Skip to main content
POST
security.breach.check

Authorizations

Authorization
string
header
required

API key: sk_live_…

Headers

Idempotency-Key
string

Optional. A retry with the same key returns the stored result.

Maximum string length: 255
Pramaan-Max-Price-Micro
string

Optional. The most this request may be priced at, in micro-USD (a whole number above 0). It replaces the capability's own price ceiling for this request, lower or higher. Sources that could cost more are left out; when none is left the answer is 400 with the lowest limit that would work.

Pattern: ^[1-9]\d{0,14}$

Body

application/json
kind
enum<string>
required

The exposure to check: email, username, password hash, or a matching identifier and password hash.

Available options:
email,
username,
password,
email_password,
username_password
email
string

Email to check; required only for email and email_password.

Required string length: 1 - 320
username
string

Username to check; required only for username and username_password.

Required string length: 1 - 256
passwordHash
string

Hexadecimal password hash, never the password itself; required for password checks.

Pattern: ^[a-fA-F0-9]+$
hashAlgorithm
enum<string>

Hash algorithm; defaults to sha256 for password checks. Legacy hashes must be selected explicitly.

Available options:
sha256,
sha1,
md5

Response

The result

exposed
boolean
required

Whether the supplied identifier or credential combination was found in a breach.

sources
string[]

Breached site or merchant names, up to 100; no credentials are returned.

Maximum array length: 100
firstObservedAt
string

When the identifier was first observed by the data source, in ISO format; this is not the breach date.

includedPlaintextPassword
boolean

Whether the evidence included a plaintext password; no password or hash is returned.