Get Records by Email

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/emails/{email}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "username": "string",
        "domain": "domain.com",
        "passwordType": "plaintext",
        "severity": 20,
        "ipAddresses": [
          "string"
        ],
        "emailUsername": "string",
        "passwordPlaintext": "string",
        "emailDomain": "domain.com",
        "sourceId": 6,
        "password": "string",
        "email": "string",
        "documentId": "00000000-0000-0000-0000-000000000000",
        "publishDate": "2016-10-24T00:00:00Z",
        "source": {
          "id": 6,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "unknown",
          "type": "PUBLIC",
          "site": "domain.com",
          "publishDate": "2016-10-24T02:00:25Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 50,
    "total": 1
  }
}

GET

dpp

dwm

breach

data

emails

{email}

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/emails/{email}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "username": "string",
        "domain": "domain.com",
        "passwordType": "plaintext",
        "severity": 20,
        "ipAddresses": [
          "string"
        ],
        "emailUsername": "string",
        "passwordPlaintext": "string",
        "emailDomain": "domain.com",
        "sourceId": 6,
        "password": "string",
        "email": "string",
        "documentId": "00000000-0000-0000-0000-000000000000",
        "publishDate": "2016-10-24T00:00:00Z",
        "source": {
          "id": 6,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "unknown",
          "type": "PUBLIC",
          "site": "domain.com",
          "publishDate": "2016-10-24T02:00:25Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 50,
    "total": 1
  }
}

Returns every record in the dark-web breach dataset that exposes the given email address. Page forward with page (50 records/page). Every record is enriched in-line with a source object resolved from its sourceId.

URL: /dpp/dwm/v2/breach/data/emails/{email}
Redacted URL: /dpp/dwm/v2/breach/data/emails-redacted/{email}
Request Method: GET

Use the redacted URL to get the same records with every personal value partially masked.

Authentication

Send the Access Token in the X-AccessToken request header on every authenticated call:

X-AccessToken: YOUR_ACCESS_TOKEN

Path Parameters

string

required

Email address to look up.

Query Parameters

number

Page number (1-based). 50 records/page over the newest 1000 stored (max 20 pages).

string

Registered user uuid — makes this a PAID lookup. Must belong to your partner (404 if not); a disabled or expired user gives 403. Omit for a free lookup.

Sample Request

cURL

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/emails/{email}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

Redacted

cURL

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/emails-redacted/{email}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/emails/{email}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

Response

object

Show header

string

Response status message, e.g. Success.

number

Result code. 1 = success.

object

Show body

object[]

Matched breach records on this page.

Show results

string

Username exposed in the record.

string

Domain of the exposed email address.

string

How the exposed password is stored, e.g. plaintext.

number

Severity code for this exposure.

string[]

IP addresses associated with the record.

string

Local part of the exposed email address.

string

Exposed password, in plaintext.

string

Domain of the exposed email address.

number

Identifier of the breach source this record came from.

string

Exposed password.

string

Exposed email address.

string

Unique identifier of this breach record.

string

Date the record was published into the dataset.

object

Breach source metadata, resolved from sourceId.

Show source

number

Source identifier.

string

Full name of the breach.

string

Short display name of the breach.

string

Source category.

string

Source visibility, e.g. PUBLIC or PRIVATE.

string

Site the breach relates to.

string

Date the record was published into the dataset.

number

Current page number.

number

Number of records per page.

number

Total number of matching records across all pages.

Sample Response

Success

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "username": "string",
        "domain": "domain.com",
        "passwordType": "plaintext",
        "severity": 20,
        "ipAddresses": [
          "string"
        ],
        "emailUsername": "string",
        "passwordPlaintext": "string",
        "emailDomain": "domain.com",
        "sourceId": 6,
        "password": "string",
        "email": "string",
        "documentId": "00000000-0000-0000-0000-000000000000",
        "publishDate": "2016-10-24T00:00:00Z",
        "source": {
          "id": 6,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "unknown",
          "type": "PUBLIC",
          "site": "domain.com",
          "publishDate": "2016-10-24T02:00:25Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 50,
    "total": 1
  }
}

Redacted

Every personal value is partially masked by the API.

Redacted

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "username": "u*****me",
        "domain": "d*******om",
        "passwordType": "plaintext",
        "severity": 20,
        "ipAddresses": [
          "1*******10"
        ],
        "emailUsername": "u*****me",
        "passwordPlaintext": "p*****rd",
        "emailDomain": "d*******om",
        "sourceId": 6,
        "password": "p*****rd",
        "email": "u************om",
        "documentId": "00000000-0000-0000-0000-000000000000",
        "publishDate": "2016-10-24T00:00:00Z",
        "source": {
          "id": 6,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "unknown",
          "type": "PUBLIC",
          "site": "domain.com",
          "publishDate": "2016-10-24T02:00:25Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 1,
    "total": 1
  }
}

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "username": "string",
        "domain": "domain.com",
        "passwordType": "plaintext",
        "severity": 20,
        "ipAddresses": [
          "string"
        ],
        "emailUsername": "string",
        "passwordPlaintext": "string",
        "emailDomain": "domain.com",
        "sourceId": 6,
        "password": "string",
        "email": "string",
        "documentId": "00000000-0000-0000-0000-000000000000",
        "publishDate": "2016-10-24T00:00:00Z",
        "source": {
          "id": 6,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "unknown",
          "type": "PUBLIC",
          "site": "domain.com",
          "publishDate": "2016-10-24T02:00:25Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 50,
    "total": 1
  }
}

Status Codes

Status	Meaning
`200`	Matching breach records. total is how many records we hold for this asset.
`403`	Paid lookup: the uuid resolves to a user that is disabled (10204) or expired (10205)
`404`	Paid lookup: no user with this uuid for your partner (10200)
`500`	Internal Server Error.

Error codes

Returned in header.response_code when the request fails.

Code	Message
`10006`	Bad request / A `{kind}` value is required / Provide at least one search asset
`10200`	User with uuid `{uuid}` not found
`10204`	User with uuid `{uuid}` is disabled
`10205`	User with uuid `{uuid}` has expired
`11100`	Cluster1 is not configured
`11102`	Exposure lookup not permitted (`{status}`)
`11103`	Exposure lookup returned `{status}`
`11104`	Cluster1 is unavailable
`11199`	DWM response post-processing failed

See Errors for the response envelope and the full list of codes.

Overview

User Management

Dark Web Monitoring

Data Broker Opt-Out Service

Get Records by Email

Authentication

Path Parameters

Query Parameters

Sample Request

Redacted

Response

Sample Response

Redacted

Status Codes

Error codes

​Authentication

​Path Parameters

​Query Parameters

​Sample Request

​Redacted

​Response

​Sample Response

​Redacted

​Status Codes

​Error codes

Authentication

Path Parameters

Query Parameters

Sample Request

Redacted

Response

Sample Response

Redacted

Status Codes

Error codes