Look up every compromised record for a single email address. The Data Breaches API offers two ways to do it: the standard search scoped to an address, and a dedicated lookup that covers the full history.
/breaches?email= | /breaches/getEmail | |
|---|---|---|
| Best for | Monitoring an address alongside your domain searches | Investigating one address across all history |
| Time range | Last 365 days by default; raw mode does not accept email | All history by default |
| Filters | All Filters | Date range and sort order |
| Records per page | 100 | 1,000 |
| Domain authorization | Required for the address's domain (added automatically) | Not required |
| Access | Data Breaches permission | Data Breaches permission plus the email-search permission |
| Credits | 1 per page | 1 per page |
/breaches?email=GET
https://api.webz.io/breaches?token=YOUR_TOKEN&email=[email protected]
Returns records whose compromised account email is exactly [email protected] (case-insensitive). Everything else works as in any /breaches search: combine with Filters such as data_type or has_password, sort with sort_by and order_by, and page with next - see Pagination.
https://api.webz.io/breaches?token=YOUR_TOKEN&email=[email protected]&data_type=infostealer&order_by=desc
The address's domain (example.com) is treated like any searched domain: it must be authorized for your token and is added automatically on first use - see Search Scope.
The default window is the last 365 days - see Time Range. Raw mode (raw=true) does not accept email; for older records use /breaches/getEmail below.
/breaches/getEmailGET
https://api.webz.io/breaches/getEmail?token=YOUR_TOKEN&email=[email protected]
Returns all records for the address across the entire Data Breaches history, 1,000 per page, with no domain authorization. Use it when you need the complete exposure history of one account - for example during an incident investigation or an executive-protection review.
/breaches/getEmail requires the email-search permission in addition to Data Breaches access; without it, requests return 401. Contact [email protected] to enable it.
| Parameter | Required | Description |
|---|---|---|
token | Yes | Your API token, or send Authorization: Bearer YOUR_TOKEN. |
email | Yes | The address to look up. Case-insensitive. |
breach_from, breach_to | No | Breach or infection date range, epoch milliseconds UTC. |
crawled_from, crawled_to | No | Collection date range, epoch milliseconds UTC. |
sort_by | No | breached or crawled. Defaults to the date field you filter on; breached when there is no date filter. |
order_by | No | asc (default) or desc. |
full_passwords | No | false masks passwords even if your account may view them. Default true. |
next | No | Pagination cursor. Follow the next URL from the response instead of building it. |
Use one date range per request - breach_* or crawled_*, not both. With no date range, the whole history is searched. There is no limit parameter; any parameter not listed above returns 400.
curl -H "Authorization: Bearer YOUR_TOKEN" \
"https://api.webz.io/breaches/[email protected]&breach_from=1577836800000&order_by=desc"
The same Response Format as /breaches, with up to 1,000 records per page:
{
"records": [ ... ],
"totalResults": 1230,
"moreResultsAvailable": 230,
"next": "/breaches/[email protected]&token=YOUR_TOKEN&next=CURSOR",
"requestsLeft": 954,
"totalResultsVerified": true
}Append next to https://api.webz.io and call it as-is; repeat until next is null. Each page costs one credit. Passwords are masked unless your account has the view-password permission, as everywhere in the API - see Record Data Fields.
An empty result is not proof that an address is clean. If a very large lookup cannot be completed in time, the response is an empty page rather than an error - narrow the date range and retry.
requestsLeft shows your balance.The same lookup works through Natural Language Search: a question that names a full address, such as Show all leaked credentials for [email protected], runs as a /breaches?email= search.