# Introduction

The Data Breaches API turns compromised credential data into structured JSON - accounts exposed in data breaches, combo lists, and infostealer logs, collected continuously and enriched for threat intelligence.

## Coverage

Records come from two kinds of sources, exposed in the `type` field:

- **Data breaches** (`data_breach`) - large-scale leaks and dumps from breached services and combo lists.
- **Infostealer logs** (`infostealer`) - credentials and device data harvested from malware-infected machines.

The `sub_type` field narrows this further: `database_dump`, `data_breach_combo_list`, `stealer_logs`, `stealers_combo_list`.

## Enrichment

Every record is enriched at collection time:

- **Account** - the compromised email, account name, password, and password type.
- **Breach** - the breach name, date, source domain, and the asset types it exposed.
- **Device** (infostealer records) - infection id, IP, location, operating system, malware family, and more.
- **Service classification** - the kind of service the login belongs to, such as category `VPN` and name `Fortinet`, derived from the login URL.

## How it works

1. Send a `GET` request scoped to a domain or email - see [Quickstart](data-breach-quickstart).
2. Read the matching records from the JSON response.
3. Follow the `next` URL to page through the rest - see [Pagination](data-breach-pagination).

> [!NOTE]
> The Data Breaches API requires its own permission and authorized domains on your account. You can only search domains authorized for your token - contact sales@webz.io for access.