> ## Documentation Index
> Fetch the complete documentation index at: https://flare-iman-v2-v3-spec-ordering.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Expand Event V2 Field (Beta)
Returns a page of items for a particular expanded field in a specified event.
```json StealerLogCookies theme={null}
{
"items": [
{
"host_key": "example.com",
"path": "/",
"expires_utc": "2025-01-01T00:00:00",
"name": "example",
"value": "🍪"
}
],
"next": null
}
```
```json StealerLogCredentials theme={null}
{
"items": [
{
"url": "https://example.com",
"username": "john_doe",
"password": "hunter2",
"application": "application"
}
],
"next": null
}
```
### Expandable fields
The following fields can be expanded for the given event type.
`cookies` `credentials`
## OpenAPI
````yaml firework-v4-openapi get /firework/v4/events/_expand
openapi: 3.1.0
info:
title: Firework API
version: v4
servers:
- url: https://api.flare.io
security:
- BearerAuth: []
paths:
/firework/v4/events/_expand:
get:
tags:
- public
- team=experience
summary: Expand Event Field
operationId: expand_event_field_events__expand_get
parameters:
- name: field
in: query
required: true
schema:
$ref: '#/components/schemas/ExpandableField'
- name: uid
in: query
required: true
schema:
type: string
title: Uid
- name: from
in: query
required: false
schema:
anyOf:
- type: string
- type: 'null'
title: From
- name: size
in: query
required: false
schema:
type: integer
maximum: 20
exclusiveMinimum: 0
default: 20
title: Size
responses:
'200':
description: Successful Response
content:
application/json:
schema:
anyOf:
- $ref: >-
#/components/schemas/PaginatedResults_StealerLogCredential_str_
- $ref: >-
#/components/schemas/PaginatedResults_StealerLogCookie_str_
- $ref: '#/components/schemas/PaginatedResults_FeedItem_str_'
- $ref: >-
#/components/schemas/PaginatedResultsWithTotalCount_LeakedFile_str_
- $ref: >-
#/components/schemas/PaginatedResults_LeakedFileExtension_str_
title: Response Expand Event Field Events Expand Get
'422':
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
components:
schemas:
ExpandableField:
type: string
enum:
- credentials
- cookies
- associated_events
- leaked_files
- leaked_file_extensions
title: ExpandableField
PaginatedResults_StealerLogCredential_str_:
properties:
items:
items:
$ref: '#/components/schemas/StealerLogCredential'
type: array
title: Items
next:
anyOf:
- type: string
- type: 'null'
title: Next
type: object
required:
- items
- next
title: PaginatedResults[StealerLogCredential, str]
PaginatedResults_StealerLogCookie_str_:
properties:
items:
items:
$ref: '#/components/schemas/StealerLogCookie'
type: array
title: Items
next:
anyOf:
- type: string
- type: 'null'
title: Next
type: object
required:
- items
- next
title: PaginatedResults[StealerLogCookie, str]
PaginatedResults_FeedItem_str_:
properties:
items:
items:
$ref: '#/components/schemas/FeedItem'
type: array
title: Items
next:
anyOf:
- type: string
- type: 'null'
title: Next
type: object
required:
- items
- next
title: PaginatedResults[FeedItem, str]
PaginatedResultsWithTotalCount_LeakedFile_str_:
properties:
items:
items:
$ref: '#/components/schemas/LeakedFile'
type: array
title: Items
next:
anyOf:
- type: string
- type: 'null'
title: Next
total_count:
anyOf:
- type: integer
- type: 'null'
title: Total Count
type: object
required:
- items
- next
title: PaginatedResultsWithTotalCount[LeakedFile, str]
PaginatedResults_LeakedFileExtension_str_:
properties:
items:
items:
$ref: '#/components/schemas/LeakedFileExtension'
type: array
title: Items
next:
anyOf:
- type: string
- type: 'null'
title: Next
type: object
required:
- items
- next
title: PaginatedResults[LeakedFileExtension, str]
HTTPValidationError:
properties:
detail:
items:
$ref: '#/components/schemas/ValidationError'
type: array
title: Detail
type: object
title: HTTPValidationError
StealerLogCredential:
properties:
url:
type: string
title: Url
username:
type: string
title: Username
password:
type: string
title: Password
application:
type: string
title: Application
type: object
required:
- url
- username
- password
- application
title: StealerLogCredential
StealerLogCookie:
properties:
host_key:
type: string
title: Host Key
path:
type: string
title: Path
expires_utc:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Expires Utc
name:
type: string
title: Name
value:
type: string
title: Value
type: object
required:
- host_key
- path
- expires_utc
- name
- value
title: StealerLogCookie
FeedItem:
properties:
metadata:
