# Search by Email

Look up every compromised record for a single email address. The Data Breaches API offers two ways to do it: the standard search scoped to an address, and a dedicated lookup that covers the full history.

| | `/breaches?email=` | `/breaches/getEmail` |
| --- | --- | --- |
| Best for | Monitoring an address alongside your domain searches | Investigating one address across all history |
| Time range | Last 365 days by default; raw mode does not accept `email` | All history by default |
| Filters | All [Filters](data-breach-filters) | Date range and sort order |
| Records per page | 100 | 1,000 |
| Domain authorization | Required for the address's domain (added automatically) | Not required |
| Access | Data Breaches permission | Data Breaches permission plus the email-search permission |
| Credits | 1 per page | 1 per page |

## Standard search: `/breaches?email=`

`GET`

```bash
https://api.webz.io/breaches?token=YOUR_TOKEN&email=jane@example.com
```

Returns records whose compromised account email is exactly `jane@example.com` (case-insensitive). Everything else works as in any `/breaches` search: combine with [Filters](data-breach-filters) such as `data_type` or `has_password`, sort with `sort_by` and `order_by`, and page with `next` - see [Pagination](data-breach-pagination).

```bash
https://api.webz.io/breaches?token=YOUR_TOKEN&email=jane@example.com&data_type=infostealer&order_by=desc
```

The address's domain (`example.com`) is treated like any searched domain: it must be authorized for your token and is added automatically on first use - see [Search Scope](data-breach-scope).

> [!NOTE]
> The default window is the last 365 days - see [Time Range](data-breach-time-range). Raw mode (`raw=true`) does not accept `email`; for older records use `/breaches/getEmail` below.

## Full-history lookup: `/breaches/getEmail`

`GET`

```bash
https://api.webz.io/breaches/getEmail?token=YOUR_TOKEN&email=jane@example.com
```

Returns all records for the address across the entire Data Breaches history, 1,000 per page, with no domain authorization. Use it when you need the complete exposure history of one account - for example during an incident investigation or an executive-protection review.

> [!NOTE]
> `/breaches/getEmail` requires the email-search permission in addition to Data Breaches access; without it, requests return `401`. Contact **sales@webz.io** to enable it.

### Parameters

| Parameter | Required | Description |
| --- | --- | --- |
| `token` | Yes | Your API token, or send `Authorization: Bearer YOUR_TOKEN`. |
| `email` | Yes | The address to look up. Case-insensitive. |
| `breach_from`, `breach_to` | No | Breach or infection date range, epoch milliseconds UTC. |
| `crawled_from`, `crawled_to` | No | Collection date range, epoch milliseconds UTC. |
| `sort_by` | No | `breached` or `crawled`. Defaults to the date field you filter on; `breached` when there is no date filter. |
| `order_by` | No | `asc` (default) or `desc`. |
| `full_passwords` | No | `false` masks passwords even if your account may view them. Default `true`. |
| `next` | No | Pagination cursor. Follow the `next` URL from the response instead of building it. |

Use one date range per request - `breach_*` or `crawled_*`, not both. With no date range, the whole history is searched. There is no `limit` parameter; any parameter not listed above returns `400`.

```bash
curl -H "Authorization: Bearer YOUR_TOKEN" \
  "https://api.webz.io/breaches/getEmail?email=jane@example.com&breach_from=1577836800000&order_by=desc"
```

### Response and pagination

The same [Response Format](data-breach-response-format) as `/breaches`, with up to 1,000 records per page:

```json
{
  "records": [ ... ],
  "totalResults": 1230,
  "moreResultsAvailable": 230,
  "next": "/breaches/getEmail?email=jane@example.com&token=YOUR_TOKEN&next=CURSOR",
  "requestsLeft": 954,
  "totalResultsVerified": true
}
```

Append `next` to `https://api.webz.io` and call it as-is; repeat until `next` is `null`. Each page costs one credit. Passwords are masked unless your account has the view-password permission, as everywhere in the API - see [Record Data Fields](data-breach-data-fields).

> [!WARNING]
> An empty result is not proof that an address is clean. If a very large lookup cannot be completed in time, the response is an empty page rather than an error - narrow the date range and retry.

## Credits and limits

- Both endpoints cost **1 credit per page**, including a page with 0 records. `requestsLeft` shows your balance.
- The per-token rate limit of about 1 request per second applies to both - see [Errors, Rate Limits & Credits](data-breach-errors-limits).
- One address per request.

## Ask in plain English

The same lookup works through [Natural Language Search](data-breach-natural-language-search): a question that names a full address, such as `Show all leaked credentials for jane@example.com`, runs as a `/breaches?email=` search.

## Related documentation

- [Search Scope](data-breach-scope)
- [Filters](data-breach-filters)
- [Time Range](data-breach-time-range)
- [Pagination](data-breach-pagination)
- [Record Data Fields](data-breach-data-fields)
- [Errors, Rate Limits & Credits](data-breach-errors-limits)