Skip to main content
Search harvested-file listings (FileGrabber output) by filename — use this to discover what sensitive documents, key material, configs, or seed-phrase backups were exfiltrated alongside credentials during an infection.

​
Request

POST /v1/search/file · Required scope: search:file (pro and ultra tiers)
ParameterTypeRequiredDefaultDescription
file_namestringYes—Filename or partial filename to search for (substring match), max 200 chars, e.g. "seed.txt"
start_datestring (date-time) | nullNo—Inclusive start filter, clamped by query_window_days
end_datestring (date-time) | nullNo—Inclusive end filter
sort_byinfection_date | date_uploadedNoinfection_dateField to sort on
sort_directionasc | descNodescMust stay constant across pages
cursorstring | nullNo—Pagination token
limitintegerNo251–500, clamped to your tier’s max_rows

​
Example request

curl -X POST https://api.vantaprism.me/v1/search/file \
  -H "api-key: $VANTAPRISM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "file_name": "seed.txt", "limit": 25 }'

​
Response

200 OK — array of FileSearchResult, cursor-paginated. 
{
  "data": [
    {
      "stealer_id": "RL-2026-AC91F3",
      "victim_id": "a3f1c9e8b2d4567890abcdef1234567890abcdef1234567890abcdef123456",
      "original_path": "C:\\Users\\jdoe\\Documents\\wallet.txt",
      "filename": "wallet.txt",
      "ip": "203.0.113.42",
      "country": "US",
      "stealer_family": "RedLine",
      "infection_date": "2026-05-02T14:22:31Z"
    }
  ],
  "nextCursor": null,
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 28.7,
    "tier": "pro",
    "masked_fields": []
  }
}
FieldDescription
stealer_idlog_victim_id of the infected machine
victim_idSHA-256 victim ID — use with Victim Profiles
original_pathFull path on the victim’s disk
filenameFilename, e.g. wallet.txt
ipSource IP of the infected machine
countryISO 3166-1 alpha-2
stealer_family
infection_dateWhen the log was captured

​
Pagination

Cursor-paginated — see Pagination.

​
Errors

StatuscodeCause
400VALIDATION_ERRORfile_name is missing or exceeds 200 characters
400INVALID_CURSORTampered or stale cursor
403FORBIDDEN_SCOPEKey lacks search:file
See Errors for the full catalog.

​
Tier notes

This endpoint requires search:file, which is not included on the free tier — a free-tier key receives 403 FORBIDDEN_SCOPE. Pro and ultra keys both receive original_path, filename, and ip unmasked (the Data Masking free-tier rules for these fields never apply here, since free tier cannot call this endpoint at all).