Get a victim's records for a specific data category

curl --request GET \
  --url https://api.vantaprism.me/v1/victims/{victim_id}/{sub} \
  --header 'api-key: <api-key>'

{
  "data": [
    {
      "victim_id": "<string>",
      "domain": "<string>",
      "url": "<string>",
      "login": "<string>",
      "password": "<string>",
      "browser": "<string>",
      "profile": "<string>",
      "inserted_at": "2023-11-07T05:31:56Z"
    }
  ],
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 42.7,
    "tier": "pro",
    "masked_fields": [
      "password",
      "ip"
    ],
    "freshness_at": "2023-11-07T05:31:56Z"
  }
}

victims

Get a victim's records for a specific data category

Returns up to limit rows of a single data category for one victim. sub must be one of the values below — each requires its own scope, independent of search:stealer (required for the profile endpoint above). Requesting an unmapped sub value returns 404 NOT_FOUND; requesting a valid sub without its scope returns 403 FORBIDDEN_SCOPE.

`sub` value	Required scope	Response shape
`credentials`	`search:login`	`CredentialRecord[]`
`cookies`	`view:cookies`	`CookieRecord[]`
`autofill`	`view:autofill`	`AutofillRecord[]`
`cards`	`view:cards`	`CardRecord[]`
`wallets`	`view:wallets`	`WalletRecord[]`
`files`	`search:file`	`FileSearchResult[]`
`ftp`	`view:ftp`	`FTPRecord[]`
`history`	`view:history`	`HistoryRecord[]`
`keychain`	`view:keychain`	`KeychainRecord[]`
`commands`	`view:commands`	`CommandRecord[]`

The same per-tier field masking described on the Data Masking page applies to every row, exactly as on the equivalent /v1/data/* endpoint.

GET

victims

{victim_id}

{sub}

Get a victim's records for a specific data category

curl --request GET \
  --url https://api.vantaprism.me/v1/victims/{victim_id}/{sub} \
  --header 'api-key: <api-key>'

{
  "data": [
    {
      "victim_id": "<string>",
      "domain": "<string>",
      "url": "<string>",
      "login": "<string>",
      "password": "<string>",
      "browser": "<string>",
      "profile": "<string>",
      "inserted_at": "2023-11-07T05:31:56Z"
    }
  ],
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 42.7,
    "tier": "pro",
    "masked_fields": [
      "password",
      "ip"
    ],
    "freshness_at": "2023-11-07T05:31:56Z"
  }
}

Authorizations

api-key

string

header

required

Static API key, format vp_<env>_<8-hex-prefix>.<40-hex-secret>. Preferred header for server-to-server integrations.

Path Parameters

victim_id

string

required

SHA-256 victim_id (64 lowercase hex chars) or a log_victim_id from a previous search result. Unresolvable log_victim_id values return 404 NOT_FOUND.

sub

enum<string>

required

Which data category to return for this victim.

Available options:

credentials,

cookies,

autofill,

cards,

wallets,

files,

ftp,

history,

keychain,

commands

Query Parameters

limit

integer

default:25

Maximum rows to return. Clamped to your tier's max_rows if lower.

Required range: 1 <= x <= 500

Response

Sub-resource rows for the victim

data

object[]

required

Show child attributes