{"uid":"cap_IO_1cuO0FC6oT1Hqyd4k2","slug":"identity-graph-email-to-breach-correlation-c11d8a11","name":"Identity Graph - Email-to-Breach Correlation","description":"Correlate an email address against the criminal breach/stealer corpus to surface linked phone numbers, secondary domains, and other identifiers tied to the same compromised identity. Call to map the blast radius of a known compromise across an organization.","url":"https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/identity-graph","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"email":{"type":"string","description":"Email address to correlate against the criminal dump corpus"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.35","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.35/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.35","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.35","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_IlDz495srlMwm9uUTJrjL","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.35","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Correlates an email address against criminal breach and infostealer corpora to surface linked phone numbers, domains, and other identifiers tied to the same compromised identity.","exampleAgentPrompt":"Can you check what phone numbers, domains, and other identifiers are linked to jane.doe@acmecorp.com in criminal breach and infostealer databases — I need to understand the full blast radius of her compromised identity.","exampleUseCases":[{"title":"Post-breach employee identity mapping","prompt":"We just found out that marcus.reyes@techventures.io was in a credential dump — can you pull the full identity graph for that email and show me every linked phone number, domain, and identifier that appeared alongside it in criminal corpora?"},{"title":"Vendor security due diligence","prompt":"Before we onboard this contractor, can you run a breach identity correlation on contact@freelancedev-services.com and tell me if it's linked to any suspicious secondary domains or phone numbers in criminal databases?"},{"title":"Incident response blast radius assessment","prompt":"We had a breach affecting sarah.kim@globalretail.com — pull the identity graph for that email from the criminal breach corpus so our IR team can see all correlated identifiers and understand the full scope of exposure."}],"resultDescription":"Returns a JSON object with a found boolean indicating whether the email appears in the criminal corpus, an array of breach/stealer sources, arrays of correlated phone numbers and secondary domains linked to the same compromised identity, and a count of total correlated identifiers.","failureModes":["Email not found in corpus (found: false, empty arrays returned)","Invalid or malformed email address causes 400 validation error","API timeout or 5xx error if corpus query is slow","Empty arrays returned when email is found but no correlated identifiers exist in the dataset","Rate limiting or payment failure causes 402/429 response"],"whenToPreferThis":"Use this endpoint when you need to understand the full identity footprint of a known compromised email — specifically to surface linked phone numbers, domains, and cross-account identifiers from criminal breach and infostealer data. Prefer this over simple breach-check endpoints when you need lateral identity mapping rather than just a yes/no compromise confirmation. Ideal for incident response blast-radius assessments, supply chain vetting, and insider threat investigations.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:44:05.246Z","isFirstParty":false}