Screenshots API

The Screenshots API exposes screenshot objects captured from monitored sources. Use it to list available screenshots, download the current object for a screenshot filename, and inspect or retrieve historical versions when object versioning is available.

Endpoints

GET /api/v1/screenshots/download/{filename}/
GET /api/v1/screenshots/download/{filename}/version/{versionId}/
GET /api/v1/screenshots/history/{filename}/
GET /api/v1/screenshots/list/

Screenshot downloads may return a direct object response or a temporary retrieval result depending on storage state. When a historical object must be restored before access, retry after the restore window indicated by the response.

Filename Format

Screenshot filenames are object keys based on the event ID:

{event_id}_screenshot.png

For example:

39038_screenshot.png
38576_screenshot.png

Use the exact filename value as the S3 object key. Do not use a full URL, do not omit the .png extension, and do not replace the event ID with the leak-site name. The history endpoint may also resolve the object when the .png suffix is omitted, but integrations should send the full filename.

List Example

curl -X GET "https://ecrime.ch/api/v1/screenshots/list/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

The list endpoint can be slow because it enumerates the screenshot object bucket and resolves leak-site metadata per object. If your workflow already has an event ID, prefer history/{event_id}_screenshot.png/ or download/{event_id}_screenshot.png/.

Download Example

curl -X GET "https://ecrime.ch/api/v1/screenshots/download/39038_screenshot.png/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

History Example

curl -X GET "https://ecrime.ch/api/v1/screenshots/history/39038_screenshot.png/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

Sample History Response

{
  "status": "200",
  "message": "OK",
  "date": 1781681134,
  "results": 1,
  "data": [
    {
      "versionId": "7Jkxf9uZa0lz36BBJY95rqpDI.CxnlRG",
      "leaksite": "Space Bears",
      "filename": "39038_screenshot.png",
      "size": "870375",
      "isLatest": true,
      "date": "2026-06-17T06:44:04+00:00",
      "storageClass": "STANDARD",
      "restoreStatus": null,
      "canDownloadNow": true
    }
  ]
}

History responses include object versioning and storage state. Use canDownloadNow before attempting to download older versions that may be in archive storage.