What this endpoint does

Retrieves compromised credential exposures discovered across breach dumps and stealer malware logs for specified domains. Detections are categorized as "External" (employee credentials found on third-party websites and services outside the organization) or "Workforce" (credentials for the organization's own login portals and services). Use the novel_only filter to restrict results to newly discovered exposures not previously seen. Use the Identity: Search endpoint to find exposures by specific identity attributes, or the Identity: Lookup endpoint to retrieve a known detection by ID.

Response data

Each detection includes the compromised identity (username or email), password hash values and complexity properties, the targeted authorization service (login URL, domain, and technology stack such as VPN or webmail), any stolen browser cookies, the malware family responsible for the theft, and breach source metadata including exfiltration date. Results are paginated via a cursor-based offset token.

200Success

400Bad Request

401Unauthorized

403Forbidden

500Internal Server Error

defaultError