Every search covers a time window. By default it is the last 365 days.
Timestamps are epoch milliseconds, UTC.
| Parameter | Filters on | Default |
|---|---|---|
crawled_from, crawled_to | When Webz.io collected the record | crawled_from = 365 days ago |
breach_from, breach_to | The breach date, or the infostealer infection date | breach_from = 365 days ago |
https://api.webz.io/breaches?token=YOUR_TOKEN&email_domain=example.com&breach_from=1751630400000
In the default mode, a crawled_from or breach_from older than one year returns 400. To search further back, add raw=true. Raw mode has a restricted parameter set:
breach_from (optionally breach_to) or crawled_from (optionally crawled_to) - not both.login_domain or email_domain.token, raw, that one time group, that one domain filter, and next. Anything else returns 400.https://api.webz.io/breaches?token=YOUR_TOKEN&raw=true&email_domain=example.com&breach_from=1640995200000
Raw mode is not available to internal integration tokens; such requests return 403.