendations, set this to true.
        schema:
          type: boolean
      - name: inclusive-projection
        in: query
        description: 'Return **only** the listed fields, omitting everything else. Useful for trimming large responses (e.g. fetching just malware logs) and reducing payload size.


          Values are a comma-separated list (`?inclusive-projection=databases,malware_logs`) or repeated parameters (`?inclusive-projection=databases&inclusive-projection=malware_logs`).


          The record''s envelope fields (its `id`, the `email`/`phone` value, and `meta`) are always returned regardless of the projection.


          **Top-level sections:**

          - `databases` — breached database records (the `databases` response field).

          - `combo_lists` — credential list records (returned in the `credential_lists` response field; email endpoints only).

          - `malware_logs` — malware infection logs.


          `databases` and `malware_logs` also support selecting individual sub-fields with dot notation, e.g. `databases.identifier`, `malware_logs.credentials`, `malware_logs.cookies`. Only the listed sub-fields are returned — there are no implicit includes beyond the always-present `id`.


          **`id` is special:** each record''s `id` is always present and may be named explicitly (e.g. `malware_logs.id`), but it can never be excluded — the only way to omit it is to exclude the whole enclosing object.


          Mutually exclusive with **exclusive-projection** — supplying both returns `400 Bad Request`. Unknown field names also return `400 Bad Request`. A maximum of 100 fields may be supplied.'
        required: false
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
        example:
        - malware_logs
        - databases
      - name: exclusive-projection
        in: query
        description: 'Return the full email document **except** the listed fields. Useful for dropping heavy parts of the response (e.g. excluding malware logs) while keeping everything else.


          Values are a comma-separated list (`?exclusive-projection=malware_logs,combo_lists`) or repeated parameters (`?exclusive-projection=malware_logs&exclusive-projection=combo_lists`).


          **Top-level sections:**

          - `databases` — breached database records (the `databases` response field).

          - `combo_lists` — credential list records (returned in the `credential_lists` response field; email endpoints only).

          - `malware_logs` — malware infection logs.


          `databases` and `malware_logs` also support excluding individual sub-fields with dot notation, e.g. `malware_logs.cookies`, `malware_logs.installed_software`, `databases.data`. The rest of each record is still returned.


          **`id` cannot be excluded.** Any exclusion path that targets an `id` (e.g. `id` or `malware_logs.id`) returns `400 Bad Request` — to omit an object''s id, exclude the whole object instead.


          Mutually exclusive with **inclusive-projection** — supplying both returns `400 Bad Request`. Unknown field names also return `400 Bad Request`. A maximum of 100 fields may be supplied.'
        required: false
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
        example:
        - malware_logs
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Emails'
        required: true
      responses:
        '200':
          description: Returns found data
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Reset:
              schema:
                type: string
                format: date-time
              description: Date and time when quota limit resets
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmailsSample'
        '206':
          description: Returns partial found data, with **errors** field on truncated records
          headers:
            X-RateLimit-Limit:
              $ref: '#/components/headers/X-RateLimit-Limit'
            X-RateLimit-Remaining:
              $ref: '#/components/headers/X-RateLimit-Remaining'
            X-RateLimit-Reset:
              $ref: '#/components/headers/X-RateLimit-Reset'
            X-Quota-Limit:
              $ref: '#/components/headers/X-Quota-Limit'
            X-Quota-Remaining:
              $ref: '#/components/headers/X-Quota-Remaining'
            X-Quota-Re

# --- truncated at 32 KB (88 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/nord-security/refs/heads/main/openapi/nord-security-email-intelligence-api-openapi.yml