Investigations API

SpyCloud Investigations provides three APIs for programmatic access to recaptured identity data. Each is designed to answer a different investigative question.

All three are REST APIs that work with your Investigations API key. Start with the question you need to answer, then continue to the guide for that API.

For most investigations, start with the Investigations Breach Data API to search SpyCloud’s Breach Catalog for exposure records associated with a known selector.

Use IDLink API when you want to uncover hidden connections around an identity, or the Infostealer Log API when you need the detailed contents of a specific malware infection.

Chose the right API

Start with what you know and what you want to find.

If you have...	And want...	Use...
A selector: email, username, phone, IP, password, domain, and more	Every exposure record for it	Investigations Breach Data API
A selector	Discover other identities, accounts, and data connected to it	IDLink API
A `log_id` or `infected_machine_id`	What the infostealer log actually contains	Infostealer Log API
A `source_id`	Details about the breach or source	Investigations API – Breach Catalog

Not sure where to start? The Investigations Breach Data API is the primary API for most investigations. Start there when you have a known selector and want to see the exposure records associated with it.

The APIs at a glance

Investigations Breach Data API

Returns every exposure record for a selector, as JSON. It's built for SIEM and SOAR enrichment, batch jobs, and evidentiary pulls. Breach catalog endpoints return details about a breach or source by source_id.

Use it for:

Selector-based exposure searches
High-volume and batch investigations
SIEM and security workflow enrichment
Link analysis and investigative integrations

IDLink API

Uncover hidden connections to correlate identities at scale. IDLink goes beyond direct-match searches by automatically pivoting across related identity assets. Starting from a selector, it returns the other identities, accounts, and devices connected to it, as JSON records or JSON Graph Format.

Use it when you want to:

Discover related accounts and identity attributes
Expand an investigation beyond the original selector
Automate identity correlation and pivots

Infostealer Log API

Returns the parsed contents of an infostealer log, organized into collections such as credentials, cookies, and autofills. Requests require a log_id or infected_machine_id, and responses are JSON or CSV by collection.

Use it when you need to investigate:

Credentials, cookies, autofill data, installed applications, and other available collections within an infostealer log

Learn More

Investigations Breach Data API guide: start here for selector-based exposure lookups and breach catalog details.
IDLink API guide: continue here to pivot from a selector to connected identities.
Infostealer Log API guide: continue here to retrieve the contents of a specific log.

Guidelines and sample configuration

All three APIs share the same authentication, IP allow-listing, pagination, and error handling. Read the API Guidelines before you build.

Investigations Breach Data API Reference
IDLink API Reference
Infostealer Log Data API Reference