SpyCloud Breach API

openapi: 3.2.0
info:
  title: Spycloud Breach API
  version: '1.1'
  description: 'Operations tagged Breach across 5 of this provider''s published API definitions: spycloud-consumer-ato-prevention-openapi.yml, spycloud-data-partnership-openapi.yml, spycloud-enterprise-ato-prevention-openapi.yml, spycloud-investigations-openapi.yml, spycloud-session-identity-protection-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.spycloud.io/sp-v2
- url: https://api.spycloud.io/enterprise-v2
- url: https://api.spycloud.io/investigations-v2
- url: https://api.spycloud.io/sip-v1
security:
- sec0: []
tags:
- name: Breach
paths:
  /breach/data/emails/{email}:
    servers:
    - url: https://api.spycloud.io/sp-v2
    get:
      summary: Get records by email address
      description: ''
      operationId: cap-get-records-by-email-address
      parameters:
      - name: email
        in: path
        description: One or more comma delimited email addresses to search for. You can search for up to 10 email addresses at a time. You can also search for the sha1, sha256, or sha512 hash of the email.
        schema:
          type: string
        required: true
      - name: since
        in: query
        description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field in format YYYY-MM-DD
        schema:
          type: string
          format: date
      - name: until
        in: query
        description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field in format YYYY-MM-DD
        schema:
          type: string
          format: date
      - name: severity
        in: query
        description: One or more comma delimited numeric severity code to filter based on the severity.
        schema:
          type: string
      - name: source_id
        in: query
        description: One or more comma delimited numeric source id to filter.
        schema:
          type: string
      - name: salt
        in: query
        description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used.
        schema:
          type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value:
                    cursor: ''
                    hits: 1000
                    results:
                    - email: test@example.com
                      document_id: 27800eca-bd08-47e7-8ecd-b3c142633047
                      source_id: 153965
                      email_domain: example.com
                      email_username: test
                      domain: example.com
                      severity: 20
                      spycloud_publish_date: '2026-04-24T00:00:00Z'
                      breach_title: Unknown Phishing Kit
                      breach_category: phished
              schema:
                type: object
                properties:
                  cursor:
                    type: string
                    example: ''
                  hits:
                    type: integer
                    example: 1000
                    default: 0
                  results:
                    type: array
                    items:
                      type: object
                      properties:
                        email:
                          type: string
                          example: test@example.com
                        document_id:
                          type: string
                          example: 27800eca-bd08-47e7-8ecd-b3c142633047
                        source_id:
                          type: integer
                          example: 153965
                          default: 0
                        email_domain:
                          type: string
                          example: example.com
                        email_username:
                          type: string
                          example: test
                        domain:
                          type: string
                          example: example.com
                        severity:
                          type: integer
                          example: 20
                          default: 0
                        spycloud_publish_date:
                          type: string
                          example: '2026-04-24T00:00:00Z'
                          format: date-time
                        breach_title:
                          type: string
                          example: Unknown Phishing Kit
                        breach_category:
                          type: string
                          example: phished
                required:
                - hits
                - results
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
      tags:
      - Breach
  /breach/data/ips/{ip}:
    servers:
    - url: https://api.spycloud.io/sp-v2
    get:
      summary: Get records by IP address
      description: ''
      operationId: cap-get-records-by-ip-address
      parameters:
      - name: ip
        in: path
        description: IP address or network CIDR notation to search for. For CIDR notation, use an underscore instead of a slash.
        schema:
          type: string
        required: true
      - name: since
        in: query
        description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field in either format for date YYYY-MM-DD or datetime YYYY-MM-DDThh:mm:ss[z]
        schema:
          type: string
          format: date
      - name: until
        in: query
        description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field in either format for date YYYY-MM-DD or datetime YYYY-MM-DDThh:mm:ss[z]
        schema:
          type: string
          format: date
      - name: severity
        in: query
        description: One or more comma delimited numeric severity code to filter based on the severity.
        schema:
          type: string
      - name: source_id
        in: query
        description: One or more comma delimited numeric source id to filter.
        schema:
          type: string
      - name: salt
        in: query
        description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used.
        schema:
          type: string
      - name: since_modification_date
        in: query
        description: This parameter allows you to define the starting point for a date range query on the when an already published record was modified (record_modification_date).
        schema:
          type: string
          format: date
      - name: until_modification_date
        in: query
        description: This parameter allows you to define the ending point for a date range query on the when an already published record was modified (record_modification_date).
