Get Records by Phone Number

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/phone-numbers/{phone}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "username": "string",
        "password": "string",
        "firstName": "string",
        "lastName": "string",
        "city": "string",
        "state": "string",
        "postalCode": "string",
        "phone": "string",
        "email": "string",
        "dob": "string",
        "sourceId": 13080,
        "documentId": "00000000-0000-0000-0000-000000000000",
        "recordModificationDate": "2023-01-26T00:00:00Z",
        "fullName": "string",
        "emailDomain": "domain.com",
        "emailUsername": "string",
        "domain": "domain.com",
        "passwordType": "plaintext",
        "passwordPlaintext": "string",
        "severity": 20,
        "publishDate": "2017-11-04T00:00:00Z",
        "source": {
          "id": 13080,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "exfiltrated",
          "type": "PUBLIC",
          "site": "domain.com",
          "publishDate": "2017-11-04T00:41:18Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 50,
    "total": 1
  }
}

GET

dpp

dwm

breach

data

phone-numbers

{phone}

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/phone-numbers/{phone}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "username": "string",
        "password": "string",
        "firstName": "string",
        "lastName": "string",
        "city": "string",
        "state": "string",
        "postalCode": "string",
        "phone": "string",
        "email": "string",
        "dob": "string",
        "sourceId": 13080,
        "documentId": "00000000-0000-0000-0000-000000000000",
        "recordModificationDate": "2023-01-26T00:00:00Z",
        "fullName": "string",
        "emailDomain": "domain.com",
        "emailUsername": "string",
        "domain": "domain.com",
        "passwordType": "plaintext",
        "passwordPlaintext": "string",
        "severity": 20,
        "publishDate": "2017-11-04T00:00:00Z",
        "source": {
          "id": 13080,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "exfiltrated",
          "type": "PUBLIC",
          "site": "domain.com",
          "publishDate": "2017-11-04T00:41:18Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 50,
    "total": 1
  }
}

Returns breach records in the dark-web breach dataset that expose the given phone number. Supply digits only, no formatting. Records may also carry phoneFull — the same number with its country code prefixed — when the source provided it.

URL: /dpp/dwm/v2/breach/data/phone-numbers/{phone}
Redacted URL: /dpp/dwm/v2/breach/data/phone-numbers-redacted/{phone}
Request Method: GET

Use the redacted URL to get the same records with every personal value partially masked.

Authentication

Send the Access Token in the X-AccessToken request header on every authenticated call:

X-AccessToken: YOUR_ACCESS_TOKEN

Path Parameters

string

required

Phone number, digits only (no spaces/dashes)

Query Parameters

number

Page number (1-based). 50 records/page over the newest 1000 stored (max 20 pages).

string

Registered user uuid — makes this a PAID lookup. Must belong to your partner (404 if not); a disabled or expired user gives 403. Omit for a free lookup.

Sample Request

cURL

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/phone-numbers/{phone}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

Redacted

cURL

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/phone-numbers-redacted/{phone}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

curl -X GET "<base_url>/dpp/dwm/v2/breach/data/phone-numbers/{phone}" \
  -H "X-AccessToken: YOUR_ACCESS_TOKEN"

Response

object

Show header

string

Response status message, e.g. Success.

number

Result code. 1 = success.

object

Show body

object[]

Matched breach records on this page.

Show results

string

Username exposed in the record.

string

Exposed password.

string

Exposed first name.

string

Exposed last name.

string

Exposed city.

string

Exposed state or region.

string

Exposed postal code.

string

Exposed phone number.

string

Exposed email address.

string

Exposed date of birth.

number

Identifier of the breach source this record came from.

string

Unique identifier of this breach record.

string

Date the record was last modified in the dataset.

string

Exposed full name.

string

Domain of the exposed email address.

string

Local part of the exposed email address.

string

Domain of the exposed email address.

string

How the exposed password is stored, e.g. plaintext.

string

Exposed password, in plaintext.

number

Severity code for this exposure.

string

Date the record was published into the dataset.

object

Breach source metadata, resolved from sourceId.

Show source

number

Source identifier.

string

Full name of the breach.

string

Short display name of the breach.

string

Source category.

string

Source visibility, e.g. PUBLIC or PRIVATE.

string

Site the breach relates to.

string

Date the record was published into the dataset.

number

Current page number.

number

Number of records per page.

number

Total number of matching records across all pages.

