Get all breaches for an account
Available on Core, Pro, and High RPM subscriptions. Returns the breaches for the supplied account (email address, username, or phone number). The account is not case-sensitive and is trimmed of leading or trailing whitespace. The account should always be URL encoded. This is an authenticated API requiring both the hibp-api-key and user-agent headers. Test API keys can be used to query test addresses on the hibp-integration-tests.com domain.
Path parameters
URL-encoded account to search for (email address, username, or phone number)
Query parameters
Returns the full breach model when false. By default, only the name of the breach is returned rather than the complete breach data.
Filters the result set to only breaches against the domain specified. It is possible that one site (and consequently domain), is compromised on multiple occasions.
Returns breaches that have been flagged as 'unverified'. By default, both verified and unverified breaches are returned when performing a search.
Headers
User agent string identifying the consuming application. Required on all documented requests, including unauthenticated endpoints; missing user agents may receive HTTP 403 responses.
Response
A list of breaches for the account. By default the response is truncated to only the breach name. Set truncateResponse=false to receive the full breach model. Sensitive and retired breaches are not returned by the public API.