---
title: "Get all breached email addresses for a domain"
method: GET
path: "/breacheddomain/{domain}"
---

# Get all breached email addresses for a domain

`GET /breacheddomain/{domain}`

Available on Core and Pro subscriptions. Returns all breached email aliases on a verified domain and the breach names they have appeared in. The domain must already have been added to the domain search dashboard and successfully verified. Sensitive breaches are returned because this API is only available after domain control has been demonstrated.

## Path parameters

- `domain` string, required

## Headers

- `user-agent` string, required

## Response `200`

Mapping of email aliases to breach names. For each breached email address on the domain, only the alias is returned along with each breach it has appeared in. Only the name attribute of the breach is returned.

- object

## Other responses

- `400` — Bad request — invalid domain format
- `401` — Unauthorized — the hibp-api-key header was missing, malformed, or invalid.
- `403` — Forbidden — no user agent has been specified in the request, the domain has not been verified in the domain search dashboard, or the current subscription is out of scope for the domain size or monitored-domain count.
- `404` — Not found — the domain does not have any email addresses in any breaches
- `429` — Too many requests — the rate limit has been exceeded. Typically, there is no need to query a domain unless a new breach has been added since the last query.
- `503` — Service unavailable

---

[API](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3.md) · [All operations](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/haveibeenpwned/have-i-been-pwned-api-v3/revisions/b6c35caec844/schema)