What this endpoint does

Enumerates compromised identities associated with one or more domains across all breach data and stealer malware logs in Identity Intelligence. Set domain_types to control the search scope: "Email" finds identities using email addresses at the domain (e.g., user@example.com), "Authorization" finds identities with credentials for login portals hosted on the domain, or specify both to search across all exposure types. Use optional filters to narrow results by date ranges, password complexity, malware families, or authorization technologies. To retrieve full credential details for discovered identities, pass them to the Identity: Lookup endpoint.

Response data

Returns a lightweight list of exposed identities, each containing the login (username or email address) and the associated domain. This deliberately minimal format is designed for enumeration at scale — use the Identity: Lookup endpoint with the discovered login and domain values to retrieve full credential records including password hashes, breach sources, and compromise metadata. Results are paginated via a cursor-based offset token.

200Success

400Bad Request

401Unauthorized

403Forbidden

500Internal Server Error

defaultError