Every search is scoped to a domain or an email. At least one of the four parameters below must be present, or the request returns 400.
| Parameter | Searches | Example |
|---|---|---|
email | One compromised email address | [email protected] |
email_domain | Compromised accounts by email domain | email_domain=example.com |
login_domain | Credentials used to log into a domain | login_domain=example.com |
domain | Either the email domain or the login domain | domain=example.com |
example.com) in login_domain also matches its subdomains.sub.example.com) stays exact to that subdomain.email is matched exactly; its domain part is what gets authorized on your account. For the full history of one address, see Search by Email.Values are case-insensitive. You can combine email_domain with login_domain in one request, but you cannot send two values for the same parameter - search one domain at a time.
You can only search domains authorized for your token. A new domain is added automatically on first use; a brand-new domain may take about 20 seconds to index on that first request. See Errors, Rate Limits & Credits.