NordStellar Enterprise Data API

{"openapi":"3.1.0","info":{"title":"NordStellar Enterprise Data API","description":"## Overview\nThe NordStellar Enterprise Data API provides comprehensive access to our data breach intelligence platform, enabling organizations to integrate real-time security monitoring and alerting capabilities directly into their existing infrastructure.\nThis API allows you to proactively protect your users by detecting when their sensitive information has been compromised in data breaches across the internet.\n\n**Key Features**:\n- **Real-time Breach Monitoring**: Receive immediate notifications when user data appears in newly discovered data breaches.\n- **Zero-Knowledge Architecture**: Search for compromised sensitive data (credit cards, national identification numbers) using secure hash-based methods that never transmit the actual sensitive information.\n- **Comprehensive Data Sources**: Access intelligence from multiple sources including corporate data breaches, malware infection logs, and stolen credential lists.\n- **Flexible Integration Options**: Support for webhook notifications, bulk operations, and subscription management to fit your organization's unique requirements.\n- **Enterprise-Grade Security**: Secure authentication methods, rate limiting, and quota management to ensure responsible and controlled API usage.","version":"3.1"},"servers":[{"url":"/api/v3/data"}],"security":[{"ApiKeyAuth":[]},{"BasicAuth":[]}],"tags":[{"name":"API User Management","description":"Endpoints for administering API keys, and web hook settings.\n\nThese operations enable administrators to list and manage API keys, update webhook configuration."},{"name":"Domain Intelligence","description":"Endpoints for investigating domain exposure in data breaches, including detailed breach information and compromise analysis.\nThese operations support protection against domain hijacking, phishing attacks, and other threats targeting domain owners."},{"name":"Email Intelligence","description":"Endpoints for comprehensive email address monitoring in data breaches, including detailed breach information, password exposure, and statistical analysis.\nThese operations enable robust email security protection, account takeover prevention, and exposure assessment at both individual and domain-wide levels."},{"name":"Phone Intelligence","description":"Endpoints for investigating phone number exposure in data breaches, including detailed breach information and compromise analysis. These operations support protection against SIM swapping, phone-based fraud, and other attacks targeting mobile devices and phone numbers."},{"name":"Credit Card Intelligence","description":"Endpoints for comprehensive credit card data monitoring in data breaches, including zero-knowledge search capabilities.\nThese operations enable robust credit card security protection and exposure assessment."},{"name":"National Identification Number Intelligence","description":"Endpoints for comprehensive national identification number data monitoring in data breaches, including zero-knowledge search capabilities.\nThese operations enable robust national identification number security protection and exposure assessment."},{"name":"Breached Databases","description":"Endpoints for retrieving detailed metadata about breach origins, including databases.\nThese operations provide comprehensive context about database breach incidents, affected platforms, and exposure scope to support your security investigations."},{"name":"Credential Lists","description":"Endpoints for retrieving detailed metadata about breach origins, including credential lists.\nThese operations provide comprehensive context about credential list breach incidents, affected platforms, and exposure scope to support your security investigations."},{"name":"Malware Logs Intelligence","description":"Endpoints for retrieving detailed metadata about breach origins, including malware logs.\nThese operations provide comprehensive context about malware logs breach incidents, affected platforms, and exposure scope to support your security investigations."},{"name":"Password Intelligence","description":"Endpoints for comprehensive password data monitoring in data breaches, including zero-knowledge search capabilities.\nThese operations enable robust password security protection and exposure assessment."},{"name":"Cookie Intelligence","description":"Endpoints for comprehensive cookie data monitoring in data breaches, including zero-knowledge search capabilities.\nThese operations enable robust cookie security protection and exposure assessment."},{"name":"Dark Web Intelligence","description":"Endpoints for searching scraped content from the dark web"},{"name":"Subscription Management","description":"Endpoints for managing user subscriptions to data breach monitoring services. These operations enable administrators to create, update, and delete subscriptions for email addresses, phone numbers, domains, and sensitive data types.\n\nWhen a subscription is created, Serity automatically sends requests to the user’s webhook whenever new or updated data matches the subscription criteria. The webhook destination must be specified through the APIs user-management endpoints.