---
title: "Get current subscription status"
method: GET
path: "/subscription/status"
---

# Get current subscription status

`GET /subscription/status`

Available on Core, Pro, and High RPM subscriptions. Returns details of the current subscription represented by the supplied hibp-api-key, including plan capabilities such as stealer-log access, breached-account k-anonymity access, bulk domain add features, and monitored-domain limits.

## Headers

- `user-agent` string, required

## Response `200`

Current subscription capabilities and limits for the supplied API key.

- SubscriptionStatus
  - `SubscriptionName` string, required — The name representing the current plan and level, for example "Core 1", "Pro 2", or "High RPM 12000".
  - `Description` string, required — A human-readable sentence explaining the scope of the subscription.
  - `SubscribedUntil` string, date-time, required — The date and time the current subscription ends in ISO 8601 format.
  - `Rpm` integer, required — The rate limit in requests per minute. This applies to the rate the breach search by email address API can be requested.
  - `DomainSearchMaxBreachedAccounts` integer, nullable, required — The size of the largest domain the subscription can search. This is expressed in the total number of breached email addresses on the domain, excluding those that appear solely in spam lists.
  - `MaxBreachedDomains` integer, nullable, required — The number of domains the subscription can add, regardless of their size. A null value indicates there is no max domain limit.
  - `IncludesStealerLogs` boolean, required — Indicates if the subscription includes access to the stealer logs APIs.
  - `IncludesBulkDomainAdd` boolean, required — Indicates if the subscription includes access to the APIs that add domains via DNS or email verification.
  - `IncludesAutoSubdomainVerification` boolean, required — Indicates if the subscription allows subdomains to be automatically added after the apex domain has already been verified.
  - `IncludesCustomerDomains` boolean, required — Indicates if the subscription allows the domains of customers to be added.
  - `IncludesKAnon` boolean, required — Indicates if the subscription includes access to the breached-account k-anonymity API.

## Other responses

- `401` — Unauthorized — the hibp-api-key header was missing, malformed, or invalid.
- `403` — Forbidden — no user agent has been specified in the request.
- `404` — Not found — no active subscription was found for the supplied API key.

---

[API](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3.md) · [All operations](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/haveibeenpwned/have-i-been-pwned-api-v3/revisions/b6c35caec844/schema)