{"uid":"cap_dwmJYPwaiG-V-uLJyrCMs","slug":"have-i-been-pwned-domain-breach-lookup-ddbd82e8","name":"Have I Been Pwned Domain Breach Lookup","description":"List the known public data breaches that affected a domain, from the Have I Been Pwned breach catalogue. Returns normalized breach metadata (name, date, account count, data classes, stealer-log and verified flags) plus a summary. This is which known breaches touched the domain, not whether a specific account is compromised. Breach indicators, not a guarantee.","url":"https://api.agentstools.dev/breach/domain","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","required":[],"properties":{"url":{"type":"string","description":"Alternative input: a URL (its host is used)"},"host":{"type":"string","description":"Alternative input: a bare hostname"},"domain":{"type":"string","description":"Domain to look up (e.g. example.com)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_pXKkW5kCHJXPIhvcaAN0I","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns known public data breaches that affected a given domain, with normalized metadata from the Have I Been Pwned catalogue including breach names, dates, account counts, and data classes exposed.","exampleAgentPrompt":"Can you check the Have I Been Pwned breach catalogue for adobe.com and tell me which known public breaches affected that domain, what types of data were exposed, and how many accounts were involved in each?","exampleUseCases":[{"title":"Vendor due diligence breach check","prompt":"Before we sign this SaaS contract, can you pull up all known public data breaches that have hit the vendor's domain at acmecorp.com? I want to know what types of data were exposed, how many accounts were affected, and whether any of those breaches involved passwords or financial info."},{"title":"Company breach history audit","prompt":"Can you check our company domain, bigfirm.com, against the Have I Been Pwned catalogue and give me a full rundown of every known breach that touched it — dates, how many accounts were compromised each time, and what kinds of personal data got out?"},{"title":"Educate employees on past exposures","prompt":"I'm putting together a security awareness presentation and want to show our staff how many times linkedin.com has appeared in known public data breaches — can you look that up and summarize the breach names, dates, and what personal data classes were exposed each time?"}],"resultDescription":"A list of normalized breach records from the HIBP catalogue that touched the queried domain, each including breach name, date, number of affected accounts, data classes exposed (e.g. passwords, email addresses, phone numbers), whether it was verified, and whether it was a stealer-log breach — plus an overall summary of breach exposure for the domain.","failureModes":["Domain not found in HIBP catalogue returns an empty breach list (not an error)","Malformed domain input may return a 400 bad request","Network timeout if HIBP upstream is slow","Payment not processed (402) if x402 payment header is missing or invalid","Rate limiting if called in rapid succession without valid payment"],"whenToPreferThis":"Use this endpoint when you need to know which public, catalogued data breaches have historically exposed accounts associated with a specific domain — ideal for security assessments, vendor due diligence, corporate risk profiling, or educating users about their organization's breach history. Prefer this over individual email lookups when the goal is domain-level exposure analysis rather than checking a specific person's account compromise status.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T19:07:10.073Z","isFirstParty":false}