All parameters for the /nhi endpoint. Request method is HTTP GET. Each parameter may appear once, except the multi-valued ones noted below; an unknown parameter returns 400.
Required
Parameter
Description
token
Your API token. Always required.
domain
The domain to check, e.g. example.com. Schemes, paths, and ports are stripped; example.com and www.example.com are different domains. Must be a valid registered domain.
Time window
Epoch milliseconds, UTC. No default window - omit both to cover all collected data.
Parameter
Description
crawled_from, crawled_to
Filter by collection time.
breach_from, breach_to
Filter by exfiltration date.
Filters
Parameter
Description
token_type
Kind of credential, e.g. ApiKey, OauthPAT, RefreshToken, PrivateKey. Multi-valued (OR).
service_type
Detector / issuing service, e.g. googleoauth2, vercel. Multi-valued (OR).
verification_status
verified, unverified, or unknown. Multi-valued (OR).
