Every API here is available over the APIs.io API and to AI agents over MCP.
openapi: 3.2.0
info:
title: NordStellar Enterprise Data Malware Logs Intelligence API
description: '## Overview
The NordStellar Enterprise Data API provides comprehensive access to our data breach intelligence platform, enabling organizations to integrate real-time security monitoring and alerting capabilities directly into their existing infrastructure.
This API allows you to proactively protect your users by detecting when their sensitive information has been compromised in data breaches across the internet.
**Key Features**:
- **Real-time Breach Monitoring**: Receive immediate notifications when user data appears in newly discovered data breaches.
- **Zero-Knowledge Architecture**: Search for compromised sensitive data (credit cards, national identification numbers) using secure hash-based methods that never transmit the actual sensitive information.
- **Comprehensive Data Sources**: Access intelligence from multiple sources including corporate data breaches, malware infection logs, and stolen credential lists.
- **Flexible Integration Options**: Support for webhook notifications, bulk operations, and subscription management to fit your organization''s unique requirements.
- **Enterprise-Grade Security**: Secure authentication methods, rate limiting, and quota management to ensure responsible and controlled API usage.'
version: '3.1'
servers:
- url: /api/v3/data
security:
- ApiKeyAuth: []
- BasicAuth: []
tags:
- name: Malware Logs Intelligence
description: 'Endpoints for retrieving detailed metadata about breach origins, including malware logs.
These operations provide comprehensive context about malware logs breach incidents, affected platforms, and exposure scope to support your security investigations.'
paths:
/email/{email-sha256}/malware-logs:
get:
tags:
- Malware Logs Intelligence
summary: Email malware logs lookup
description: 'Used for looking up email addresses and their malware logs.
These email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.
**Rate limit: 200 per second.**'
operationId: singleEmailMalwareLogs
parameters:
- $ref: '#/components/parameters/Email'
responses:
'200':
description: Returns found data
headers:
X-RateLimit-Limit:
$ref: '#/components/headers/X-RateLimit-Limit'
X-RateLimit-Remaining:
$ref: '#/components/headers/X-RateLimit-Remaining'
X-RateLimit-Reset:
$ref: '#/components/headers/X-RateLimit-Reset'
X-Quota-Limit:
$ref: '#/components/headers/X-Quota-Limit'
X-Quota-Remaining:
$ref: '#/components/headers/X-Quota-Remaining'
X-Quota-Reset:
$ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
content:
application/json:
schema:
$ref: '#/components/schemas/EmailMalwareLogsSample'
'206':
description: Returns partial found data, with **errors** field on truncated records
headers:
X-RateLimit-Limit:
$ref: '#/components/headers/X-RateLimit-Limit'
X-RateLimit-Remaining:
$ref: '#/components/headers/X-RateLimit-Remaining'
X-RateLimit-Reset:
$ref: '#/components/headers/X-RateLimit-Reset'
X-Quota-Limit:
$ref: '#/components/headers/X-Quota-Limit'
X-Quota-Remaining:
$ref: '#/components/headers/X-Quota-Remaining'
X-Quota-Reset:
$ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
content:
application/json:
schema:
type: object
properties:
id:
type: string
example: 2a539d6520266b56c3b0c525b9e6128858baeccb5ee9b694a2906e123c8d6dd3
email:
type: string
example: example@example.com
malware_logs:
type: array
items:
$ref: '#/components/schemas/MalwareDataItem'
errors:
type: object
properties:
body:
type: string
description: Contains errors signifying partial data
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
'404':
description: No data found
content: {}
security:
- ApiKeyAuth: []
/email/malware-logs:
post:
tags:
- Malware Logs Intelligence
summary: Bulk email malware logs lookup
description: 'Used for looking up email addresses and their malware logs in bulk.
These email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.
The data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.
*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.
