# Request Parameters

All parameters for the `/breaches` endpoint. Request method is HTTP `GET`. Each parameter may appear once, except the multi-valued ones noted below; an unknown parameter returns `400`.

## Required

At least one of these must be present - see [Search Scope](data-breach-scope):

| Parameter | Description |
| --- | --- |
| `token` | Your API token. Always required. |
| `email` | One compromised email address. |
| `email_domain` | Search by email domain. |
| `login_domain` | Search by login domain. |
| `domain` | Match either email or login domain. |

## Time window

Epoch milliseconds, UTC. See [Time Range](data-breach-time-range).

| Parameter | Description |
| --- | --- |
| `crawled_from`, `crawled_to` | Filter by crawl time. `crawled_from` defaults to 365 days ago. |
| `breach_from`, `breach_to` | Filter by breach or infection date. `breach_from` defaults to 365 days ago. |
| `raw` | `true` lifts the one-year limit under a restricted parameter set. |

## Filters

| Parameter | Description |
| --- | --- |
| `data_type` | `infostealer` or `data_breach`. Multi-valued (OR). |
| `sub_type` | `database_dump`, `data_breach_combo_list`, `stealer_logs`, `stealers_combo_list`. Multi-valued (OR). |
| `password_type` | Password type. Multi-valued (OR). |
| `has_password` | `true` / `false`. |
| `is_premium` | `true` / `false`. |
| `service_category`, `service_name` | Detected service class, e.g. `VPN` / `Fortinet`. |
| `breach_uuid` | 40-char hex breach id; still needs a domain or email scope. |
| `breach_name`, `login_url` | Free-text match within selected records. |

## Sorting & paging

| Parameter | Description |
| --- | --- |
| `sort_by` | `crawled` (default) or `breached`. |
| `order_by` | `asc` (default) or `desc`. |
| `next` | Continuation cursor from the previous response - see [Pagination](data-breach-pagination). |