Sample Response

Success

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "username": "string",
        "password": "string",
        "firstName": "string",
        "lastName": "string",
        "city": "string",
        "state": "string",
        "postalCode": "string",
        "phone": "string",
        "email": "string",
        "dob": "string",
        "sourceId": 13080,
        "documentId": "00000000-0000-0000-0000-000000000000",
        "recordModificationDate": "2023-01-26T00:00:00Z",
        "fullName": "string",
        "emailDomain": "domain.com",
        "emailUsername": "string",
        "domain": "domain.com",
        "passwordType": "plaintext",
        "passwordPlaintext": "string",
        "severity": 20,
        "publishDate": "2017-11-04T00:00:00Z",
        "source": {
          "id": 13080,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "exfiltrated",
          "type": "PUBLIC",
          "site": "domain.com",
          "publishDate": "2017-11-04T00:41:18Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 50,
    "total": 1
  }
}

Redacted

Every personal value is partially masked by the API.

Redacted

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "username": "u*****me",
        "password": "p*****rd",
        "firstName": "F**st",
        "lastName": "L*st",
        "city": "C*ty",
        "state": "S**te",
        "postalCode": "0**00",
        "phone": "5*******00",
        "email": "u************om",
        "dob": "1*****************0Z",
        "sourceId": 13080,
        "documentId": "00000000-0000-0000-0000-000000000000",
        "recordModificationDate": "2023-01-26T00:00:00Z",
        "fullName": "F*******st",
        "emailDomain": "d*******om",
        "emailUsername": "u*****me",
        "domain": "d*******om",
        "passwordType": "plaintext",
        "passwordPlaintext": "p*****rd",
        "severity": 20,
        "publishDate": "2017-11-04T00:00:00Z",
        "source": {
          "id": 13080,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "exfiltrated",
          "type": "PUBLIC",
          "site": "domain.com",
          "publishDate": "2017-11-04T00:41:18Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 50,
    "total": 1
  }
}

{
  "header": {
    "message": "Success",
    "response_code": 1
  },
  "body": {
    "results": [
      {
        "username": "string",
        "password": "string",
        "firstName": "string",
        "lastName": "string",
        "city": "string",
        "state": "string",
        "postalCode": "string",
        "phone": "string",
        "email": "string",
        "dob": "string",
        "sourceId": 13080,
        "documentId": "00000000-0000-0000-0000-000000000000",
        "recordModificationDate": "2023-01-26T00:00:00Z",
        "fullName": "string",
        "emailDomain": "domain.com",
        "emailUsername": "string",
        "domain": "domain.com",
        "passwordType": "plaintext",
        "passwordPlaintext": "string",
        "severity": 20,
        "publishDate": "2017-11-04T00:00:00Z",
        "source": {
          "id": 13080,
          "title": "Breach Name",
          "shortTitle": "Breach Name",
          "category": "exfiltrated",
          "type": "PUBLIC",
          "site": "domain.com",
          "publishDate": "2017-11-04T00:41:18Z"
        }
      }
    ],
    "page": 1,
    "pageSize": 50,
    "total": 1
  }
}

Status Codes

Status	Meaning
`200`	Matching breach records for the phone number. phoneFull is present only when the source supplied it.
`403`	Paid lookup: the uuid resolves to a user that is disabled (10204) or expired (10205)
`404`	Paid lookup: no user with this uuid for your partner (10200)
`500`	Internal Server Error.

Error codes

Returned in header.response_code when the request fails.

Code	Message
`10006`	Bad request / A `{kind}` value is required / Provide at least one search asset
`10200`	User with uuid `{uuid}` not found
`10204`	User with uuid `{uuid}` is disabled
`10205`	User with uuid `{uuid}` has expired
`11100`	Cluster1 is not configured
`11102`	Exposure lookup not permitted (`{status}`)
`11103`	Exposure lookup returned `{status}`
`11104`	Cluster1 is unavailable
`11199`	DWM response post-processing failed

See Errors for the response envelope and the full list of codes.

Overview

User Management

Dark Web Monitoring

Data Broker Opt-Out Service

Get Records by Phone Number

Authentication

Path Parameters

Query Parameters

Sample Request

Redacted

Response

Sample Response

Redacted

Status Codes

Error codes

​Authentication

​Path Parameters

​Query Parameters

​Sample Request

​Redacted

​Response

​Sample Response

​Redacted

​Status Codes

​Error codes

Authentication

Path Parameters

Query Parameters

Sample Request

Redacted

Response

Sample Response

Redacted

Status Codes

Error codes