---
title: "Lookup passwords for exposure"
method: POST
path: "/identity/password/lookup"
tags: ["Credentials"]
---

# Lookup passwords for exposure

`POST /identity/password/lookup`

Checks if specified passwords were exposed.

## Request body

- PasswordLookupRequest
  - `passwords` PasswordHash[], required
    - union
      - FullPasswordHash
        - `algorithm` 'SHA1' | 'SHA256' | 'HASH32' | 'HASH40' | 'HASH64' | 'HASH96' | 'HASH128' | 'BCRYPT' | 'PHPASS' | 'HASHCAT_HEX' | 'BASE64' | 'SSHA' | 'PBKDF2_SHA256' | 'BASE64_HASH32' | 'BASE64_HASH40' | 'BASE64_HASH128' | 'BASE64_INTEGER_HASH32' | 'BASE64_INTEGER_HASH40' | 'BASE64_INTEGER_HASH64' | 'BASE64_INTEGER_HASH96' | 'BASE64_INTEGER_HASH128' | 'MYSQL_SHA_V41PLUS' | 'NTLM' | 'MD5', required
        - `hash` string, required
      - PrefixPasswordHash
        - `algorithm` 'SHA1' | 'SHA256' | 'HASH32' | 'HASH40' | 'HASH64' | 'HASH96' | 'HASH128' | 'BCRYPT' | 'PHPASS' | 'HASHCAT_HEX' | 'BASE64' | 'SSHA' | 'PBKDF2_SHA256' | 'BASE64_HASH32' | 'BASE64_HASH40' | 'BASE64_HASH128' | 'BASE64_INTEGER_HASH32' | 'BASE64_INTEGER_HASH40' | 'BASE64_INTEGER_HASH64' | 'BASE64_INTEGER_HASH96' | 'BASE64_INTEGER_HASH128' | 'MYSQL_SHA_V41PLUS' | 'NTLM' | 'MD5', required
        - `hash_prefix` string, required

## Response `200`

Success

- PasswordLookupResponse
  - `results` SinglePasswordLookupResult[], required
    - `password` union, required
      - FullPasswordHash
        - `algorithm` 'SHA1' | 'SHA256' | 'HASH32' | 'HASH40' | 'HASH64' | 'HASH96' | 'HASH128' | 'BCRYPT' | 'PHPASS' | 'HASHCAT_HEX' | 'BASE64' | 'SSHA' | 'PBKDF2_SHA256' | 'BASE64_HASH32' | 'BASE64_HASH40' | 'BASE64_HASH128' | 'BASE64_INTEGER_HASH32' | 'BASE64_INTEGER_HASH40' | 'BASE64_INTEGER_HASH64' | 'BASE64_INTEGER_HASH96' | 'BASE64_INTEGER_HASH128' | 'MYSQL_SHA_V41PLUS' | 'NTLM' | 'MD5', required
        - `hash` string, required
      - PrefixPasswordHash
        - `algorithm` 'SHA1' | 'SHA256' | 'HASH32' | 'HASH40' | 'HASH64' | 'HASH96' | 'HASH128' | 'BCRYPT' | 'PHPASS' | 'HASHCAT_HEX' | 'BASE64' | 'SSHA' | 'PBKDF2_SHA256' | 'BASE64_HASH32' | 'BASE64_HASH40' | 'BASE64_HASH128' | 'BASE64_INTEGER_HASH32' | 'BASE64_INTEGER_HASH40' | 'BASE64_INTEGER_HASH64' | 'BASE64_INTEGER_HASH96' | 'BASE64_INTEGER_HASH128' | 'MYSQL_SHA_V41PLUS' | 'NTLM' | 'MD5', required
        - `hash_prefix` string, required
    - `exposure_status` 'NeverExposed' | 'Uncommon' | 'Common', required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal Server Error
- `default` — Error

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)