\n\n### Webhook Requirements\nTo ensure reliable delivery under high load, user webhooks **must support very high request throughput** — at least `100 requests per second`. Serity operates at scale and will **not throttle outbound traffic** based on slow client responses. Frequent `429 Too Many Requests` responses are retried, but they can **clog internal delivery queues**, thus, it is strongly recommended that webhook endpoints are backed by a **message queue** or similar buffering system that can **acknowledge requests immediately** and **process them asynchronously** at the desired pace. This ensures resilience and prevents backpressure issues during high traffic periods.\n\n### Delivery Semantics and Retry Policy\n- `2XX responses (200–299)` are treated as successful acknowledgements and are not retried.  \n- `404 responses` trigger internal alerts and are **not retried**, as they typically indicate an invalid or deprecated endpoint.\n- `429 (Too Many Requests)` responses are retried with backoff, but can cause delivery delays if they persist.\n- `All other 4XX and 5XX responses` are **retried** with exponential backoff.  \n- After prolonged retry failure, events are moved to a **DLQ**. In such cases, the platform team will contact the user.  \n### Webhook Payload\n```\n{\n  \"subscription_id\": \"string\",\n  \"document_type\": \"email-sha256 | phone-sha256 | cc-argon2id | nin-argon2id | cc-sha1 | nin-sha1\",\n  \"document_identifier\": \"string\",\n  \"operation_type\": \"update | insert\",\n  \"databases\": [],\n  \"credential_lists\": [],\n  \"malware_logs\": [],\n}\n```\nBy default, users receive only documents with the *insert* operation type.  If the corresponding subscription has the dispatch_on_update option enabled, the webhook also sends update events."},{"name":"Profiling","description":"Endpoints for generating OSINT-based profiling reports on email addresses and phone numbers. Reports aggregate data from external intelligence sources, enrich it with internal breach data, and produce an LLM-powered risk analysis.\n\nReports are processed asynchronously through a multi-stage pipeline: `pending` (data collection) → `analyzing` (LLM processing) → `completed`. Use the GET endpoint to poll for completion."},{"name":"Utility Endpoints","description":"Utility endpoints for supporting zero-knowledge functionalities, such as retrieving salts.\nThese operations are essential for the proper functioning of zero-knowledge security features."}],"paths":{"/user":{"get":{"tags":["API User Management"],"summary":"Get user information","description":"Used for getting the profile information associated with the user's credentials used to make the API call.\n\n**Rate limit: 10 per minute.**","operationId":"getUserDetails","responses":{"200":{"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}},"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserDetails"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"type":"object","properties":{"errors":{"type":"object","properties":{"body":{"type":"string","description":"Error description"}}}}}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"BasicAuth":[]}]}},"/user/subscription-endpoint":{"post":{"tags":["API User Management"],"summary":"Update user endpoint information","description":"Used for updating the subscription webhook endpoint information tied to current user.\nUsername and password are optional, these values should only be set if the subscription service uses BasicAuth to connect to the provided endpoint\n\n**Rate limit: 10 per minute.**","operationId":"updateUserEndpointDetails","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionEndpoint"}}}},"responses":{"200":{"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}},"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubscriptionEndpointSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"BasicAuth":[]}]}},"/auth/token":{"post":{"tags":["API User Management"],"summary":"Create API access token","description":"Used for creating the API access token.\n\nAPI access token can then be used for authentication to other non-administrative endpoints.\n\nThe **id** parameter is optional in the request body. Any unique name of alphanumeric characters\nto identify the holder or purpose of this token can be used. If left blank, the id will be assigned randomly.\n\n**Rate limit: 10 per minute.**","operationId":"createAccessToken","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetAccessToken"}}}},"responses":{"200":{"description":"Success","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessToken"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"BasicAuth":[]}]}},"/auth/token/{id}":{"delete":{"tags":["API User Management"],"summary":"Delete API access token","description":"Used for deleting the API access token.\n\nThis operation is non-reversible and the token will not be active anymore with no way to reactivate it.\n\n**Rate limit: 10 per minute.**","operationId":"deleteAccessToken","parameters":[{"$ref":"#/components/parameters/TokenId"}],"responses":{"200":{"description":"Success","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessToken"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"BasicAuth":[]}]},"get":{"tags":["API User Management"],"summary":"Get API access token","description":"Used for getting the API access token.