Get Records by Domain

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/domains/{domain}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "severity": 20,
        "targetUrl": "www.domain.com/login",
        "documentId": "00000000-0000-0000-0000-000000000000",
        "targetDomain": "domain.com",
        "passwordPlaintext": "string",
        "password": "string",
        "passwordType": "plaintext",
        "sourceId": 226019,
        "targetSubdomain": "www.domain.com",
        "breachCategory": "combolist",
        "username": "string",
        "publishDate": "2026-10-03T05:11:07Z",
        "source": {
          "id": 226019,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "combolist",
          "type": "PRIVATE",
          "site": "n/a",
          "publishDate": "2026-10-03T05:01:22Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 200,
    "total": 1
  }
}

GET

dpp

dwm

breach

data

domains

{domain}

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/domains/{domain}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "severity": 20,
        "targetUrl": "www.domain.com/login",
        "documentId": "00000000-0000-0000-0000-000000000000",
        "targetDomain": "domain.com",
        "passwordPlaintext": "string",
        "password": "string",
        "passwordType": "plaintext",
        "sourceId": 226019,
        "targetSubdomain": "www.domain.com",
        "breachCategory": "combolist",
        "username": "string",
        "publishDate": "2026-10-03T05:11:07Z",
        "source": {
          "id": 226019,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "combolist",
          "type": "PRIVATE",
          "site": "n/a",
          "publishDate": "2026-10-03T05:01:22Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 200,
    "total": 1
  }
}

Returns breach records in the dark-web breach dataset that touch the given domain — accounts belonging to it (employee exposure) and machines that had it as a login target. Narrow with type; each type is paginated independently, limit records per page (10-200, default 200). Every record is enriched in-line with a source object resolved from its sourceId. Credentials (password, passwordPlaintext) are returned as-is; passwordType indicates whether the original was plaintext or a hash. Use domains-redacted for masked output.

URL: /dpp/dwm/v2/breach/data/domains/{domain}
Redacted URL: /dpp/dwm/v2/breach/data/domains-redacted/{domain}
Request Method: GET

Use the redacted URL to get the same records with every personal value partially masked.

Authentication

Send the Access Token in the X-AccessToken request header on every authenticated call:

X-AccessToken: YOUR_ACCESS_TOKEN

Path Parameters

string

required

Domain name to look up (or its SHA-1 hash)

Query Parameters

number

Page number (1-based), over the newest 1000 stored for this domain + type. Page size is set by limit (default 200).

string

Registered user uuid — makes this a PAID lookup. Must belong to your partner (404 if not); a disabled or expired user gives 403. Omit for a free lookup.

string

Record type. corporate = accounts on this email domain, email_domain = the same widened to infostealer-sourced records, target_domain/infected = machines that had this domain as a login target. Omit for all types combined — on a busy domain the combined view is dominated by target_domain records, so use corporate for employee exposure. One of corporate, infected, email_domain, target_domain.

number

Records per page, 10-200. Omit for 200. A value outside the range, a decimal, or a non-number is rejected with 400.

Sample Request

cURL

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/domains/{domain}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

Redacted

cURL

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/domains-redacted/{domain}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/domains/{domain}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

Response

object

Show header

string

Response status message, e.g. Success.

number

Result code. 1 = success.

object

Show body

object[]

Matched breach records on this page.

Show results

number

Severity code for this exposure.

string

URL of the site the exposed credentials were used on.

string

Unique identifier of this breach record.

string

Domain of that site.

string

Exposed password, in plaintext.

string

Exposed password.

string

How the exposed password is stored, e.g. plaintext.

number

Identifier of the breach source this record came from.

string

Subdomain of that site.

string

Further categorization: combolist, exfiltrated, exposed, infostealer, phished, scraped, or unknown.

string

Username exposed in the record.

string

Date the record was published into the dataset.

object

Breach source metadata, resolved from sourceId.

