API reference

Every endpoint is REST over HTTPS and returns JSON. Base URL: https://api.lxrd.dev

Authentication

Pass your key in the x-api-key header on every request. Find your key on the dashboard. Never ship it in client-side code — proxy through your own backend.

curl -X POST "https://api.lxrd.dev/v2/search" \
  -H "x-api-key: $LXRD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "user@example.com"}'

Search response

Each source is resolved independently. A source that fails appears under errors keyed by name, while the rest still return — a partial failure never fails the whole request.

{
  "query": "user@example.com",
  "type": "email",
  "breach":  { "items": [...], "total": 1420, "nextCursor": "AoJw3ZD..." },
  "stealer": { "items": [...], "total": 37,   "nextCursor": null },
  "osint":   { "email": {...}, "google": {...} },
  "errors":  {}
}

Endpoints

POST/v2/search

Unified search. One query is classified, then run against breach records, stealer logs, and the OSINT providers that fit that query type — in parallel, as a single billable lookup.

{ "query": "user@example.com" }

Detected types: email · username · ip · domain · phone · discord

POST/v2/bulk

Submit many terms as one asynchronous job. Requires Starter plan or higher.

{ "terms": ["example.com", "other.com"], "service": "breach", "format": "json" }

service: breach · stealer · victims — format: csv · json · jsonl · txt · html

GET/v2/bulk/{job_id}

Poll a bulk job for status and results.

status: queued · running · completed · failed

Response codes

`400`	Missing or invalid query / field
`401`	Missing or invalid API key
`403`	Plan does not include this endpoint, or account suspended
`429`	Rate limit exceeded for your plan
`502`	Upstream index unavailable — retry with backoff

Rate limits

Limits are per plan and reset daily: Free 50/day, Starter 2,000/day, Pro and Enterprise unlimited. Bulk jobs cap term counts at 5, 50, 500, and 5,000 respectively. Exceeding a limit returns 429 with a Retry-After header.