# Introduction

The Domain Exposure API summarizes credential exposure associated with a domain over the previous 12 months.

The report combines two types of compromised credential data:

- **Data breaches** — credentials exposed through breaches, database dumps, and combo lists.
- **Infostealer logs** — credentials collected from malware-infected devices.

It also distinguishes between two types of exposure:

- **Employee exposure** — compromised accounts associated with the organization's domain.
- **Client exposure** — compromised users found logging into services belonging to the domain.

For example, a compromised `@example.com` employee account would contribute to employee exposure. A compromised Gmail user whose infostealer log contains credentials for `example.com` would contribute to client exposure.

The API returns aggregated statistics rather than individual credentials or personally identifiable information.