        schema:
          type: string
          format: date
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value:
                    cursor: 5621cbc4-ebae-4eae-aa36-555401f88d01
                    hits: 306504
                    results:
                    - severity: 5
                      ip_addresses:
                      - 192.168.1.1
                      breach_title: Unknown Phishing Kit
                      spycloud_publish_date: '2026-04-28T20:02:37Z'
                      source_id: 155269
                      document_id: ec333df8-9d61-462b-99ce-bfd932f0dfcf
                      breach_category: phished
              schema:
                type: object
                properties:
                  cursor:
                    type: string
                    example: 5621cbc4-ebae-4eae-aa36-555401f88d01
                  hits:
                    type: integer
                    example: 306504
                    default: 0
                  results:
                    type: array
                    items:
                      type: object
                      properties:
                        severity:
                          type: integer
                          example: 5
                          default: 0
                        ip_addresses:
                          type: array
                          items:
                            type: string
                            example: 192.168.1.1
                        breach_title:
                          type: string
                          example: Unknown Phishing Kit
                        spycloud_publish_date:
                          type: string
                          example: '2026-04-28T20:02:37Z'
                          format: date-time
                        source_id:
                          type: integer
                          example: 155269
                          default: 0
                        document_id:
                          type: string
                          example: ec333df8-9d61-462b-99ce-bfd932f0dfcf
                        breach_category:
                          type: string
                          example: phished
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
      tags:
      - Breach
  /breach/data/usernames/{username}:
    servers:
    - url: https://api.spycloud.io/sp-v2
    get:
      summary: Get records by usernames
      description: ''
      operationId: get-records-by-usernames
      parameters:
      - name: username
        in: path
        description: Username you wish to search for. You can also search for the sha1, sha256, or sha512 hash of the username.
        schema:
          type: string
        required: true
      - name: since
        in: query
        description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field in either format for date YYYY-MM-DD or datetime YYYY-MM-DDThh:mm:ss[z]
        schema:
          type: string
          format: date
      - name: until
        in: query
        description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field in either format for date YYYY-MM-DD or datetime YYYY-MM-DDThh:mm:ss[z]
        schema:
          type: string
          format: date
      - name: severity
        in: query
        description: One or more comma delimited numeric severity code to filter based on the severity.
        schema:
          type: string
      - name: source_id
        in: query
        description: One or more comma delimited numeric source id to filter.
        schema:
          type: string
      - name: salt
        in: query
        description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used.
        schema:
          type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value:
                    cursor: 0bc4bc0f-2801-45fd-9a23-5e80f8f1b4ec
                    hits: 1000
                    results:
                    - username: brian
                      document_id: 222a1530-a7dc-4875-b829-40893949316f
                      source_id: 154861
                      severity: 5
                      spycloud_publish_date: '2026-04-27T00:00:00Z'
                      breach_title: Unknown Phishing Kit
                      breach_category: phished
              schema:
                type: object
                properties:
                  cursor:
                    type: string
                    example: 0bc4bc0f-2801-45fd-9a23-5e80f8f1b4ec
                  hits:
                    type: integer
                    example: 1000
                    default: 0
                  results:
                    type: array
                    items:
                      type: object
                      properties:
                        username:
                          type: string
                          example: brian
                        document_id:
                          type: string
                          example: 222a1530-a7dc-4875-b829-40893949316f
                        source_id:
                          type: integer
                          example: 154861
                          default: 0
                        severity:
                          type: integer
                          example: 5
                          default: 0
                        spycloud_publish_date:
                          type: string
                          example: '2026-04-27T00:00:00Z'
                          format: date-time
                        breach_title:
                          type: string
                          example: Unknown Phishing Kit
                        breach_category:
                          type: string
                          example: phished
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
      tags:
      - Breach
  /breach/catalog/:
    servers:
    - url: https://api.spycloud.io/sp-v2
    get:
      summary: List all breach metadata
      description: ''
      operationId: cap-list-all-breach-metadata
      parameters:
      - name: query
        in: query
        description: Query value to search the breach catalog for.
        schema:
          type: string
      - name: cursor
        in: query
        description: Token used for iterating through multiple pages of results.
        schema:
          type: string
      - name: since
        in: query
        description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field in either format for date YYYY-MM-DD or datetime YYYY-MM-DDThh:mm:ss[z]
        schema:
          type: string
          format: date
      - name: until
        in: query
        description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field in either format for date YYYY-MM-DD or datetime YYYY-MM-DDThh:mm:ss[z]
        schema:
          type: string
          format: date
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
      tags:
      - Breach
  /breach/catalog/{id}:
    servers:
    - url: https://api.spycloud.io/sp-v2
    get:
      summary: Get metadata for a breach
      description: ''
      operationId: get-metadata-for-a-breach
      parameters:
      - name: id
        in: path
        description: Numerical ID of the breach. Both integer and UUIDv4 ID formats are supported. You may also use a comma delimiter to request more than one breach at a time.
