Core entities
| Entity | Purpose | Key fields |
|---|---|---|
| Search | One launched search execution | id, type, value, status, created_at, user_id, project_id, team_id, search_metadata |
| Search Result payload | Stored final payload attached to a search | result.cards[], result.leaked_data, result.breached_accounts[], result.registered_accounts[] |
| Stream event | Incremental event consumed by the result page | taskId, moduleId, moduleName, result, timestamp, status |
| Monitor | Scheduled monitoring definition | id, user_id, name, type, target, frequency, status |
| Monitoring Alert | Alert emitted by monitor processing | id, user_id, monitor_id, severity, message, status, created_at |
| Project | Investigation workspace | id, title, description, content, owner_id, team_id, created_at, updated_at |
| Team | Collaboration boundary | id, owner_id, name, credit_bank_enabled, credit_bank_balance, use_owner_credits |
| Team Membership | User role inside a team | team_id, user_id, role (owner, admin, editor, viewer) |
| Team Invitation | Pending invitation workflow | team_id, email, role, invitation_code, expires_at, accepted_at |
Search and module states
- Search status
- Module delivery
- Panel updates
Typical status flow:
pendingrunningfinishederror
Visibility rules
A field, tab, or panel is displayed only when all required conditions are met:- The search type supports that view
- The plan allows the underlying data source
- Matching data is present in returned payloads
- The user has not disabled the view in display settings
Missing panel usually means no applicable data was returned, not a rendering issue.
Relationships in practice
Search -> Module Results
Search -> Module Results
One search execution yields multiple module outputs (stream events and/or stored cards).
Search -> Result payload
Search -> Result payload
One search can include cards plus optional leaked, breached, and registered account datasets in its stored result payload.
Team -> Projects -> Searches
Team -> Projects -> Searches
Teams group projects, and projects can reference saved searches, notes, and attachments.
Monitor -> Alerts
Monitor -> Alerts
One monitor can generate many alert records over time, each with its own workflow status.