Show source

number

Source identifier.

string

Full name of the breach.

string

Short display name of the breach.

string

Source category.

string

Source visibility, e.g. PUBLIC or PRIVATE.

string

Site the breach relates to.

string

Date the record was published into the dataset.

number

Current page number.

number

Number of records per page.

number

Total number of matching records across all pages.

Sample Response

Success

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "severity": 20,
        "targetUrl": "www.domain.com/login",
        "documentId": "00000000-0000-0000-0000-000000000000",
        "targetDomain": "domain.com",
        "passwordPlaintext": "string",
        "password": "string",
        "passwordType": "plaintext",
        "sourceId": 226019,
        "targetSubdomain": "www.domain.com",
        "breachCategory": "combolist",
        "username": "string",
        "publishDate": "2026-10-03T05:11:07Z",
        "source": {
          "id": 226019,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "combolist",
          "type": "PRIVATE",
          "site": "n/a",
          "publishDate": "2026-10-03T05:01:22Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 200,
    "total": 1
  }
}

Redacted

Every personal value is partially masked by the API.

Redacted

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "severity": 20,
        "targetUrl": "w*****************in",
        "documentId": "00000000-0000-0000-0000-000000000000",
        "targetDomain": "d*******om",
        "passwordPlaintext": "p*****rd",
        "password": "p*****rd",
        "passwordType": "plaintext",
        "sourceId": 226019,
        "targetSubdomain": "w***********om",
        "breachCategory": "combolist",
        "username": "u*****me",
        "publishDate": "2026-10-03T05:11:07Z",
        "source": {
          "id": 226019,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "combolist",
          "type": "PRIVATE",
          "site": "n/a",
          "publishDate": "2026-10-03T05:01:22Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 200,
    "total": 1
  }
}

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "severity": 20,
        "targetUrl": "www.domain.com/login",
        "documentId": "00000000-0000-0000-0000-000000000000",
        "targetDomain": "domain.com",
        "passwordPlaintext": "string",
        "password": "string",
        "passwordType": "plaintext",
        "sourceId": 226019,
        "targetSubdomain": "www.domain.com",
        "breachCategory": "combolist",
        "username": "string",
        "publishDate": "2026-10-03T05:11:07Z",
        "source": {
          "id": 226019,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "combolist",
          "type": "PRIVATE",
          "site": "n/a",
          "publishDate": "2026-10-03T05:01:22Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 200,
    "total": 1
  }
}

Status Codes

Status	Meaning
`200`	Matching breach records for the domain. total is how many records we hold for this domain + type.
`400`	Invalid query (response_code 10002): limit must be a whole number from 10 to 200 and type must be one of the listed values. header.message names the invalid field, e.g. limit 201 exceeds the maximum. The minimum limit is 10 and the maximum limit is 200.
`403`	Paid lookup: the uuid resolves to a user that is disabled (10204) or expired (10205)
`404`	Paid lookup: no user with this uuid for your partner (10200)
`500`	Internal Server Error.

Error codes

Returned in header.response_code when the request fails.

Code	Message
`10006`	Bad request / A `{kind}` value is required / Provide at least one search asset
`10200`	User with uuid `{uuid}` not found
`10204`	User with uuid `{uuid}` is disabled
`10205`	User with uuid `{uuid}` has expired
`11100`	Cluster1 is not configured
`11102`	Exposure lookup not permitted (`{status}`)
`11103`	Exposure lookup returned `{status}`
`11104`	Cluster1 is unavailable
`11199`	DWM response post-processing failed

See Errors for the response envelope and the full list of codes.

Overview

User Management

Dark Web Monitoring

Data Broker Opt-Out Service

Get Records by Domain

Authentication

Path Parameters

Query Parameters

Sample Request

Redacted

Response

Sample Response

Redacted

Status Codes

Error codes

​Authentication

​Path Parameters

​Query Parameters

​Sample Request

​Redacted

​Response

​Sample Response

​Redacted

​Status Codes

​Error codes

Authentication

Path Parameters

Query Parameters

Sample Request

Redacted

Response

Sample Response

Redacted

Status Codes

Error codes