Skip to main content
A richer version of Search Domains for companies that authenticate through external identity providers (Okta, Azure AD, etc.). Every result is classified as employee, user, or third_party so you can prioritize corporate-account compromises.

​
Request

POST /v1/domain/company · Required scope: search:domain (all tiers)
ParameterTypeRequiredDefaultDescription
domainsstring[]Yes—Primary company domains, min 1 item. e.g. ["acme-corp.com"]
external_domainsstring[]No[]SSO/IdP or other external app domains, e.g. ["acme-corp.okta.com"] — logins here are classified employee too
typeemployees | users | bothNobothSee Overview
start_datestring (date-time) | nullNo—Inclusive start filter, clamped by query_window_days
end_datestring (date-time) | nullNo—Inclusive end filter
sort_directionasc | descNodescMust stay constant across pages
cursorstring | nullNo—Pagination token
limitintegerNo251–500, clamped to your tier’s max_rows

​
Example request

curl -X POST https://api.vantaprism.me/v1/domain/company \
  -H "api-key: $VANTAPRISM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["acme-corp.com"],
    "external_domains": ["acme-corp.okta.com"],
    "limit": 25
  }'

​
Response

200 OK — array of DomainCompanyResult (a DomainSearchResult plus credential_type), cursor-paginated. 
{
  "data": [
    {
      "stealer_id": "RL-2026-AC91F3",
      "victim_id": "a3f1c9e8b2d4567890abcdef1234567890abcdef1234567890abcdef123456",
      "domain": "acme-corp.okta.com",
      "url": "https://acme-corp.okta.com/app/UserHome",
      "username": "jondoe@*******.com",
      "password": "••••",
      "infection_date": "2026-05-02T14:22:31Z",
      "type": "employee",
      "credential_type": "employee"
    }
  ],
  "nextCursor": null,
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 41.0,
    "tier": "free",
    "masked_fields": ["username", "password"]
  }
}
FieldDescription
credential_typeemployee — login belongs to domains or external_domains; user — external account on a domains URL; third_party — neither, but co-present on the same infected machine
All other fields are identical to DomainSearchResult.

​
Pagination

Cursor-paginated — see Pagination.

​
Errors

StatuscodeCause
400VALIDATION_ERRORdomains is empty or exceeds limits
400INVALID_CURSORTampered or stale cursor
403FORBIDDEN_SCOPEKey lacks search:domain
See Errors for the full catalog.

​
Tier notes

Same masking and clamping behavior as Search Domains.