{ "openapi": "3.0.1", "info": { "title": "CheckLeaked.cc — Breach & OSINT Suite", "description": "Full CheckLeaked.cc API as an Apify actor: Dehashed, Experimental (Snusbase), LeakCheck, Crack Hash, IP Lookup, Google Hunt (GHunt), plus a combined OSINT report mode that fans out every identifier across every service in a single run.", "version": "1.1", "x-build-id": "sggSALbrpBaZjjHI7" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/eduair94~checkleaked-cc/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-eduair94-checkleaked-cc", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/eduair94~checkleaked-cc/runs": { "post": { "operationId": "runs-sync-eduair94-checkleaked-cc", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/eduair94~checkleaked-cc/run-sync": { "post": { "operationId": "run-sync-eduair94-checkleaked-cc", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "mode" ], "properties": { "apiKey": { "title": "CheckLeaked.cc bot API key", "type": "string", "description": "Your bot token from https://checkleaked.cc/botLinks — sent as the `api-key` header on every request. Required for every mode except `pwned_password` and `breach_info` (open, free routes)." }, "leakCheckKey": { "title": "LeakCheck.io API key (optional)", "type": "string", "description": "Optional. Your own LeakCheck.io key for the LeakCheck engine (`leak_check`, `deep_search`, `osint_report`). Without it the key stored on your CheckLeaked account, else the system key, is used. If you bring your own, whitelist the gateway IP `192.126.161.211` in your LeakCheck.io dashboard." }, "mode": { "title": "Mode", "enum": [ "deep_search", "investigate", "osint_report", "dehashed", "experimental", "leak_check", "crack_hash", "ip_lookup", "ghunt", "domain_whois", "hibp", "leakradar_email", "leakradar_raw", "leakradar_domain", "dark_web", "pwned_password", "breach_info" ], "type": "string", "description": "Which tool to run.\n\n- **deep_search** ★ — one identifier, EVERY engine at once (LeakCheck + Have I Been Pwned, Snusbase with load-all, Dehashed paginated, LeakRadar stealer logs), optional linked-identity pivots and stealer-log credential extraction, then the Pro AI intelligence dossier (risk score, identity, credential statistics, attack scenarios, recommendations), optionally as PDF, and/or a WormGPT web investigation grounded on the findings.\n- **investigate** — WormGPT AI web investigation only: the agent searches the web and runs the OSINT tools itself, returns a Markdown dossier with sources (Pro; one WormGPT quota unit per query, no search credit).\n- **osint_report** — the classic fan-out per identifier (LeakCheck, Snusbase, Dehashed, crack hash, IP lookup, GHunt, WHOIS + LeakRadar exposure for domains) with a heuristic risk score.\n- **dehashed** / **experimental** / **leak_check** / **crack_hash** / **ip_lookup** / **ghunt** — one engine each.\n- **domain_whois** — registrar, dates, name servers, contacts.\n- **hibp** — full Have I Been Pwned breach list for an email (one row per breach).\n- **leakradar_email** — stealer-log credential leaks for an email/username (paginated).\n- **leakradar_raw** — free-text search over raw stealer-log blocks, optional credential extraction.\n- **leakradar_domain** — composite domain exposure report (employees / customers / third parties, subdomains, URLs).\n- **dark_web** — indexed dark-web forum/market posts (paginated).\n- **pwned_password** — k-anonymity pwned-password check (free, no key).\n- **breach_info** — one breach's registry record (free, no key).", "default": "deep_search" }, "queries": { "title": "Queries to run", "type": "array", "description": "One row per lookup. Each row has an `entry` (the value to look up) and an optional `type` (how to interpret it). In `deep_search`, `investigate`, `leak_check` and `osint_report` the `type` is optional — if omitted, the actor detects it (email / ip_address / hash / phone / domain / username / keyword).