Introduction

The Domain Exposure API summarizes credential exposure associated with a domain over the previous 12 months.

The report combines two types of compromised credential data:

• Data breaches — credentials exposed through breaches, database dumps, and combo lists.
• Infostealer logs — credentials collected from malware-infected devices.

It also distinguishes between two types of exposure:

• Employee exposure — compromised accounts associated with the organization's domain.
• Client exposure — compromised users found logging into services belonging to the domain.

For example, a compromised @example.com employee account would contribute to employee exposure. A compromised Gmail user whose infostealer log contains credentials for example.com would contribute to client exposure.

The API returns aggregated statistics rather than individual credentials or personally identifiable information.