curl -X GET "<base_url>/dpp/dwm/v2/breach/data/domains/{domain}" \
-H "X-AccessToken: YOUR_ACCESS_TOKEN"
{
"header": {
"message": "Success",
"response_code": 1
},
"body": {
"results": [
{
"severity": 20,
"targetUrl": "www.domain.com/login",
"documentId": "00000000-0000-0000-0000-000000000000",
"targetDomain": "domain.com",
"passwordPlaintext": "string",
"password": "string",
"passwordType": "plaintext",
"sourceId": 226019,
"targetSubdomain": "www.domain.com",
"breachCategory": "combolist",
"username": "string",
"publishDate": "2026-10-03T05:11:07Z",
"source": {
"id": 226019,
"title": "Breach Name",
"shortTitle": "Breach Name",
"category": "combolist",
"type": "PRIVATE",
"site": "n/a",
"publishDate": "2026-10-03T05:01:22Z"
}
}
],
"page": 1,
"pageSize": 200,
"total": 1
}
}
Dark Web Scan
Get Records by Domain
Returns breach records in the dark-web breach dataset that touch the given domain — accounts belonging to it (employee exposure) and machines that had it as a login target.
GET
/
dpp
/
dwm
/
v2
/
breach
/
data
/
domains
/
{domain}
curl -X GET "<base_url>/dpp/dwm/v2/breach/data/domains/{domain}" \
-H "X-AccessToken: YOUR_ACCESS_TOKEN"
{
"header": {
"message": "Success",
"response_code": 1
},
"body": {
"results": [
{
"severity": 20,
"targetUrl": "www.domain.com/login",
"documentId": "00000000-0000-0000-0000-000000000000",
"targetDomain": "domain.com",
"passwordPlaintext": "string",
"password": "string",
"passwordType": "plaintext",
"sourceId": 226019,
"targetSubdomain": "www.domain.com",
"breachCategory": "combolist",
"username": "string",
"publishDate": "2026-10-03T05:11:07Z",
"source": {
"id": 226019,
"title": "Breach Name",
"shortTitle": "Breach Name",
"category": "combolist",
"type": "PRIVATE",
"site": "n/a",
"publishDate": "2026-10-03T05:01:22Z"
}
}
],
"page": 1,
"pageSize": 200,
"total": 1
}
}
Send a live request to
GET /dpp/dwm/v2/breach/data/domains/{domain} with Try it. See the full reference for the response fields and error codes: Get Records by Domain.
Path Parameters
string
required
Domain name to look up (or its SHA-1 hash)
Query Parameters
number
Page number (1-based), over the newest 1000 stored for this domain + type. Page size is set by limit (default 200).
string
Registered user uuid — makes this a PAID lookup. Must belong to your partner (404 if not); a disabled or expired user gives 403. Omit for a free lookup.
string
Record type. corporate = accounts on this email domain, email_domain = the same widened to infostealer-sourced records, target_domain/infected = machines that had this domain as a login target. Omit for all types combined — on a busy domain the combined view is dominated by target_domain records, so use corporate for employee exposure. One of
corporate, infected, email_domain, target_domain.number
Records per page, 10-200. Omit for 200. A value outside the range, a decimal, or a non-number is rejected with 400.
curl -X GET "<base_url>/dpp/dwm/v2/breach/data/domains/{domain}" \
-H "X-AccessToken: YOUR_ACCESS_TOKEN"
{
"header": {
"message": "Success",
"response_code": 1
},
"body": {
"results": [
{
"severity": 20,
"targetUrl": "www.domain.com/login",
"documentId": "00000000-0000-0000-0000-000000000000",
"targetDomain": "domain.com",
"passwordPlaintext": "string",
"password": "string",
"passwordType": "plaintext",
"sourceId": 226019,
"targetSubdomain": "www.domain.com",
"breachCategory": "combolist",
"username": "string",
"publishDate": "2026-10-03T05:11:07Z",
"source": {
"id": 226019,
"title": "Breach Name",
"shortTitle": "Breach Name",
"category": "combolist",
"type": "PRIVATE",
"site": "n/a",
"publishDate": "2026-10-03T05:01:22Z"
}
}
],
"page": 1,
"pageSize": 200,
"total": 1
}
}