\n\nAllowed `type` values per mode:\n- deep_search / investigate / osint_report: email, username, phone, domain, ip_address, hash, name, keyword (auto-detected when omitted)\n- dehashed: email, username, ip_address, name, address, phone, vin, free\n- experimental: email, username, mass, password, name, hash, lastip\n- leak_check: auto, email, username, keyword, domain, phone, hash, password, origin, phash (plus legacy: mass, login, pass_email, domain_email, pass_login)\n- leakradar_email: (email or username — `type: username` forces the username reading)\n- pwned_password: (a 40-hex entry is sent as SHA-1; `type: ntlm` + 32-hex sends an NTLM hash; anything else is the plaintext password, hashed before it leaves)\n- crack_hash / ip_lookup / ghunt / domain_whois / hibp / leakradar_raw / leakradar_domain / dark_web / breach_info: type ignored — `entry` is the hash / IP / Gmail / domain / email / search text / breach name", "default": [] }, "singleEntry": { "title": "Single entry (shortcut)", "type": "string", "description": "Convenience field — if `queries` is empty, the actor treats this as a single query with the `singleType` below. Ideal for one-shot API calls / Zapier / Make integrations." }, "singleType": { "title": "Single entry type (shortcut)", "type": "string", "description": "Type for `singleEntry`. Leave empty for auto-detect (deep_search / investigate / leak_check / osint_report)." }, "engines": { "title": "Deep Search engines", "type": "array", "description": "`deep_search` only. Which engines to run per identifier. Default: all five. `hibp` rides on the LeakCheck call (one credit for both).", "items": { "type": "string", "enum": [ "leakcheck", "hibp", "experimental", "dehashed", "raw" ], "enumTitles": [ "LeakCheck", "Have I Been Pwned", "Experimental / Snusbase (load-all)", "Dehashed", "LeakRadar raw stealer logs" ] }, "default": [ "leakcheck", "hibp", "experimental", "dehashed", "raw" ] }, "pivotCap": { "title": "Linked identities to follow (deep_search)", "minimum": 0, "maximum": 25, "type": "integer", "description": "`deep_search` only. After the seed search, follow up to this many linked identities the results surfaced (other e-mails, reused usernames, phones), best first, up to five hops deep (a handle found at hop 4 is still searched at hop 5). Each pivot is a FULL search across the enabled engines and is billed like one. 0 = off.", "default": 0 }, "rawExtract": { "title": "Unlock & extract stealer-log credentials", "type": "boolean", "description": "`deep_search` and `leakradar_raw`. Unlock the matched raw blocks and emit the parsed credential records (url / username / password, hash-flagged) as `raw_credential` rows; in `deep_search` they also feed the AI dossier. Costs one upstream part fetch per unlocked block (see `rawMaxHits`).", "default": false }, "rawMaxHits": { "title": "Blocks to unlock per query (rawExtract)", "minimum": 1, "maximum": 100, "type": "integer", "description": "How many matched raw blocks to unlock and parse per query when `rawExtract` is on.", "default": 10 }, "aiReport": { "title": "AI intelligence dossier (deep_search)", "type": "boolean", "description": "`deep_search` only. After the engines (and pivots) finish, generate the Pro AI intelligence report over EVERYTHING found: executive summary, 0-100 risk, consolidated identity, credential statistics, password analysis, breaches, cross-engine correlations, attack scenarios, recommendations. No extra search credit; needs a Pro subscription on CheckLeaked.cc. Skipped automatically when nothing was found.", "default": true }, "enrichment": { "title": "OSINT enrichment (deep_search)", "type": "boolean", "description": "`deep_search` only. Before the AI dossier, run first-party OSINT lookups over the identities the search surfaced — GHunt Google-account profile (with avatar, Local Guide standing, services) for each e-mail, and IP geolocation for each IP — and feed them to the report as grounded facts (the Google avatar is embedded in the PDF). Each lookup is billed on your account (Pro for GHunt) and charged as a `ghunt-profile` / `ip-lookup-record` PPE event.", "default": true }, "reportPdf": { "title": "Also typeset the dossier as PDF", "type": "boolean", "description": "`deep_search` only. Store the dossier as an A4 PDF in the run's key-value store (`DEEP_REPORT__.pdf`); the report row carries its `pdfUrl`.", "default": false }, "webInvestigation": { "title": "WormGPT web investigation (deep_search)", "type": "boolean", "description": "`deep_search` only. Also run the WormGPT investigation agent, grounded