API reference
Every request carries a partner key in the Authorization header as a bearer token. A reading is started by domain and read back by its id. Every example below uses an invented firm on a reserved .example name.
POST /api/v1/layer/readings/
Body: the domain and the grade, one of stage_a, full or record. A live key answers 202 with the reading's id. A reading is drawn from the block balance when it is asked for and credited back when it is not made.
The record needs firm_contact, an address at the firm's own domain. The record is read only with the firm's own consent. We email the firm's address a consent page and read nothing until it agrees. The firm's contact is asked for consent by email. Nothing is read until the firm agrees. A request not answered in 14 days lapses and nothing is charged. Until the firm answers, the reading's state is awaiting_consent.
curl -X POST https://getleaktrace.com/api/v1/layer/readings/ \
-H "Authorization: Bearer lt_..." \
-H "Content-Type: application/json" \
-d '{"domain": "harbourview-law.example", "grade": "record",
"firm_contact": "[email protected]"}' {"data": {"reading_id": "6f1c...", "domain": "harbourview-law.example",
"grade": "record", "state": "awaiting_consent"}, "status": 202} | Depth | What it holds | Scale |
|---|---|---|
stage_a | First stage. The mail records, the certificate, look-alike registrations and their mail. | Read with 46 techniques in the first stage and up to 350 look-alike addresses an attacker could register from the firm's name, checked by DNS. Breach data, searches and look-alike pages wait for the full reading. |
full | Full reading. The full reading's mail, certificate, website-software and breach rows with their evidence, and look-alike domains worth a look, the paid-only parts left out. | Read with 52 techniques, 11 routes to the firm's money, clients, accounts and name and up to 350 look-alike addresses an attacker could register from the firm's name. |
record | Dated record. The full-depth reading the firm itself consents to, issued as three documents and a dated record of the assessment, with a reference and fingerprint. | Read with the firm's consent, with 75 techniques and 16 routes: the ports on up to 8 hosts, 26 private-file addresses, up to 30 of its own pages and up to 8 domains it owns. |
Metered per reading, in prepaid blocks. The figures are in the agreement.
GET /api/v1/layer/readings/<reading_id>/
The state is awaiting_consent, queued, running, ready, not_read, declined or lapsed. Once ready, reading holds the rows read from public records with their evidence, look-alike domains worth a look, the line on other names and the date of the reading. A record adds its reference, its SHA-256 fingerprint and the link that checks both.
{"data": {"reading_id": "6f1c...", "state": "ready", "depth": "record",
"reading": {"domain": "harbourview-law.example", "read_on": "4 November 2026",
"stage": "B",
"rows": [{"id": "dmarc", "label": "Email authentication (DMARC)",
"answer": "No", "evidence": "..."}],
"lookalikes": [{"name": "harbourview-1aw.example", "registered": "...",
"line": "..."}]},
"record": {"reference": "LT-XLR-2026-....", "sha256": "...",
"verify_url": "https://getleaktrace.com/verify/LT-XLR-2026-..../?fp=...",
"pdf": "/api/v1/layer/readings/6f1c.../record.pdf"}}, "status": 200} GET /api/v1/layer/readings/<reading_id>/record.pdf
The one-page dated record, for the record grade. Its fingerprint is the SHA-256 of these bytes. Anyone can check the reference and the fingerprint together at getleaktrace.com/verify/.
GET /api/v1/layer/readings/<reading_id>/documents/<key>.pdf
Three documents and a dated record. Each is listed in record.documents with its own fingerprint, which /verify/ confirms with the record's reference.
GET /api/v1/layer/balance/
The block balance, the partner's price list as accepted, the agreement version, today's count of readings and the day's cap.
A reading that is not made answers not_read with one sentence, 30 minutes after it was asked, whatever the reason: "This domain was not read. Nothing was charged." A reading reveals nothing about who buys from LeakTrace. Every firm is read fresh, the same way.
Build before a block is bought
A sandbox key reads the demonstration records only and never makes a read. It answers at once, with nothing charged, and a record's PDF follows within a minute. The demonstration names:
harbourview-law.exampleharbourview-llp.examplesample-firm.example
Any other name answers 403: "A sandbox key reads the demonstration records only."
Each key may make 30 requests a minute. A live partner may start 250 metered readings a Toronto day. The sandbox answers 100 a day.
| Status | When |
|---|---|
401 | No key, or a key that is not valid. |
402 | The block balance does not cover this reading. Nothing was read or charged. |
403 | LeakTrace's own domains are not read through LeakTrace Core. Accept the current LeakTrace Core agreement before a metered reading. |
429 | Over the key's requests a minute, or today's reading cap for this partner is reached. it resets at midnight, toronto time. |
Notifications: set a webhook address on the account page. Events: a reading done, a consent accepted, declined or lapsed. Each is signed with X-LeakTrace-Signature, the HMAC-SHA256 of the body with your secret. The body names the event (reading.ready, reading.not_read, consent.accepted, consent.declined, consent.lapsed) and the reading's state; the reading itself is fetched with the key. A partner may still poll.
The agreement is accepted, keys are made and blocks are bought on the account page, signed in by a link to the work address. Your account.
The older endpoints under /api/v1/ serve their own keys, issued by /api/v1/register/, which answers 202 for every address and sends a key by email only. Their description is at /api/v1/openapi.json. A partner key reads through the endpoints above.
Security has always faced inward. LeakTrace is the AI layer that faces the attacker.