# Search Scope

Every search is scoped to a domain or an email. At least one of the four parameters below must be present, or the request returns `400`.

| Parameter | Searches | Example |
| --- | --- | --- |
| `email` | One compromised email address | `email=jane@example.com` |
| `email_domain` | Compromised accounts by email domain | `email_domain=example.com` |
| `login_domain` | Credentials used to log into a domain | `login_domain=example.com` |
| `domain` | Either the email domain or the login domain | `domain=example.com` |

## Domain matching

- A **root domain** (`example.com`) in `login_domain` also matches its subdomains.
- A **subdomain** (`sub.example.com`) stays exact to that subdomain.
- `email` is matched exactly; its domain part is what gets authorized on your account.

Values are case-insensitive. You can combine `email_domain` with `login_domain` in one request, but you cannot send two values for the same parameter - search one domain at a time.

> [!NOTE]
> You can only search domains authorized for your token. A new domain is added automatically on first use; a brand-new domain may take about 20 seconds to index on that first request. See [Errors, Rate Limits & Credits](data-breach-errors-limits).