> ## Documentation Index > Fetch the complete documentation index at: https://docs.attaxr.com/llms.txt > Use this file to discover all available pages before exploring further. # List resources > Paginated, owner-scoped listing. Newest first by default. `?q=` searches assetValue (case-insensitive contains). ## OpenAPI ````yaml /api/openapi.json get /api/leads openapi: 3.1.0 info: title: Aquila API version: 1.0.0 description: >- Event-driven reconnaissance platform API. All /api/* routes except /api/public/* require an authenticated session (cookie), an X-Api-Key header, or a bearer token. Auth endpoints under /api/auth/* are generated by Better Auth. servers: - url: https://aquila.attaxr.com - url: http://localhost security: [] tags: - name: AI - name: Agents - name: Bulk Delete - name: Chat - name: Constraints - name: Dashboard - name: Events - name: JS - name: JS Analysis - name: JS Monitoring - name: Leads - name: MCP Key - name: Models - name: Notification Channels - name: Notification Event Preferences - name: Notifications - name: OOB - name: Provider Keys - name: Public Shares - name: Reinforcements - name: Reports - name: Scans - name: Schedules - name: Shares - name: Tools - name: User Profiles - name: V1 - name: Vulnerabilities - name: Workflows paths: /api/leads: get: tags: - Leads summary: List resources description: >- Paginated, owner-scoped listing. Newest first by default. `?q=` searches assetValue (case-insensitive contains). operationId: getApiLeads parameters: - name: q in: query required: false schema: type: string description: Case-insensitive contains search. - name: page in: query required: false schema: type: integer description: Page number, 1-based. - name: limit in: query required: false schema: type: integer description: Items per page (1-100, default 20). - name: sort in: query required: false schema: type: string enum: - createdAt - updatedAt description: Sort column (allowlisted). - name: order in: query required: false schema: type: string enum: - asc - desc description: Sort direction (default desc). responses: '200': description: Paginated result page. content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: items: type: array items: type: object properties: _id: type: string userId: type: string assetKey: type: string assetType: type: string assetValue: type: string scanId: type: string metadata: default: {} type: object propertyNames: type: string additionalProperties: {} category: type: string interestScore: type: number minimum: 0 maximum: 1 confidence: type: number minimum: 0 maximum: 1 recommendedAction: type: string analysis: type: string technologies: type: array items: type: object propertyNames: type: string additionalProperties: {} notableObservations: type: array items: type: string relationships: type: array items: type: string whyInteresting: type: string potentialVulnerabilities: type: array items: type: object propertyNames: type: string additionalProperties: {} recommendedTools: type: array items: type: object propertyNames: type: string additionalProperties: {} architectureMermaid: type: string chainingOpportunities: type: array items: type: object propertyNames: type: string additionalProperties: {} endpoints: type: array items: type: object propertyNames: type: string additionalProperties: {} insights: type: array items: type: object propertyNames: type: string additionalProperties: {} cves: type: array items: type: object properties: id: type: string minLength: 1 technology: type: string version: type: string description: type: string cvssScore: type: number cvssSeverity: type: string enum: - CRITICAL - HIGH - MEDIUM - LOW publishedAt: type: string references: type: array items: type: string required: - id - technology additionalProperties: false classifiedAt: {} lastAnalysisAt: {} reconVersion: type: integer minimum: 0 maximum: 9007199254740991 response: type: string changedResponse: type: string lastFetchedAt: {} jsRecon: type: object propertyNames: type: string additionalProperties: {} jsReconAnalyzedAt: {} lastNotifiedJsBodyHash: type: string lastNotifiedJsAt: {} type: default: other type: string enum: - authorization_issue - api_endpoint - auth_workflow - sensitive_functionality - business_logic_concern - other title: type: string description: default: '' type: string priority: default: medium type: string enum: - low - medium - high - critical status: default: new type: string enum: - new - analyzing - investigating - validating - closed createdAt: default: '2026-09-18T11:34:11.692Z' updatedAt: default: '2026-09-18T11:34:11.692Z' required: - userId - assetKey - metadata - type - title - description - priority - status - createdAt - updatedAt additionalProperties: false total: type: number page: type: number limit: type: number totalPages: type: number required: - items - total - page - limit - totalPages additionalProperties: false '400': description: '`?q=` supplied but the resource has no search column.' content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: error: type: string required: - error additionalProperties: false '401': description: No valid session cookie or API key. content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: error: type: string required: - error additionalProperties: false security: - apiKeyCookie: [] - apiKeyHeader: [] - bearerAuth: [] components: securitySchemes: apiKeyCookie: type: apiKey in: cookie name: better-auth.session_token description: Browser session cookie set by Better Auth sign-in. apiKeyHeader: type: apiKey in: header name: x-api-key description: Personal API key (aquila_… prefix; settings → API keys). bearerAuth: type: http scheme: bearer description: Personal API key sent as a bearer token. ````