What this endpoint does

Checks whether specific passwords have appeared in any breach data or stealer malware logs indexed by Identity Intelligence, without associating them to any identity or domain. Submit passwords as cryptographic hashes (supporting SHA1, SHA256, MD5, NTLM, BCRYPT, and other algorithms) using either the full hash or a five-character hash prefix for privacy-preserving lookups following the k-anonymity model. Multiple passwords can be checked in a single request. Password hashes for specific identities can be obtained from the exposed_secret.hashes field in records returned by the Identity: Lookup or Identity: Detections endpoints.

Response data

Returns an exposure status for each submitted password indicating how widely it has been seen across breach datasets: "Common" means the password appears frequently, "ExposedMultipleTimes" means it has been seen in more than one breach, "ExposedOnce" means it appeared in exactly one breach, and "NeverExposed" means it has not been found in any indexed breach data. No identity, domain, or breach source details are included — this endpoint evaluates password exposure in isolation.