If a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned
and the rest of its malware data truncated. Truncated data contains malware IDs that can be used
to retrieve data using **data-source** endpoints*
**Rate limit: 10 per second.**'
operationId: emailMalwareLogs
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Emails'
required: true
responses:
'200':
description: Returns found data
headers:
X-RateLimit-Limit:
$ref: '#/components/headers/X-RateLimit-Limit'
X-RateLimit-Remaining:
$ref: '#/components/headers/X-RateLimit-Remaining'
X-RateLimit-Reset:
$ref: '#/components/headers/X-RateLimit-Reset'
X-Quota-Limit:
$ref: '#/components/headers/X-Quota-Limit'
X-Quota-Remaining:
$ref: '#/components/headers/X-Quota-Remaining'
X-Quota-Reset:
$ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
content:
application/json:
schema:
$ref: '#/components/schemas/EmailsMalwareLogsSample'
'206':
description: Returns partial found data, with **errors** field on truncated records
headers:
X-RateLimit-Limit:
$ref: '#/components/headers/X-RateLimit-Limit'
X-RateLimit-Remaining:
$ref: '#/components/headers/X-RateLimit-Remaining'
X-RateLimit-Reset:
$ref: '#/components/headers/X-RateLimit-Reset'
X-Quota-Limit:
$ref: '#/components/headers/X-Quota-Limit'
X-Quota-Remaining:
$ref: '#/components/headers/X-Quota-Remaining'
X-Quota-Reset:
$ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
$ref: '#/components/schemas/EmailMalwareLogsSample'
limit:
type: integer
example: 10
offset:
type: integer
example: 0
errors:
type: object
properties:
body:
type: string
description: Contains errors signifying partial data
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
security:
- ApiKeyAuth: []
/phone/{phone-sha256}/malware-logs:
get:
tags:
- Malware Logs Intelligence
summary: Phone malware logs lookup
description: 'Used for looking up phone numbers and their malware logs.
These phone numbers and their data have been collected and aggregated from various databases openly accessible on the internet.
**Rate limit: 200 per second.**'
operationId: singlePhoneMalwareLogs
parameters:
- $ref: '#/components/parameters/Phone'
responses:
'200':
description: Returns found data
headers:
X-RateLimit-Limit:
$ref: '#/components/headers/X-RateLimit-Limit'
X-RateLimit-Remaining:
$ref: '#/components/headers/X-RateLimit-Remaining'
X-RateLimit-Reset:
$ref: '#/components/headers/X-RateLimit-Reset'
X-Quota-Limit:
$ref: '#/components/headers/X-Quota-Limit'
X-Quota-Remaining:
$ref: '#/components/headers/X-Quota-Remaining'
X-Quota-Reset:
$ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
content:
application/json:
schema:
$ref: '#/components/schemas/PhoneMalwareLogsSample'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
'404':
description: No data found
content: {}
security:
- ApiKeyAuth: []
/phone/malware-logs:
post:
tags:
- Malware Logs Intelligence
summary: Bulk phone malware logs lookup
description: 'Used for looking up phones numbers and their malware logs in bulk.
These phone numbers and their data have been collected and aggregated from various databases openly accessible on the internet.
The data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.
*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.
