Skip to main content
A global view of which domains have the most unique infected victims with saved credentials, over a configurable look-back window — useful for trend reports, dashboards, or industry benchmarking. Requires only a valid API key.

​
Request

GET /v1/domain/top-exposed · Required scope: none (any valid key) · Aggregation (counts toward agg_per_min) · Not paginated
ParameterLocationTypeRequiredDefaultDescription
limitqueryintegerNo201–100 domains to return
daysqueryintegerNo30Look-back window, 7–365 days

​
Example request

curl "https://api.vantaprism.me/v1/domain/top-exposed?limit=20&days=30" \
  -H "api-key: $VANTAPRISM_API_KEY"

​
Response

200 OK — array of TopExposedDomainResult, ordered by unique_victims descending. Not masked. 
{
  "data": [
    { "domain": "google.com", "unique_victims": 184302, "credential_count": 251904 },
    { "domain": "facebook.com", "unique_victims": 156221, "credential_count": 198734 },
    { "domain": "microsoft.com", "unique_victims": 98112, "credential_count": 142890 }
  ],
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 18.4,
    "tier": "free",
    "freshness_at": "2026-06-15T09:00:00Z"
  }
}
FieldDescription
domainThe domain
unique_victimsDistinct infected machines with at least one credential for this domain in the window
credential_countTotal credential rows for this domain in the window

​
Caching

Cached for roughly 1 hour — meta.freshness_at reflects the last computation time.

​
Errors

StatuscodeCause
400VALIDATION_ERRORlimit > 100 or days out of range
429RATE_LIMIT_EXCEEDEDExceeded agg_per_min
See Errors for the full catalog.