From e61b7d0d88701242f240bc24d9c8f3c38d9d0383 Mon Sep 17 00:00:00 2001
From: Maxime Goyette <maxime.goyette@flare.io>
Date: Mon, 2 Feb 2026 15:02:29 -0500
Subject: [PATCH] Add expand-event-field page.

---
 .../v4/endpoints/expand-event-field.mdx       | 124 ++++++++++++++++++
 1 file changed, 124 insertions(+)
 create mode 100644 docs/api-reference/v4/endpoints/expand-event-field.mdx

diff --git a/docs/api-reference/v4/endpoints/expand-event-field.mdx b/docs/api-reference/v4/endpoints/expand-event-field.mdx
new file mode 100644
index 0000000..b3b88c3
--- /dev/null
+++ b/docs/api-reference/v4/endpoints/expand-event-field.mdx
@@ -0,0 +1,124 @@
+---
+title: "Expand Event Field"
+api: "GET https://api.flare.io/firework/v4/events/_expand"
+authMethod: "bearer"
+---
+
+Returns a page of items for a particular expanded field in a specified event.
+
+<Panel>
+  <ResponseExample>
+    ```json Stealer Log Credentials
+      {
+        "items": [
+          {
+            "url": "<string>",
+            "username": "<string>",
+            "password": "<string>",
+            "hash": "<string>",
+            "application": "<string>"
+          }
+        ],
+        "next": null
+      }
+    ```
+    ```json Stealer Log Cookies
+      {
+        "items": [
+          {
+            "host_key": "<string>",
+            "path": "<string>",
+            "expires_utc": "2023-11-07T05:31:56Z",
+            "name": "<string>",
+            "value": "<string>"
+          }
+        ],
+        "next": null
+      }
+    ```
+  </ResponseExample>
+</Panel>
+
+## Parameters
+
+<ParamField path="uid" type="string" required>
+  The UID of the Event.
+</ParamField>
+
+<ParamField path="field" type="string" required>
+  The field to expand.
+  
+  For a complete list of supported expandable fields per event type, see the [Expandable fields](#expandable-fields) section below.
+</ParamField>
+
+<ParamField path="from" type="string" optional>
+  The `next` value from the previous response. 
+  If not provided, the first page of results will be returned.
+
+  For more information, see the [Flare standard paging pattern <Icon icon="book" size={16} />](/concepts/paging).
+</ParamField>
+
+### Expandable fields
+
+The following fields can be expanded for the given event type.
+
+<Tabs>
+  <Tab title="Stealer Log">
+    `credentials`
+    `cookies`
+  </Tab>
+</Tabs>
+
+## Response
+The response includes an array of `items` and a `next` field, as described in the [Flare standard paging pattern <Icon icon="book" size={16} />](/concepts/paging).
+
+<ResponseField name="items" type="list[object]" required>
+  <Expandable defaultOpen>
+    <Tabs>
+      <Tab title="Stealer Log">
+        <Tabs>
+          <Tab title="Credential">
+            <ResponseField name="url" type="string">
+              Url of the specific credential.
+            </ResponseField>
+            <ResponseField name="username" type="string">
+              Username of the specific credential.
+            </ResponseField>
+            <ResponseField name="password" type="string">
+              Password of the specific credential.
+            </ResponseField>
+            <ResponseField name="hash" type="string">
+              Hash of the specific credential.
+            </ResponseField>
+            <ResponseField name="application" type="string">
+              Application of the specific credential.
+            </ResponseField>
+          </Tab>
+          <Tab title="Cookie">
+            <ResponseField name="host_key" type="string">
+              Host key of the specific cookie.
+            </ResponseField>
+            <ResponseField name="path" type="string">
+              Path of the specific cookie.
+            </ResponseField>
+            <ResponseField name="expires_utc" type="date">
+              The date the cookie expires.
+            </ResponseField>
+            <ResponseField name="name" type="string">
+              Name of the specific cookie.
+            </ResponseField>
+            <ResponseField name="value" type="string">
+              Value of the specific cookie.
+            </ResponseField>
+          </Tab>
+        </Tabs>
+      </Tab>
+    </Tabs>
+  </Expandable>
+</ResponseField>
+<ResponseField name="next" type="string | null">
+  The value that should be included in the next request's `from` parameter.
+  Most of the time, this is an opaque string.
+
+  For more information, see the [Flare standard paging pattern <Icon icon="book" size={16} />](/concepts/paging).
+</ResponseField>