If a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned
and the rest of its malware data truncated. Truncated data contains malware IDs that can be used
to retrieve data using **data-source** endpoints*
**Rate limit: 200 per second.**'
operationId: phonesMalwareLogs
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Phone'
required: true
responses:
'200':
description: Returns found data
headers:
X-RateLimit-Limit:
$ref: '#/components/headers/X-RateLimit-Limit'
X-RateLimit-Remaining:
$ref: '#/components/headers/X-RateLimit-Remaining'
X-RateLimit-Reset:
$ref: '#/components/headers/X-RateLimit-Reset'
X-Quota-Limit:
$ref: '#/components/headers/X-Quota-Limit'
X-Quota-Remaining:
$ref: '#/components/headers/X-Quota-Remaining'
X-Quota-Reset:
$ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
content:
application/json:
schema:
$ref: '#/components/schemas/PhonesMalwareLogsSample'
'206':
description: Returns partial found data, with **errors** field on truncated records
headers:
X-RateLimit-Limit:
$ref: '#/components/headers/X-RateLimit-Limit'
X-RateLimit-Remaining:
$ref: '#/components/headers/X-RateLimit-Remaining'
X-RateLimit-Reset:
$ref: '#/components/headers/X-RateLimit-Reset'
X-Quota-Limit:
$ref: '#/components/headers/X-Quota-Limit'
X-Quota-Remaining:
$ref: '#/components/headers/X-Quota-Remaining'
X-Quota-Reset:
$ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
$ref: '#/components/schemas/PhoneMalwareLogsSample'
limit:
type: integer
example: 10
offset:
type: integer
example: 0
errors:
type: object
properties:
body:
type: string
description: Contains errors signifying partial data
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
security:
- ApiKeyAuth: []
/data-source/malware-log/{id}:
get:
tags:
- Malware Logs Intelligence
summary: Malware Log Lookup
description: 'Used to look up malware logs that are publicly accessible on the internet, and their metadata.
These malware logs may have been collected from both clearnet and deep/dark web.
Each malware log record pertains to a particular instance of infection and contains data gathered from the affected machine at the time of the attack.
The returned sections can be narrowed using the **inclusive-projection** and **exclusive-projection** query parameters
(see the parameter descriptions for the available sections, e.g. `credentials`, `cookies`, `secrets`).
**Rate limit: 200 per second.**'
operationId: malwareLog
parameters:
- $ref: '#/components/parameters/HexId'
- $ref: '#/paths/~1data-source~1malware-log/post/parameters/0'
- $ref: '#/paths/~1data-source~1malware-log/post/parameters/1'
responses:
'200':
description: Returns found data
headers:
X-RateLimit-Limit:
$ref: '#/components/headers/X-RateLimit-Limit'
X-RateLimit-Remaining:
$ref: '#/components/headers/X-RateLimit-Remaining'
X-RateLimit-Reset:
$ref: '#/components/headers/X-RateLimit-Reset'
X-Quota-Limit:
$ref: '#/components/headers/X-Quota-Limit'
X-Quota-Remaining:
$ref: '#/components/headers/X-Quota-Remaining'
X-Quota-Reset:
$ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
content:
application/json:
schema:
$ref: '#/components/schemas/MalwareDataItem'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
'404':
description: No data found
content: {}
security:
- ApiKeyAuth: []
/data-source/malware-log:
post:
tags:
- Malware Logs Intelligence
summary: Bulk Malware Log Lookup
description: 'Used to look up malware logs that are publicly accessible on the internet, and their metadata.
These malware logs may have been collected from both clearnet and deep/dark web.
Each malware log record pertains to a particular instance of infection and contains data gathered from the affected machine at the time of the attack.
The data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.
The returned sections can be narrowed using the **inclusive-projection** and **exclusive-projection** query parameters
(see the parameter descriptions for the available sections, e.g. `credentials`, `cookies`, `secrets`).
**Rate limit: 200 per second.**'
operationId: malwareLogs
parameters:
- name: inclusive-projection
in: query
description: 'Return **only** the listed fields of each malware log, omitting everything else. Useful for trimming large responses (malware logs can be very large) and reducing payload size.
Values are a comma-separated list (`?inclusive-projection=credentials,cookies`) or repeated parameters (`?inclusive-projection=credentials&inclusive-projection=cookies`).
**Available fields:** `id`, `identifier`, `type`, `system_info`, `identification_level`, `credentials`, `credit_cards`, `cookies`, `autofills`, `grabbed_files`, `secrets`, `metadata`, `ftp`, `installed_software`, `process_list`, `rdp`, `rac`, `ssh`, `vpn`, `email_clients`, `downloads`.
Only the listed fields are returned — there are no implicit includes beyond the always-present `id`.
