{"uid":"cap_BsN-_TvtBpbAvbBTNOLn4","slug":"breach-domain-f1499e73","name":"breach-domain","description":"List the known public data breaches that affected a domain, from the Have I Been Pwned breach catalogue. Returns normalized breach metadata (name, date, account count, data classes, stealer-log and verified flags) plus a summary. This is which known breaches touched the domain, not whether a specific account is compromised. Breach indicators, not a guarantee.","url":"https://payai.agentstools.dev/breach/domain","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","required":[],"properties":{"url":{"type":"string","description":"Alternative input: a URL (its host is used)"},"host":{"type":"string","description":"Alternative input: a bare hostname"},"domain":{"type":"string","description":"Domain to look up (e.g. example.com)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_HZ74BdJOYf4Chti8zAZrb","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns all known public data breaches from Have I Been Pwned that affected a given domain, with normalized metadata and a summary.","exampleAgentPrompt":"Can you pull all the known data breaches from Have I Been Pwned that have affected adobe.com — I want to see the breach names, dates, how many accounts were hit, and what types of data were exposed?","exampleUseCases":[{"title":"Corporate security breach audit","prompt":"Look up all known data breaches that have ever affected our company domain acmecorp.com — I need breach names, dates, account counts, and what categories of data were leaked so I can include it in our security audit report."},{"title":"Vendor due diligence check","prompt":"Before we onboard this new SaaS vendor, can you check if their domain techvendor.io shows up in any known data breaches from the HIBP catalogue? I want to know what was exposed and whether the breaches were verified."},{"title":"Customer trust notification prep","prompt":"We need to let our customers know about any historical breaches tied to our domain shopbright.com — can you pull the full breach history including data classes exposed and stealer-log flags so we can draft a transparent disclosure?"}],"resultDescription":"A list of normalized breach records from the Have I Been Pwned catalogue, each containing the breach name, date, affected account count, data classes compromised (e.g. email addresses, passwords, phone numbers), whether the breach involved stealer logs, and whether it has been verified. Also includes an overall summary of breaches affecting the domain.","failureModes":["Domain not found in HIBP catalogue — returns empty breach list or a no-breaches summary","Invalid or malformed domain input — may return a validation error","HIBP upstream service unavailable — returns a service error","Rate limiting from upstream provider — returns a timeout or error response","Ambiguous input (URL vs bare hostname) — result depends on host extraction logic"],"whenToPreferThis":"Use this endpoint when you need to audit a domain's breach history at the organizational level rather than checking a specific individual email address. It is ideal for security reviews, vendor due diligence, compliance reporting, and generating breach summaries for a company or service domain. Choose this over an email-level lookup when the goal is domain-wide exposure assessment.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T07:12:44.850Z","isFirstParty":false}