Request
POST /v1/data/autofill · Required scope: view:autofill (pro and ultra tiers)
At least one of name_contains, start_date, or end_date is required.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
name_contains | string | null | One of name_contains/start_date/end_date required | — | Case-insensitive substring match against the autofill field name, e.g. "email", "phone" |
start_date | string (date-time) | null | See above | — | Inclusive start filter, clamped by query_window_days |
end_date | string (date-time) | null | See above | — | Inclusive end filter |
sort_direction | asc | desc | No | desc | Must stay constant across pages |
cursor | string | null | No | — | Pagination token |
limit | integer | No | 25 | 1–500, clamped to your tier’s max_rows |
Example request
Response
200 OK — array of AutofillRecord, cursor-paginated.
| Field | Description |
|---|---|
victim_id | SHA-256 victim ID — use with Victim Profiles |
browser | Browser the value was harvested from |
profile | Browser profile name |
name | Autofill field name, e.g. "email", "phone", "address_line1" |
value | The stored autofill value. Returned as "[REDACTED]" on free tier |
inserted_at | When the record was ingested |
Pagination
Cursor-paginated — see Pagination.Errors
| Status | code | Cause |
|---|---|---|
| 400 | VALIDATION_ERROR | None of name_contains, start_date, end_date provided |
| 400 | INVALID_CURSOR | Tampered or stale cursor |
| 403 | FORBIDDEN_SCOPE | Key lacks view:autofill (free tier) |
Tier notes
This endpoint requiresview:autofill, which is not included on the free
tier — a free-tier key receives 403 FORBIDDEN_SCOPE. Pro and ultra tiers
receive value raw; returning a raw value is logged to the
api_raw_access audit table.