**`id` is special:** it is always present and may be named explicitly, but it can never be excluded.
Mutually exclusive with **exclusive-projection** — supplying both returns `400 Bad Request`. Unknown field names also return `400 Bad Request`. A maximum of 100 fields may be supplied.'
required: false
style: form
explode: false
schema:
type: array
items:
type: string
example:
- credentials
- cookies
- name: exclusive-projection
in: query
description: 'Return each full malware log **except** the listed fields. Useful for dropping heavy parts of the response (e.g. excluding cookies or grabbed files) while keeping everything else.
Values are a comma-separated list (`?exclusive-projection=cookies,grabbed_files`) or repeated parameters (`?exclusive-projection=cookies&exclusive-projection=grabbed_files`).
**Available fields:** `identifier`, `type`, `system_info`, `identification_level`, `credentials`, `credit_cards`, `cookies`, `autofills`, `grabbed_files`, `secrets`, `metadata`, `ftp`, `installed_software`, `process_list`, `rdp`, `rac`, `ssh`, `vpn`, `email_clients`, `downloads`.
**`id` cannot be excluded** — supplying `id` returns `400 Bad Request`.
Mutually exclusive with **inclusive-projection** — supplying both returns `400 Bad Request`. Unknown field names also return `400 Bad Request`. A maximum of 100 fields may be supplied.'
required: false
style: form
explode: false
schema:
type: array
items:
type: string
example:
- cookies
- grabbed_files
requestBody:
content:
application/json:
schema:
required:
- ids
type: object
properties:
ids:
type: array
description: 'A list of malware log IDs to lookup.
ID should consist of 24 hexadecimal digits.'
items:
type: string
example:
- 5f4e1f2e4b1d4d4e4b1d4d4e
- 5f4e1f2e4b1d4d4e4b1d4d4f
limit:
description: Default is the maximum limit of 20 records
type: integer
example: 10
offset:
type: integer
example: 0
required: true
responses:
'200':
description: Returns found data
headers:
X-RateLimit-Limit:
$ref: '#/components/headers/X-RateLimit-Limit'
X-RateLimit-Remaining:
$ref: '#/components/headers/X-RateLimit-Remaining'
X-RateLimit-Reset:
$ref: '#/components/headers/X-RateLimit-Reset'
X-Quota-Limit:
$ref: '#/components/headers/X-Quota-Limit'
X-Quota-Remaining:
$ref: '#/components/headers/X-Quota-Remaining'
X-Quota-Reset:
$ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
content:
application/json:
schema:
$ref: '#/components/schemas/MalwareLogsSample'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
'413':
description: Too many logs on single request
content: {}
security:
- ApiKeyAuth: []
/data-source/malware-log/details:
post:
tags:
- Malware Logs Intelligence
summary: Bulk Malware Log Details Lookup
description: 'Used to look up malware log details (identifier, malware type, published date, updated date and system information) for a list of malware log IDs.
Returns a lightweight representation of each malware log, including the identifier, type, published date, updated date, and system information.
This endpoint does not return the full malware log data (credentials, cookies, etc.).
The data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.
**Rate limit: 200 per second.**'
operationId: malwareLogDetails
requestBody:
content:
application/json:
schema:
required:
- ids
type: object
properties:
ids:
type: array
description: 'A list of malware log IDs to lookup details for.
ID should consist of 24 hexadecimal digits.'