        schema:
          type: string
        required: true
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
      tags:
      - Breach
  /breach/data/phone-numbers/{phone_number}:
    servers:
    - url: https://api.spycloud.io/sp-v2
    get:
      summary: Get records by phone number
      description: ''
      operationId: cap-get-records-by-phone-number
      parameters:
      - name: phone_number
        in: path
        description: phone number you wish to search for. Must only be numerical values of length 7 to 15 characters. You can also search for the sha1, sha256, or sha512 hash of the phone number.
        schema:
          type: string
        required: true
      - name: since
        in: query
        description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field in either format for date YYYY-MM-DD or datetime YYYY-MM-DDThh:mm:ss[z]
        schema:
          type: string
          format: date
      - name: until
        in: query
        description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field in either format for date YYYY-MM-DD or datetime YYYY-MM-DDThh:mm:ss[z]
        schema:
          type: string
          format: date
      - name: severity
        in: query
        description: One or more comma delimited numeric severity code to filter based on the severity.
        schema:
          type: string
      - name: source_id
        in: query
        description: One or more comma delimited numeric source id to filter.
        schema:
          type: string
      - name: salt
        in: query
        description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used.
        schema:
          type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value:
                    cursor: f804576d-ca88-42ca-b833-bd0fe5cc23f8
                    hits: 1000
                    results:
                    - document_id: c9e6b730-7331-4c06-a658-87bb5d554bfd
                      source_id: 152719
                      phone_full: '15124592222'
                      severity: 5
                      spycloud_publish_date: '2026-04-21T00:00:00Z'
                      breach_title: Abrigo, Inc.
                      breach_category: exfiltrated
              schema:
                type: object
                properties:
                  cursor:
                    type: string
                    example: f804576d-ca88-42ca-b833-bd0fe5cc23f8
                  hits:
                    type: integer
                    example: 1000
                    default: 0
                  results:
                    type: array
                    items:
                      type: object
                      properties:
                        phone:
                          type: string
                          example: '5124592222'
                        document_id:
                          type: string
                          example: c9e6b730-7331-4c06-a658-87bb5d554bfd
                        source_id:
                          type: integer
                          example: 152719
                          default: 0
                        phone_full:
                          type: string
                          example: '5124592222'
                        severity:
                          type: integer
                          example: 5
                          default: 0
                        spycloud_publish_date:
                          type: string
                          example: '2026-04-21T00:00:00Z'
                          format: date-time
                        breach_title:
                          type: string
                          example: Abrigo, Inc.
                        breach_category:
                          type: string
                          example: exfiltrated
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
      tags:
      - Breach
  /breach/data/domains/{domain}:
    servers:
    - url: https://api.spycloud.io/sp-v2
    get:
      summary: Get records by domain
      description: ''
      operationId: dp-get-records-by-domain
      parameters:
      - name: domain
        in: path
        description: Domain name to search for. You can also search for the sha1 hash of the domain
        schema:
          type: string
        required: true
      - name: type
        in: query
        description: This parameter lets you filter results by several types. The allowed values are 'corporate' for corporate records, and 'infected' for infected user records, email_domain to just match against email domains, and target_domain to just match against target domains or subdomains. If no value has been provided the API function will, by default, return all record types.
        schema:
          type: string
          enum:
          - corporate
          - infected
          - email_domain
          - target_domain
      - name: cursor
        in: query
        description: Token used for iterating through multiple pages of results.
        schema:
          type: string
      - name: since
        in: query
        description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field in either format for date YYYY-MM-DD or datetime YYYY-MM-DDThh:mm:ss[z]
        schema:
          type: string
          format: date
      - name: until
        in: query
        description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field in either format for date YYYY-MM-DD or datetime YYYY-MM-DDThh:mm:ss[z]
        schema:
          type: string
          format: date
      - name: since_modification_date
        in: query
        description: This parameter allows you to define the starting point for a date range query on the when an already published record was modified (record_modification_date).
        schema:
          type: string
          format: date
      - name: until_modification_date
        in: query
        description: This parameter allows you to define the starting point for a date range query on the when an already published record was modified (record_modification_date).
        schema:
          type: string
      - name: severity
        in: query
        description: One or more comma delimited numeric severity code to filter based on the severity.
        schema:
          type: string
      - name: source_id
        in: query
        description: One or more comma delimited numeric source id to filter.
        schema:
          type: string
      - name: salt
        in: query
        schema:
          type: string
          default: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used.
