curl -X GET "<base_url>/dpp/dwm/v2/breach/data/cc-numbers/{ccSha1}" \
-H "X-AccessToken: YOUR_ACCESS_TOKEN"
{
"header": {
"message": "Success",
"response_code": 1
},
"body": {
"page": 1,
"pageSize": 50,
"total": 1,
"results": [
{
"email": "string",
"ccLastFour": "string",
"breachCategory": "phished",
"sourceId": 176469
}
]
}
}
Dark Web Scan
Get Records by Credit Card Number
Returns breach records in the dark-web breach dataset that expose the given payment card number.
GET
/
dpp
/
dwm
/
v2
/
breach
/
data
/
cc-numbers
/
{ccSha1}
curl -X GET "<base_url>/dpp/dwm/v2/breach/data/cc-numbers/{ccSha1}" \
-H "X-AccessToken: YOUR_ACCESS_TOKEN"
{
"header": {
"message": "Success",
"response_code": 1
},
"body": {
"page": 1,
"pageSize": 50,
"total": 1,
"results": [
{
"email": "string",
"ccLastFour": "string",
"breachCategory": "phished",
"sourceId": 176469
}
]
}
}
Returns breach records in the dark-web breach dataset that expose the given payment card number. The raw card number (PAN) must never be sent: hash it with SHA-1 client-side and pass the 40-character lowercase hex digest. Non-hash input is rejected with 400.
See Errors for the response envelope and the full list of codes.
- URL:
/dpp/dwm/v2/breach/data/cc-numbers/{ccSha1} - Full URL:
<base_url>/dpp/dwm/v2/breach/data/cc-numbers/{ccSha1} - Request Method: GET
Authentication
Send the Access Token in theX-AccessToken request header on every authenticated call:
X-AccessToken: YOUR_ACCESS_TOKEN
Path Parameters
string
required
40-char lowercase SHA-1 hex of the card number (hash client-side)
Query Parameters
number
Page number (1-based). 50 records/page over the newest 1000 stored (max 20 pages).
string
Registered user uuid — makes this a PAID lookup. Must belong to your partner (404 if not); a disabled or expired user gives 403. Omit for a free lookup.
Sample Request
cURL
curl -X GET "<base_url>/dpp/dwm/v2/breach/data/cc-numbers/{ccSha1}" \
-H "X-AccessToken: YOUR_ACCESS_TOKEN"
curl -X GET "<base_url>/dpp/dwm/v2/breach/data/cc-numbers/{ccSha1}" \
-H "X-AccessToken: YOUR_ACCESS_TOKEN"
Response
object
Sample Response
Success
{
"header": {
"message": "Success",
"response_code": 1
},
"body": {
"page": 1,
"pageSize": 50,
"total": 1,
"results": [
{
"email": "string",
"ccLastFour": "string",
"breachCategory": "phished",
"sourceId": 176469
}
]
}
}
{
"header": {
"message": "Success",
"response_code": 1
},
"body": {
"page": 1,
"pageSize": 50,
"total": 1,
"results": [
{
"email": "string",
"ccLastFour": "string",
"breachCategory": "phished",
"sourceId": 176469
}
]
}
}
Status Codes
| Status | Meaning |
|---|---|
200 | Matching breach records for the hashed card number (card fields masked). |
400 | Asset is not a valid 40-char SHA-1 hex digest. |
403 | Paid lookup: the uuid resolves to a user that is disabled (10204) or expired (10205) |
404 | Paid lookup: no user with this uuid for your partner (10200) |
500 | Internal Server Error. |
Error codes
Returned inheader.response_code when the request fails.
| Code | Message |
|---|---|
10006 | Bad request / A {kind} value is required / Provide at least one search asset |
10200 | User with uuid {uuid} not found |
10204 | User with uuid {uuid} is disabled |
10205 | User with uuid {uuid} has expired |
11100 | Cluster1 is not configured |
11101 | Expected a 40-character SHA-1 hex hash (hash the SSN/CC client-side) |
11102 | Exposure lookup not permitted ({status}) |
11103 | Exposure lookup returned {status} |
11104 | Cluster1 is unavailable |
11199 | DWM response post-processing failed |