$ref: '#/components/schemas/FeedItemMetadata'
title:
anyOf:
- type: string
- type: 'null'
title: Title
tenant_metadata:
$ref: '#/components/schemas/FeedItemTenantMetadata'
identifiers:
items:
$ref: '#/components/schemas/FeedItemIdentifier'
type: array
title: Identifiers
highlights:
additionalProperties:
items:
type: string
type: array
type: object
title: Highlights
type: object
required:
- metadata
title: FeedItem
LeakedFile:
properties:
uid:
type: string
title: Uid
filepath:
anyOf:
- type: string
- type: 'null'
title: Filepath
filename:
anyOf:
- type: string
- type: 'null'
title: Filename
size:
anyOf:
- type: integer
- type: 'null'
title: Size
created_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Created At
first_crawled_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: First Crawled At
archive_file:
anyOf:
- type: string
- type: 'null'
title: Archive File
archive_type:
anyOf:
- type: string
- type: 'null'
title: Archive Type
status:
$ref: '#/components/schemas/DownloadRequestStatus'
is_requesting_user:
anyOf:
- type: boolean
- type: 'null'
title: Is Requesting User
type: object
required:
- uid
- filepath
- filename
- size
- created_at
- first_crawled_at
- archive_file
- archive_type
- status
- is_requesting_user
title: LeakedFile
LeakedFileExtension:
properties:
extension:
type: string
title: Extension
description:
type: string
title: Description
type: object
required:
- extension
- description
title: LeakedFileExtension
ValidationError:
properties:
loc:
items:
anyOf:
- type: string
- type: integer
type: array
title: Location
msg:
type: string
title: Message
type:
type: string
title: Error Type
input:
title: Input
ctx:
type: object
title: Context
type: object
required:
- loc
- msg
- type
title: ValidationError
FeedItemMetadata:
properties:
uid:
type: string
title: Uid
estimated_created_at:
type: string
format: date-time
title: Estimated Created At
matched_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Matched At
type:
$ref: '#/components/schemas/ActivityModelName'
severity:
$ref: '#/components/schemas/Severity'
flare_url:
type: string
title: Flare Url
type: object
required:
- uid
- estimated_created_at
- matched_at
- type
- severity
- flare_url
title: FeedItemMetadata
FeedItemTenantMetadata:
properties:
severity:
anyOf:
- $ref: '#/components/schemas/FeedItemTenantMetadataSeverity'
- type: 'null'
notes:
anyOf:
- type: string
- type: 'null'
title: Notes
tags:
items:
type: string
type: array
title: Tags
remediated_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Remediated At
ignored_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Ignored At
type: object
title: FeedItemTenantMetadata
FeedItemIdentifier:
properties:
id:
type: integer
title: Id
name:
type: string
title: Name
type: object
required:
- id
- name
title: FeedItemIdentifier
DownloadRequestStatus:
type: string
enum:
- not_requested
- pending
- completed
- failed
title: DownloadRequestStatus
ActivityModelName:
type: string
enum:
- account
- actor
- actor_summary
- ad
- attachment
- blog_post
- bot
- bucket
- bucket_object
- cc
- cc_bases
- chat_message
- cookie
- docker_image
- docker_repository
- document
- domain
- domain_certificate
- domain_favicon
- domain_dns_records
- domain_ip_address
- domain_screenshot
- domain_title
- domain_whois_rdap
- driller
- driller_forum_post
- driller_forum_topic
- driller_google
- driller_profile
- driller_source_code
- entity_classification
- entity_summarization
- event
- experimental
- forum_category
- forum_post
- forum_profile
- forum_topic
- host
- intelligence_object
- invalid_credential
- leak
- leaked_credential
- leaked_data
- leaked_file
- listing
- lookalike
- mitigated_credential
- paste
- ransomleak
- ransomleak_file_listing
- score_event
- sdo_attack_pattern
- sdo_campaign
- sdo_identity
- sdo_indicator
- sdo_infrastructure
- sdo_location
- sdo_malware
- sdo_relationship
- sdo_external_report
- sdo_threat_actor
- sdo_threat_actor_group
- sdo_tool
- sdo_vulnerability
- secret
- seller
- service
- social_media_account
- source_code_secret
- stealer_log
- attachment/telegram
- threat_flow_summary
- valid_credential
- whois
title: ActivityModelName
Severity:
type: string
enum:
- info
- low
- medium
- high
- critical
title: Severity
FeedItemTenantMetadataSeverity:
properties:
original:
$ref: '#/components/schemas/Severity'
override:
$ref: '#/components/schemas/Severity'
type: object
required:
- original
- override
title: FeedItemTenantMetadataSeverity
securitySchemes:
BearerAuth:
type: http
scheme: bearer
````