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
      tags:
      - Breach
  /breach/data/health-insurance-ids/{health_insurance_id}:
    servers:
    - url: https://api.spycloud.io/sp-v2
    get:
      summary: Get records by Health Insurance ID
      description: ''
      operationId: dp-get-records-by-health-insurance-id
      parameters:
      - name: health_insurance_id
        in: path
        description: Hashed input of the SHA-1 must be all upper case alphanumerics, 6 to 64 characters.  If using SHA-256/512, you must first take a SHA-1 hash of the plaintext health insurance ID. Plaintext queries are not supported.
        schema:
          type: string
        required: true
      - name: since
        in: query
        description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field.
        schema:
          type: string
          format: date
      - name: until
        in: query
        description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field.
        schema:
          type: string
          format: date
      - name: severity
        in: query
        description: One or more comma delimited numeric severity code to filter based on the severity.
        schema:
          type: string
      - name: source_id
        in: query
        description: One or more comma delimited numeric source id to filter.
        schema:
          type: string
      - name: salt
        in: query
        description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used
        schema:
          type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
      tags:
      - Breach
  /breach/data/bank-numbers/{bank_number}:
    servers:
    - url: https://api.spycloud.io/sp-v2
    get:
      summary: Get records by bank number
      description: ''
      operationId: dp-get-records-by-bank-number
      parameters:
      - name: bank_number
        in: path
        description: Bank Number to search for.  You can also search for the sha1, sha256, or sha512 hash of the Bank Number.
        schema:
          type: string
        required: true
      - name: cursor
        in: query
        description: Token used for iterating through multiple pages of results. By default our API methods return up to 1,000 items per page. If the number of requested items is greater than 1,000 a cursor token is provided in the return payload. If set, you can use this value to iterate to the next page of results.
        schema:
          type: string
      - name: since
        in: query
        description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field.
        schema:
          type: string
          format: date
      - name: until
        in: query
        description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field.
        schema:
          type: string
          format: date
      - name: severity
        in: query
        description: One or more comma delimited numeric severity code to filter based on the severity.
        schema:
          type: string
      - name: source_id
        in: query
        description: One or more comma delimited numeric source id to filter.
        schema:
          type: string
      - name: salt
        in: query
        description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used
        schema:
          type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
      tags:
      - Breach
  /breach/data/cc-numbers/{cc_number}:
    servers:
    - url: https://api.spycloud.io/sp-v2
    get:
      summary: Get records by credit card number
      description: ''
      operationId: dp-get-records-by-credit-card-number
      parameters:
      - name: cc_number
        in: path
        description: Hashed input of the SHA-1 must be created from 12 to 19 digits without spaces, dashes, or special characters.  If using SHA-256/512, you must first take a SHA-1 hash of the plaintext CC number.
        schema:
          type: string
          default: SHA1 Hash
        required: true
      - name: since
        in: query
        description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field.
        schema:
          type: string
          format: date
      - name: until
        in: query
        description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field.
        schema:
          type: string
          format: date
      - name: severity
        in: query
        description: One or more comma delimited numeric severity code to filter based on the severity.
        schema:
          type: string
      - name: source_id
        in: query
        description: One or more comma delimited numeric source id to filter.
        schema:
          type: string
      - name: salt
        in: query
        description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used.
        schema:
          type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
      tags:
      - Breach
  /breach/data/drivers-licenses/{drivers_license}:
    servers:
    - url: https://api.spycloud.io/sp-v2
    get:
      summary: Get records by drivers license
      description: ''
      operationId: dp-get-records-by-drivers-license
      parameters:
      - name: drivers_license
        in: path
        description: Drivers License Number to search for.  You can also search for the sha1, sha256, or sha512 hash of the Drivers License Number.
        schema:
          type: string
        required: true
      - name: cursor
        in: query
        description: Token used for iterating through multiple pages of results. By default our API methods return up to 1,000 items per page. If the number of requested items is greater than 1,000 a cursor token is provided in the return payload. If set, you can use this value to iterate to the next page of results.
        schema:
          type: string
      - name: s

# --- truncated at 32 KB (71 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/spycloud/refs/heads/main/openapi/spycloud-breach-api-openapi.yml