\n\nAPI access token can then be used for authentication to other non-auth endpoints.\n\nToken IDs can be looked up via /user endpoint or created via /auth/token enpoint.\n\n**Rate limit: 10 per minute.**","operationId":"getAccessToken","parameters":[{"$ref":"#/components/parameters/TokenId"}],"responses":{"200":{"description":"Success","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per minute. Defaults 10 per minute"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessToken"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"BasicAuth":[]}]}},"/zero-knowledge/cc/{hash-type}/{hash}":{"get":{"tags":["Credit Card Intelligence"],"summary":"Credit card search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include the credit card number product (**SHA-1** or **Argon2id** hash),\ngenerated using specific secure algorithm.\n\nHashed credit card number is returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these credit cards.\nReturned data is grouped by **origin** & it's hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**)\n**Rate limit: 200 per second.**","operationId":"creditCardSearch","parameters":[{"$ref":"#/components/parameters/HashType"},{"$ref":"#/components/parameters/Hash"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/cc/{hash-type}/{hash-range}":{"get":{"tags":["Credit Card Intelligence"],"summary":"Credit cards search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include first 5 characters of the credit card number product (**SHA-1** or **Argon2id** hash),\ngenerated using specific secure algorithm.\n\nHashed credit card numbers are returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these credit cards.\nReturned data is grouped by **origin** & it's hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**)\n**Rate limit: 200 per second.**","operationId":"creditCardsSearch","parameters":[{"$ref":"#/components/parameters/HashType"},{"$ref":"#/components/parameters/HashRange"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeMultiSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/cc":{"post":{"tags":["Credit Card Intelligence"],"summary":"Bulk credit cards search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include a list of first 5 characters of credit card number products (**SHA-1** or **Argon2id** hash),\ngenerated using specific secure algorithm.\n\nHashed credit card numbers are returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these credit cards.\nReturned data is grouped by **origin** & it's hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**)\n**Rate limit: 200 per second.**","operationId":"creditCardsBulkSearch","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HashRangesSample"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeMultiSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/cc/lite":{"post":{"tags":["Credit Card Intelligence"],"summary":"Bulk lite credit cards search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include a list of first 5 characters of credit card number products (**SHA-1** or **Argon2id** hash),\ngenerated using specific secure algorithm.\n\nHashed credit card numbers are returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these credit cards.\nReturned data is grouped by **origin** and its hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**).\nFor **malware_logs** origin, each record includes **malware_details** (identifier, type, published/updated dates, **system_info**) when available from the malware-log service.\n\n**Rate limit: 200 per second.**","operationId":"creditCardsBulkSearchLite","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HashRangesSample"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeMultiLiteSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/cc/partial/sha256/{hash}":{"get":{"tags":["Credit Card Intelligence"],"summary":"Partial credit cards count lookup","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\nEndpoint is used to lookup the count of compromised credit cards that match the partial hash.\n\nThe request should include a SHA256 hash generated from the first 6 and last 4 digits of the credit card number. \nFor instance, given the credit card number **1234 5678 9012 3456**, the hash should be derived from the exact string **1234563456** (without spaces).\n\nThe response provides the count of matched compromised credit card entries.\n**Rate limit: 200 per second.**","operationId":"partialCreditCardSearch","parameters":[{"$ref":"#/components/parameters/Hash"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgePartialCreditCardsSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/nin/{hash-type}/{hash}":{"get":{"tags":["National Identification Number Intelligence"],"summary":"National identification number search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include the national identification number product (**SHA-1** or **Argon2id** hash),\ngenerated using specific secure algorithm.