File Search API

The File Search API exposes the same indexed file-name data used by the File Leak Search page. Use it to search leaked file listings, narrow a search to one event, or request a temporary download URL for an event’s full file list.

Actions

The API supports:

• listing available file-search sources
• searching indexed file lines
• generating a short-lived download URL for an event file list

Endpoints

GET /api/v1/files/list/
GET /api/v1/files/search/{query}/
GET /api/v1/files/search/{query}/wildcard/{wildcard}/from/{from}/to/{to}/
GET /api/v1/files/search/{query}/wildcard/{wildcard}/event/{event_id}/
GET /api/v1/files/download/{event_id}/

Search Parameters

Typical search inputs include:

• query: keyword, phrase, or Boolean expression to search for
• event: optional event ID to limit the search to one event
• from and to: optional import/index timestamp bounds, not event first-seen bounds
• wildcard: true enables broader wildcard matching; false uses normal matching and is the default

The from and to filters refer to when file-list lines were imported into the file-search index. They do not refer to the event’s first_seen timestamp. An event can be first seen on one date and have file listings imported days, weeks, or months later, so a file-search time range can legitimately return files for older events.

Use an event ID whenever possible. It narrows the search, reduces noise, and usually produces faster results.

Result Fields

Search results can include:

• event ID
• matching line or file-list entry
• index timestamp
• event context

Download URLs are temporary. Generate a new URL for each retrieval job instead of storing old URLs.

Search Example

curl -X GET "https://ecrime.ch/api/v1/files/search/example.com/wildcard/false/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

Event-Scoped Search Example

curl -X GET "https://ecrime.ch/api/v1/files/search/dobarro/wildcard/false/event/38576/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

Download URL Example

curl -X GET "https://ecrime.ch/api/v1/files/download/38576/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

Sample Search Response

{
  "status": "200",
  "message": "OK",
  "date": 1781681172,
  "results": 2,
  "data": [
    {
      "event_id": 38576,
      "line": "BANCO/Bancos Dobarro 02-2026.xlsx#_#_#44468",
      "timestamp": 1781676880
    },
    {
      "event_id": 38576,
      "line": "BANCO/Bancos Dobarro 11-2025.xlsx#_#_#44044",
      "timestamp": 1781676880
    }
  ]
}

line contains the matched file-list line. timestamp is the import/index timestamp for the line, not the event first-seen timestamp.