items:
type: string
example:
- 5f4e1f2e4b1d4d4e4b1d4d4e
- 5f4e1f2e4b1d4d4e4b1d4d4f
limit:
description: Default is the maximum limit of 500 records
type: integer
example: 10
offset:
type: integer
example: 0
required: true
responses:
'200':
description: Returns found data
headers:
X-RateLimit-Limit:
$ref: '#/components/headers/X-RateLimit-Limit'
X-RateLimit-Remaining:
$ref: '#/components/headers/X-RateLimit-Remaining'
X-RateLimit-Reset:
$ref: '#/components/headers/X-RateLimit-Reset'
X-Quota-Limit:
$ref: '#/components/headers/X-Quota-Limit'
X-Quota-Remaining:
$ref: '#/components/headers/X-Quota-Remaining'
X-Quota-Reset:
$ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
identifier:
type: string
description: Malware identifier
example: US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]
id:
type: string
description: Systemic hex ID of the record
example: 678e9e47098d6b3b44f75ec8
type:
type: string
description: Name of the infostealer
example: risepro
published_date:
type: string
description: Date that malware log has been published
example: '2025-01-20T19:04:39Z'
updated_date:
type: string
description: Date that malware log has been last updated
example: '2025-02-15T12:30:00Z'
system_info:
$ref: '#/components/schemas/MalwareLogSystemInfoSampleItem'
limit:
type: integer
example: 10
offset:
type: integer
example: 0
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/paths/~1user/get/responses/400/content/application~1json/schema'
'413':
description: Too many logs on single request
content: {}
security:
- ApiKeyAuth: []
/data-source/malware-log/stats:
post:
tags:
- Malware Logs Intelligence
summary: Bulk Malware Log Statistics Lookup
description: 'Returns the number of records held in each data category of a malware log, without returning the records themselves.
For a set of malware log identifiers, each result reports how many credentials, cookies, autofills, credit cards, secrets and other artifacts were recovered from the infected machine, together with its system information, metadata and identification level. This offers a lightweight way to assess the size and composition of a malware log before retrieving its full contents.
**Rate limit: 200 per second.**'
operationId: malwareLogStatistics
requestBody:
content:
application/json:
schema:
required:
- ids
type: object
properties:
ids:
type: array
description: 'A list of malware log IDs to look up statistics for. Up to 500 IDs per request.
ID should consist of 24 hexadecimal digits.'
items:
type: string
example:
- 5f4e1f2e4b1d4d4e4b1d4d4e
- 5f4e1f2e4b1d4d4e4b1d4d4f
required: true
responses:
'200':
description: Returns found data
headers:
X-RateLimit-Limit:
$ref: '#/components/headers/X-RateLimit-Limit'
X-RateLimit-Remaining:
$ref: '#/components/headers/X-RateLimit-Remaining'
X-RateLimit-Reset:
$ref: '#/components/headers/X-RateLimit-Reset'
X-Quota-Limit:
$ref: '#/components/headers/X-Quota-Limit'
X-Quota-Remaining:
$ref: '#/components/headers/X-Quota-Remaining'
X-Quota-Reset:
$ref: '#/paths/~1email/post/responses/200/headers/X-Quota-Reset'
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
identifier:
type: string
description: Malware identifier composed by malicious code
example: US[97F6DE35E58C06E6ED60B78FC35739E4] [2023-07-21T01_15_33.9687566]
id:
type: string
description: Systemic hex ID of the record
example: 678e9e47098d6b3b44f75ec8
type:
type: string
description: Name or brand of the infostealer (may be empty or unknown)
example: risepro
published_date:
type: string
description: Date that malware log has been published
example: '2025-01-20T19:04:39Z'
statistics:
type: object
description: Number of records recovered in each data category
properties:
credentials_count:
type: integer
example: 42
cookies_count:
type: integer
example: 1337
autofills_count:
type: integer
example: 12
grabbed_files_count:
type: integer
example: 87
credit_cards_count:
type: integer
example: 0
secrets_count:
type: integer
example: 3
ftp_count:
type: integer
example: 0
installed_software_count:
type: integer
example: 65
process_list_count:
type: integer
example: 120
rdp_count:
type: integer
example: 0
rac_count:
type: integer
example: 0
vpn_count:
type: integer
example: 1
email_clients_count:
type: integer
example: 2
downloads_count:
type: integer
example: 5
ssh_keys_count:
type: integer
example: 4
ssh_known_hosts_count:
type: integer
example: 9
system_info:
$ref: '#/components/schemas/MalwareLogSystemInfoSampleItem'
metadata:
type: object
properties:
incident_date:
# --- truncated at 32 KB (95 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/nord-security/refs/heads/main/openapi/nord-security-malware-logs-intelligence-api-openapi.yml