How do I list breaches for a company domain?
GET /breaches?domain=adobe.com returns public breach records for that domain. Domain catalog lookups are the safest public demo path and do not require sending personal emails.
Breach Check API
HIBP
Domain Catalog
k-Anonymity
Known breaches. Domain first.
List public HIBP breach records by domain, screen emails when you have a key, and check pwned passwords with a 5 character SHA-1 prefix. Logs never keep a full address.
/breaches · catalog25 · batch emails5 hex · hash prefix60 · req / 15 min
List domain breaches.
This calls GET /breaches for allowlisted domains only. It does not look up personal emails. The catalog is HIBP-backed so the playground waits for you to press Run.
Request builder
Domain in, public breach catalog out.
GET /breaches
Demo allowlist is example.com and adobe.com.
Output preview
Live response from the API, plus the exact request to reproduce it.
Press Run to load the HIBP-backed domain catalog. This demo never sends personal emails.
Why Breach Check
Known leaks. Privacy-first logging.
Domain breach catalog
GET /breaches?domain= lists public HIBP records without sending anyone's email address.
Email screening
GET /check returns breached, breachCount, and per-breach name, date, pwnCount, and data classes.
Batch up to 25
POST /check throttles 1.5s between upstream calls and returns total, breached, clean, and failed.
k-anonymity passwords
GET /password?hash_prefix= uses the first 5 SHA-1 hex characters. Plaintext is hashed in memory only.
Prefix-only logs
Only the first 5 hex characters of an email SHA-1 are logged. Full addresses are not written.
Explicit HIBP status
Health reports hibpConfigured. Missing keys return 503 with hibp-api-key-required instead of fake data.
/api/v1/breach-check
Endpoints, at a glance.
Domain catalog, email checks, and k-anonymity password ranges. Logs keep SHA-1 prefixes only.
GET/api/v1/breach-check/breaches
Breach catalog
Public HIBP records, optionally filtered by domain. Does not require a personal email.
GET/api/v1/breach-check/check
Email check
Look up one email. Requires a server-side HIBP API key for live data.
POST/api/v1/breach-check/check
Batch email check
1 to 25 emails. Upstream calls pause 1.5s between items.
GET/api/v1/breach-check/password
Pwned password
k-anonymity hash_prefix or in-memory password hash. Prefix only is logged.
| Parameter | Type | Required | Description |
|---|---|---|---|
| domain | string | no | Filter /breaches. Example: adobe.com. |
| string | for GET /check | Address to screen against known breaches. | |
| emails | array | for POST /check | 1 to 25 email strings. |
| hash_prefix | string | for /password | First 5 hex characters of a SHA-1 password hash. |
| password | string | for /password | Plaintext hashed in memory. Never stored. |
Error reference
Failures you can plan for.
Upstream failures include a machine-readable reason such as hibp-api-key-required.
400Validation Error
Invalid email, invalid 5-character hash prefix, or a batch larger than 25 emails.
401Authentication Error
Missing or invalid gateway API key. Send x-api-key or api_key with every request.
404Not Found
Unknown route under /api/v1/breach-check.
429Rate Limit Error
More than 60 requests in 15 minutes, or HIBP upstream rate limiting.
502Upstream Auth Error
HIBP rejected the configured key or the upstream network failed.
503Configuration Error
HIBP_API_KEY is not configured for live email lookups.
Example error response
{
"success": false,
"error": "Invalid input parameters",
"details": ["\"email\" must be a valid email"],
"correlationId": "req_abc123"
}FAQ
API questions developers ask first.
How do email lookups work?
GET /check?email= returns breached, breachCount, and per-breach detail. POST /check accepts 1 to 25 emails and throttles 1.5s between upstream HIBP calls.
Can I check a password without sending the password?
Yes. GET /password?hash_prefix=5BAA6 uses the NIST k-anonymity model. You can also pass password, which is hashed in memory and never stored.
What is logged?
Only the first 5 hex characters of the email SHA-1 hash. Full addresses are not written to logs. Live email lookups need a server-side HIBP API key.
How do I authenticate requests?
Send your Datpaq API key as an x-api-key header or an api_key query parameter. Keys are created in the Datpaq dashboard and a free tier is included.
Check known breaches without guessing logs.
List public HIBP records by domain, screen emails when you have a key, and query pwned passwords with k-anonymity prefixes.