Skip to main content
Export macOS Keychain entries harvested from infected Macs, filtered by entry name substring and/or date range. Keychain often holds Wi-Fi passwords, app credentials, and certificates — a high-value category for understanding the full blast radius of a macOS infection.

​
Request

POST /v1/data/keychain · Required scope: view:keychain (ultra tier only) At least one of name_contains, start_date, or end_date is required.
ParameterTypeRequiredDefaultDescription
name_containsstring | nullOne of the three required—Case-insensitive substring match against the Keychain entry name, e.g. "github"
start_datestring (date-time) | nullSee above—Inclusive start filter, clamped by query_window_days
end_datestring (date-time) | nullSee above—Inclusive end filter
sort_directionasc | descNodescMust stay constant across pages
cursorstring | nullNo—Pagination token
limitintegerNo251–500, clamped to your tier’s max_rows

​
Example request

curl -X POST https://api.vantaprism.me/v1/data/keychain \
  -H "api-key: $VANTAPRISM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name_contains": "github", "limit": 25 }'

​
Response

200 OK — array of KeychainRecord, cursor-paginated. 
{
  "data": [
    {
      "victim_id": "a3f1c9e8b2d4567890abcdef1234567890abcdef1234567890abcdef123456",
      "name": "github.com",
      "value": "ghp_1A2b3C4d5E6f7G8h9I0jKlMnOpQrStUvWxYz",
      "inserted_at": "2026-05-02T14:22:31Z"
    }
  ],
  "nextCursor": null,
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 22.3,
    "tier": "ultra",
    "masked_fields": []
  }
}
FieldDescription
victim_idSHA-256 victim ID — use with Victim Profiles
nameKeychain entry name, e.g. a hostname or app/service identifier
valueThe stored Keychain secret. Returned as "[REDACTED]" on free/pro tiers (keychain_value)
inserted_atWhen the record was ingested

​
Pagination

Cursor-paginated — see Pagination.

​
Errors

StatuscodeCause
400VALIDATION_ERRORNone of name_contains, start_date, end_date provided
400INVALID_CURSORTampered or stale cursor
403FORBIDDEN_SCOPEKey lacks view:keychain (free and pro tiers)
See Errors for the full catalog.

​
Tier notes

view:keychain is part of ALL_SCOPES but only granted to the ultra tier — free and pro keys receive 403 FORBIDDEN_SCOPE. Even on pro tier (hypothetically), value (keychain_value) would be returned as "[REDACTED]"; only ultra returns it raw. Returning a raw keychain_value is logged to the api_raw_access audit table.