curl -X GET "<base_url>/dpp/dwm/v2/breach/data/usernames/{username}" \
-H "X-AccessToken: YOUR_ACCESS_TOKEN"
{
"header": {
"message": "Success",
"response_code": 1
},
"body": {
"page": 1,
"pageSize": 50,
"total": 1,
"results": [
{
"username": "string",
"password": "string",
"targetDomain": "domain.com",
"breachCategory": "infostealer",
"sourceId": 178848
}
]
}
}
Dark Web Scan
Get Records by Username
Returns breach records in the dark-web breach dataset that expose the given username (handle/login).
GET
/
dpp
/
dwm
/
v2
/
breach
/
data
/
usernames
/
{username}
curl -X GET "<base_url>/dpp/dwm/v2/breach/data/usernames/{username}" \
-H "X-AccessToken: YOUR_ACCESS_TOKEN"
{
"header": {
"message": "Success",
"response_code": 1
},
"body": {
"page": 1,
"pageSize": 50,
"total": 1,
"results": [
{
"username": "string",
"password": "string",
"targetDomain": "domain.com",
"breachCategory": "infostealer",
"sourceId": 178848
}
]
}
}
Returns breach records in the dark-web breach dataset that expose the given username (handle/login).
See Errors for the response envelope and the full list of codes.
- URL:
/dpp/dwm/v2/breach/data/usernames/{username} - Full URL:
<base_url>/dpp/dwm/v2/breach/data/usernames/{username} - Request Method: GET
Authentication
Send the Access Token in theX-AccessToken request header on every authenticated call:
X-AccessToken: YOUR_ACCESS_TOKEN
Path Parameters
string
required
Username / login handle to look up.
Query Parameters
number
Page number (1-based). 50 records/page over the newest 1000 stored (max 20 pages).
string
Registered user uuid — makes this a PAID lookup. Must belong to your partner (404 if not); a disabled or expired user gives 403. Omit for a free lookup.
Sample Request
cURL
curl -X GET "<base_url>/dpp/dwm/v2/breach/data/usernames/{username}" \
-H "X-AccessToken: YOUR_ACCESS_TOKEN"
curl -X GET "<base_url>/dpp/dwm/v2/breach/data/usernames/{username}" \
-H "X-AccessToken: YOUR_ACCESS_TOKEN"
Response
object
Sample Response
Success
{
"header": {
"message": "Success",
"response_code": 1
},
"body": {
"page": 1,
"pageSize": 50,
"total": 1,
"results": [
{
"username": "string",
"password": "string",
"targetDomain": "domain.com",
"breachCategory": "infostealer",
"sourceId": 178848
}
]
}
}
{
"header": {
"message": "Success",
"response_code": 1
},
"body": {
"page": 1,
"pageSize": 50,
"total": 1,
"results": [
{
"username": "string",
"password": "string",
"targetDomain": "domain.com",
"breachCategory": "infostealer",
"sourceId": 178848
}
]
}
}
Status Codes
| Status | Meaning |
|---|---|
200 | Matching breach records for the username. |
403 | Paid lookup: the uuid resolves to a user that is disabled (10204) or expired (10205) |
404 | Paid lookup: no user with this uuid for your partner (10200) |
500 | Internal Server Error. |
Error codes
Returned inheader.response_code when the request fails.
| Code | Message |
|---|---|
10006 | Bad request / A {kind} value is required / Provide at least one search asset |
10200 | User with uuid {uuid} not found |
10204 | User with uuid {uuid} is disabled |
10205 | User with uuid {uuid} has expired |
11100 | Cluster1 is not configured |
11102 | Exposure lookup not permitted ({status}) |
11103 | Exposure lookup returned {status} |
11104 | Cluster1 is unavailable |
11199 | DWM response post-processing failed |