on the findings: it searches the web and runs the OSINT tools itself and returns a Markdown dossier with sources (stored as `INVESTIGATION__.md`). Pro; one unit of your WormGPT daily quota per identifier, separate from search credits.", "default": false }, "startPage": { "title": "Start page (dehashed)", "minimum": 1, "maximum": 10000, "type": "integer", "description": "First page to fetch in `dehashed` mode. Ignored by every other mode.", "default": 1 }, "maxPages": { "title": "Max pages per query", "minimum": 1, "maximum": 10000, "type": "integer", "description": "Hard cap on pages fetched per query for the paginated engines (`dehashed`, `leakradar_email`, `leakradar_raw`, `dark_web`, and Dehashed / raw inside `deep_search`). Each page is billed. The actor stops earlier on an empty or last page. Set to 1 to disable auto-pagination.", "default": 5 }, "pageSize": { "title": "Page size (LeakRadar / dark web)", "minimum": 1, "maximum": 100, "type": "integer", "description": "Items per page for `leakradar_email` (max 50), `leakradar_raw` and `dark_web` (max 100), and the raw engine inside `deep_search`.", "default": 50 }, "loadAll": { "title": "Load all (experimental)", "type": "boolean", "description": "When true and mode is `experimental` or `osint_report`, the actor appends `?loadAll=true` so CheckLeaked.cc auto-expands every truncated row into its full breach record. Requires a Pro/Plus subscription. `deep_search` always loads all.", "default": false }, "includeUnverified": { "title": "Include unverified breaches (hibp)", "type": "boolean", "description": "`hibp` mode only. Include breaches HIBP has not verified.", "default": true }, "includeRawResponse": { "title": "Include raw upstream response", "type": "boolean", "description": "If true, every dataset item keeps a `raw` field with the untouched upstream JSON. Handy for debugging / schema discovery; doubles dataset size.", "default": false }, "maskPasswords": { "title": "Mask passwords & hashes in output", "type": "boolean", "description": "Redact every credential field (`password`, `hashed_password`, `hash`, cracked / recovered plaintext, the dossier's password lists, the password half of `login:password` lines) before writing to the dataset. Use this when the run output will be shared with non-privileged viewers.", "default": false }, "maxConcurrency": { "title": "Max concurrent queries", "minimum": 1, "maximum": 50, "type": "integer", "description": "How many queries run in parallel. CheckLeaked.cc enforces per-plan cooldowns; keep this ≤ 3 for Free, ≤ 10 for Plus, ≤ 25 for Pro. The AI steps (dossier, web investigation) always take turns 15 s apart, and `investigate` mode runs one query at a time.", "default": 3 }, "delayMs": { "title": "Delay between requests (ms)", "minimum": 0, "maximum": 600000, "type": "integer", "description": "Sleep added after each completed request per worker. Use to stay under the per-plan cooldown (Free = 10s, Plus = 2s, Pro = 0s).", "default": 0 }, "maxRetries": { "title": "Max retries per request", "minimum": 0, "maximum": 10, "type": "integer", "description": "On 429 / 5xx / network errors the actor retries with exponential backoff. The AI endpoints are never retried by transport (a timed-out report is still running server-side); only their cooldown refusals are retried.", "default": 4 }, "requestTimeoutSecs": { "title": "Request timeout (seconds)", "minimum": 10, "maximum": 1800, "type": "integer", "description": "Per-request HTTP timeout for the search engines. Dehashed can be slow on cold cache — keep ≥ 120. The AI endpoints use their own budgets (~3 min).", "default": 180 }, "proxyConfiguration": { "title": "Proxy", "type": "object", "description": "Optional Apify proxy. CheckLeaked.cc does not require one (auth is by API key), but a proxy can help if your plan has IP-based cooldowns or you want to rotate outbound IPs.", "default": { "useApifyProxy": false } }, "stopOnError": { "title": "Stop on first hard error", "type": "boolean", "description": "If true, the actor aborts the run on any 4xx that isn't 404/429. If false, errors are written to the dataset as records with `source: checkleaked.cc/error` and the run continues.", "default": false } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }