API Documentation

Build with SocialEye

Integrate threat intelligence directly into your applications with our powerful REST API.

1. Get API Key

Create an account and generate your API key from the dashboard.

2. Make a Request

Send authenticated requests to our REST endpoints.

3. Get Results

Receive structured JSON responses with intelligence data.

Quick Example

import requests

API_KEY = "sk_live_..."
BASE_URL = "https://socialeye.net"

# Resolve a handle
def resolve_handle(handle):
    response = requests.post(
        f"{BASE_URL}/api/resolve",
        headers={
            "Authorization": f"Bearer {API_KEY}",
            "Content-Type": "application/json"
        },
        json={"handle": handle}
    )
    return response.json()

# Search breach databases (Operative+)
def search_breaches(search_type, term):
    response = requests.post(
        f"{BASE_URL}/api/database/search",
        headers={
            "Authorization": f"Bearer {API_KEY}",
            "Content-Type": "application/json"
        },
        json={"type": search_type, "term": term}
    )
    return response.json()

# Search stealer logs (GOD tier only)
def search_stealer_logs(search_type, term):
    response = requests.post(
        f"{BASE_URL}/api/stealer-logs/search",
        headers={
            "Authorization": f"Bearer {API_KEY}",
            "Content-Type": "application/json"
        },
        json={"type": search_type, "term": term, "limit": 50}
    )
    return response.json()

# Example usage
breaches = search_breaches("email", "[email protected]")
print(f"Found {breaches['data']['found']} breach records")

Authentication

All API requests require authentication via Bearer token. Include your API key in the Authorization header of every request:

Authorization: Bearer sk_live_your_api_key_here

Security Note: Never expose your API key in client-side code. Always make API calls from your backend server.

API Endpoints

Breach Search - Operative+ Stealer Logs - GOD only File Browser - GOD only
POST/api/resolve

Resolve a handle/username to associated profiles, breach data, and stealer logs

Request Parameters

handle: string (required) - The username/handle to resolve

Response Example

{
  "success": true,
  "data": {
    "target": { "handle": "johndoe", "x": {...}, "instagram": {...} },
    "intelligence": { "former_usernames": [...] },
    "stealer_logs": { "total_found": 3, "results": [...] },
    "quota": { "remaining": 499, "limit": 500, "tier": "OPERATIVE" }
  }
}
POST/api/database/search

Search breach databases for exposed credentials and personal data

Request Parameters

type: string (required) - Search type: username, email, password, ip, name, phone
term: string (required) - The search term

Response Example

{
  "success": true,
  "data": {
    "found": 15,
    "databases": 3,
    "elapsed": "0.234s",
    "results": [
      {
        "id": "...",
        "email": "[email protected]",
        "password": "••••••••",
        "source": { "name": "breach_2023", "date": "2023-06-15" }
      }
    ]
  }
}
POST/api/stealer-logs/search

Search stealer logs for compromised credentials (GOD tier only)

Request Parameters

type: string (required) - Search type: email, username, domain, password
term: string (required) - The search term
limit: number (optional) - Results per page, default 35
offset: number (optional) - Pagination offset, default 0
sort: object (optional) - { field: "time_ingested", order: "desc" | "asc" }

Response Example

{
  "success": true,
  "data": {
    "count": 12,
    "elapsed": "0.156s",
    "results": [
      {
        "id": "log_abc123",
        "data_type": "stealerlog",
        "origin": "https://example.com/login",
        "login": "[email protected]",
        "password": "exposed_pass",
        "time_ingested": "2024-01-15T10:30:00Z",
        "source": { "channel_name": "...", "platform": "telegram" }
      }
    ],
    "pagination": { "next": { "offset": 35, "limit": 35 } }
  }
}
POST/api/stealer-logs/file/[id]/[type]

Browse detailed contents of a stealer log (GOD tier only)

Request Parameters

id: string (path) - The stealer log ID from search results
type: string (path) - File type: credentials, cookies, autofills, softwares, system
limit: number (optional) - Results per page, default 20
offset: number (optional) - Pagination offset, default 0

Response Example

// Example for type=credentials:
{
  "success": true,
  "data": {
    "count": 45,
    "credentials": [
      { "origin": "https://bank.com", "login": "[email protected]", "password": "...", "file": "..." }
    ],
    "pagination": { "next": { "offset": 20, "limit": 20 } }
  }
}

// Example for type=cookies:
{
  "success": true,
  "data": {
    "count": 120,
    "cookies": [
      { "domain": ".google.com", "name": "session", "value": "...", "expires": 1735689600 }
    ]
  }
}

// Example for type=system:
{
  "success": true,
  "data": {
    "high_risk": [{ "key": "IP Address", "value": "192.168.1.1" }],
    "info": { "OS": "Windows 10", "Username": "victim_user" }
  }
}
GET/api/history

Retrieve your search history

Response Example

{
  "success": true,
  "data": [
    {
      "id": "...",
      "query": "johndoe",
      "timestamp": "2024-03-20T10:00:00Z",
      "summary": { "profiles_found": 2, "breaches_found": 5 }
    }
  ]
}
GET/api/auth/me

Get current account information and tier

Response Example

{
  "success": true,
  "data": {
    "id": "user_...",
    "email": "[email protected]",
    "plan": "OPERATIVE",
    "quota": { "used": 10, "limit": 500 }
  }
}
GET/api/settings/api-key

Get API key status and settings

Response Example

{
  "success": true,
  "data": {
    "key_preview": "sk_live_...abcd",
    "created_at": "2024-01-01T00:00:00Z",
    "last_used": "2024-03-20T10:00:00Z"
  }
}
POST/api/settings/api-key

Generate or regenerate API key

Response Example

{
  "success": true,
  "data": {
    "api_key": "sk_live_very_long_secret_key"
  }
}
GET/api/settings/ips

Get whitelisted IP addresses

Response Example

{
  "success": true,
  "data": [
    { "ip": "1.1.1.1", "label": "Office VPN", "created_at": "..." }
  ]
}
POST/api/settings/ips

Add an IP to whitelist

Request Parameters

ip: string (required) - IPv4 address to whitelist
label: string (optional) - Description for this IP

Response Example

{
  "success": true,
  "data": { "ip": "1.1.1.1", "label": "Office VPN" }
}

Rate Limits & Access

PlanBreach SearchStealer LogsRate LimitWhitelisted IPs
FreeNo AccessNo Access--
AnalystNo AccessNo Access--
OperativeFull AccessNo Access1 req/sec3
SovereignFull AccessNo Access3 req/sec10
GODFull AccessFull AccessUnlimitedUnlimited

GOD Tier Exclusive: Stealer logs search and file browser APIs are only available to GOD tier users. Contact sales to upgrade and unlock full stealer log access via API.

IP Whitelisting: For security, API requests are validated against your whitelisted IPs. You must configure at least one IP in Dashboard → Settings → API Access before using the API.

Rate Limit Headers: All API responses include rate limit information in the headers:

X-RateLimit-Limit: Maximum requests per second
X-RateLimit-Remaining: Requests remaining in current window
X-RateLimit-Reset: Seconds until the rate limit resets

429 Too Many Requests: If you exceed your rate limit, the API will return a 429 status code. Wait for the time specified in retryAfterMs before retrying.

Ready to get started?

Create an account and get your API key in minutes.