Skip to main content
Export raw login/password credential rows filtered by domain and/or login. Use this for bulk export into your own SIEM, data warehouse, or credential-monitoring pipeline — unlike the End User Protection endpoints, which are designed for single-identifier lookups, this endpoint is built for filtered bulk retrieval.

​
Request

POST /v1/data/credentials · Required scope: search:domain (all tiers) At least one of domains or logins is required.
ParameterTypeRequiredDefaultDescription
domainsstring[]One of domains/logins required[]Registrable domains to filter by, e.g. ["acme-corp.com"]
loginsstring[]One of domains/logins required[]Exact login/email values to filter on
typeemployees | users | bothNobothSee Domain Intelligence Overview
start_datestring (date-time) | nullNo—Inclusive start filter, clamped by query_window_days
end_datestring (date-time) | nullNo—Inclusive end filter
sort_directionasc | descNodescMust stay constant across pages
cursorstring | nullNo—Pagination token
limitintegerNo251–500, clamped to your tier’s max_rows

​
Example request

curl -X POST https://api.vantaprism.me/v1/data/credentials \
  -H "api-key: $VANTAPRISM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "domains": ["acme-corp.com"], "limit": 25 }'

​
Response

200 OK — array of CredentialRecord, cursor-paginated. 
{
  "data": [
    {
      "victim_id": "a3f1c9e8b2d4567890abcdef1234567890abcdef1234567890abcdef123456",
      "domain": "acme-corp.com",
      "url": "https://login.microsoftonline.com/***",
      "login": "j.***@acme-corp.com",
      "password": "••••",
      "browser": "Chrome",
      "profile": "Default",
      "inserted_at": "2026-05-02T14:22:31Z"
    }
  ],
  "nextCursor": null,
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 36.9,
    "tier": "free",
    "masked_fields": ["url", "login", "password"]
  }
}
FieldDescription
victim_idSHA-256 victim ID — use with Victim Profiles
domainRegistrable domain extracted from url
urlMasked to scheme://host/*** on free tier
loginMasked via partial_login on free tier
passwordMasked to "••••" on free tier
browserBrowser the credential was harvested from
profileBrowser profile name
inserted_atWhen the record was ingested

​
Pagination

Cursor-paginated — see Pagination.

​
Errors

StatuscodeCause
400VALIDATION_ERRORNeither domains nor logins provided
400INVALID_CURSORTampered or stale cursor
403FORBIDDEN_SCOPEKey lacks search:domain
See Errors for the full catalog.

​
Tier notes

url, login, and password are masked per the standard free-tier rules in Data Masking. If a logins value you searched for exactly matches the returned login, it is returned unmasked per the “searched value is never masked” rule; matches found only via domains remain masked on free tier.