\n\nHashed national identification number is returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these credit cards.\nReturned data is grouped by **origin** & it's hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**)\n**Rate limit: 200 per second.**","operationId":"ninSearch","parameters":[{"$ref":"#/components/parameters/HashType"},{"$ref":"#/components/parameters/Hash"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/nin/{hash-type}/{hash-range}":{"get":{"tags":["National Identification Number Intelligence"],"summary":"National identification numbers search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include first 5 characters of the national identification number product (**SHA-1** or **Argon2id** hash),\ngenerated using specific secret and secure algorithm.\n\nHashed national identification numbers are returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these nationa identification numbers.\nReturned data is grouped by **origin** & it's hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**)\n**Rate limit: 200 per second.**","operationId":"ninsSearch","parameters":[{"$ref":"#/components/parameters/HashType"},{"$ref":"#/components/parameters/HashRange"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeMultiSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/zero-knowledge/nin":{"post":{"tags":["National Identification Number Intelligence"],"summary":"Bulk national identification numbers search","description":"Zero knowledge endpoints are endpoints for sensitive data specifically designed to avoid the transfer of such data.\n\nThe request must include a list of first 5 characters of the national identification number products (**SHA-1** or **Argon2id** hash),\ngenerated using specific secret and secure algorithm.\n\nHashed national identification numbers are returned in a response that start with the filter characters provided in the request,\ntogether with the list of data categories, that are found in data related to these nationa identification numbers.\nReturned data is grouped by **origin** & it's hex **ID**, where origin is one of the data breach categories (e.g. **databases**, **malware_logs**)\n**Rate limit: 200 per second.**","operationId":"ninsBulkSearch","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HashRangesSample"}}},"required":true},"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"},"description":"Request limit per second. Defaults 200 per second"},"X-RateLimit-Remaining":{"schema":{"type":"integer"},"description":"The number of requests left for the time window."},"X-RateLimit-Reset":{"schema":{"type":"string","format":"date-time"}},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ZeroKnowledgeMultiSample"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}}},"security":[{"ApiKeyAuth":[]}]}},"/email/domain/{domain}":{"get":{"tags":["Email Intelligence","Domain Intelligence"],"summary":"Domain search","description":"Used for looking up all email addresses and their data for a specific domain.\nThese email addresses and their data have been collected and aggregated from various databases openly accessible on the internet.\n\nThe data is returned using pagination by default, pagination behaviour can be modified using **limit** and **offset** parameters.\n\n*Malware documents can be extremely large, so requested documents are capped to return **20** malware logs.\nIf a document contains more malware logs than could be retrieved, **206** response code alongside the *errors* string will be returned\nand the rest of its malware data truncated. Truncated data contains malware IDs that can be used\nto retrieve data using **data-source** endpoints*\n\nDefault is the maximum limit of **100** records \n(If the response returns exactly 100 records, it indicates the potential presence of more records. Initiate a subsequent request to retrieve any additional results)\n\n**Rate limit: 20 per second.**","operationId":"domain","parameters":[{"$ref":"#/components/parameters/Domain"},{"$ref":"#/components/parameters/Limit"},{"$ref":"#/components/parameters/Offset"},{"name":"last-id","in":"query","description":"A faster pagination alternative to offset. Set this instead of offset to get response for further pages quicker.","required":false,"schema":{"type":"string"}},{"$ref":"#/paths/~1email/post/parameters/0"}],"responses":{"200":{"description":"Returns found data","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailsSample"}}}},"206":{"description":"Returns partial found data, with **errors** field on truncated records","headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"},"X-Quota-Limit":{"$ref":"#/components/headers/X-Quota-Limit"},"X-Quota-Remaining":{"$ref":"#/components/headers/X-Quota-Remaining"},"X-Quota-Reset":{"$ref":"#/paths/~1email/post/responses/200/headers/X-Quota-Reset"}},"content":{"application/json":{"schema":{"$ref":"#/paths/~1email/post/responses/206/content/application~1json/schema"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/paths/~1user/get/responses/400/content/application~1json/schema"}}}},"401":{"descrip

# --- truncated at 32 KB (270 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/nord-security/refs/heads/main/openapi/nord-security-nordstellar-enterprise-data-api-openapi.json