UpGuard Breaches API
The breaches API from UpGuard — 5 operation(s) for breaches.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/upguard:upguard-breaches-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
description: 'Access information from the CyberRisk platform programmatically using this API.
You can find or generate an API key to access this API in your CyberRisk Account Settings.
Please authorize all requests by setting the "Authorization" header to your api key.
The base url for all public endpoints is https://cyber-risk.upguard.com/api/public'
title: UpGuard CyberRisk Breaches API
version: 1.13.2
servers:
- url: https://cyber-risk.upguard.com/api/public
security:
- API key in header: []
tags:
- name: Breaches
paths:
/breach:
get:
description: 'Returns the details of an identity breach.
Required API key permissions: `IdentityBreaches` (select when creating API key in Account Settings)'
tags:
- Breaches
summary: Get the details for an identity breach
operationId: identity_breach
parameters:
- description: The ID of the breach to fetch
name: id
in: query
schema:
type: string
responses:
'200':
description: Details of an identity breach
content:
application/json:
schema:
$ref: '#/components/schemas/IdentityBreachResponsePayloadBody'
'404':
description: The vendor was not found.
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
'422':
description: An invalid parameter was supplied or a mandatory parameter was missing
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
'429':
description: Too many requests have been made to this endpoint.
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
'500':
description: An internal system error occurred
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
/breaches:
get:
description: 'Returns a list of identities ordered by last breached date.
Required API key permissions: `IdentityBreaches` (select when creating API key in Account Settings)'
tags:
- Breaches
summary: Get a list of breached identities
operationId: breached_identities
parameters:
- description: The `page_token` from a previous request, use this to get the next page of results.
name: page_token
in: query
schema:
type: string
- description: The number of results to return per page.
name: page_size
in: query
schema:
type: integer
format: int64
default: 1000
maximum: 2000
minimum: 10
- description: 'The value to sort the breached identities by
If not specified will default to `date_last_breach` and set `sort_desc` to `true`'
name: sort_by
in: query
schema:
type: string
enum:
- name
- domain
- num_breaches
- date_last_breach
default: date_last_breach
- description: Whether or not to sort the results in descending order
name: sort_desc
in: query
schema:
type: boolean
default: false
- description: The breach ID to filter on
name: breach_id
in: query
schema:
type: string
responses:
'200':
description: A list of breached identities
content:
application/json:
schema:
$ref: '#/components/schemas/BreachedIdentitiesResponsePayloadBody'
'422':
description: An invalid parameter was supplied or a mandatory parameter was missing
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
'429':
description: Too many requests have been made to this endpoint.
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
'500':
description: An internal system error occurred
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
/vips:
get:
description: 'Returns a list of VIPs for your account.
Required API key permissions: `IdentityBreaches` (select when creating API key in Account Settings)'
tags:
- Breaches
summary: Get a list of VIPs
operationId: vip_list
parameters:
- description: The `page_token` from a previous request, use this to get the next page of results.
name: page_token
in: query
schema:
type: string
- description: The number of results to return per page.
name: page_size
in: query
schema:
type: integer
format: int64
default: 1000
maximum: 2000
minimum: 10
- example: sort_by=num_breaches:desc&sort_by=date_last_breach:asc
description: 'List of fields to sort VIPs by, with optional :asc or :desc suffix per field.
Allowed fields: name, domain, num_breaches, date_last_breach.'
name: sort_by
in: query
schema:
type: string
default: name
responses:
'200':
description: A list of VIPs currently monitored for your account
content:
application/json:
schema:
$ref: '#/components/schemas/GetVIPListRespBody'
'422':
description: An invalid parameter was supplied or a mandatory parameter was missing
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
'429':
description: Too many requests have been made to this endpoint.
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
'500':
description: An internal system error occurred
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
/vips/add:
post:
description: 'Add a VIP to your account.
Required API key permissions: `IdentityBreaches` (select when creating API key in Account Settings)'
tags:
- Breaches
summary: Add a VIP
operationId: add_vip
parameters:
- description: The email of the VIP to add. Must be an authorized company domain for your account.
name: email
in: query
required: true
schema:
type: string
responses:
'200':
description: The VIP that was added
content:
application/json:
schema:
$ref: '#/components/schemas/AddVIPRespBody'
'422':
description: An invalid parameter was supplied or a mandatory parameter was missing
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
'429':
description: Too many requests have been made to this endpoint.
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
'500':
description: An internal system error occurred
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
/vips/delete:
post:
description: 'Remove a VIP from your account.
Required API key permissions: `IdentityBreaches` (select when creating API key in Account Settings)'
tags:
- Breaches
summary: Remove a VIP
operationId: remove_vip
parameters:
- description: The email of the VIP to remove.
name: email
in: query
required: true
schema:
type: string
responses:
'204':
description: ' Successful response is empty'
'422':
description: An invalid parameter was supplied or a mandatory parameter was missing
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
'429':
description: Too many requests have been made to this endpoint.
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
'500':
description: An internal system error occurred
content:
application/json:
schema:
$ref: '#/components/schemas/endpointError'
components:
schemas:
VIP:
type: object
properties:
breach_ids:
description: The IDs of the breaches the VIP appears in
type: array
items:
type: integer
format: int64
date_last_breach:
description: The date of the latest breach the VIP appears in (RFC 3339 format).
type: string
domain:
description: The domain of the VIP
type: string
id:
description: The ID of the VIP
type: integer
format: int64
name:
description: The account name of the VIP
type: string
num_breaches:
description: The number of breaches the VIP appears in
type: integer
format: int64
severity:
description: The highest severity of the breaches the VIP appears in. Will be one of "Critical", "High", "Medium", or "Low".
type: string
AddVIPRespBody:
type: object
properties:
vip:
$ref: '#/components/schemas/VIP'
BreachedIdentitiesResponsePayloadBody:
type: object
properties:
breached_identities:
description: The list of breached identities
type: array
items:
$ref: '#/components/schemas/BreachedIdentity'
breaches:
description: The list of breaches
type: array
items:
$ref: '#/components/schemas/Breach'
next_page_token:
description: 'The token to be used to retrieve the next page of results.
Will not be returned if there are no more results.'
type: string
total_results:
description: The total number of breached identities found.
type: integer
format: int64
IdentityBreachResponsePayloadBody:
type: object
properties:
breach:
$ref: '#/components/schemas/Breach'
comments:
description: Comments associated with the identity breach
type: array
items:
$ref: '#/components/schemas/BreachComment'
BreachComment:
type: object
properties:
comment:
description: The text of the comment
type: string
example: My comment text
created_at:
description: The time the comment was added
type: string
format: date-time
example: '2019-11-09T03:48:57Z'
created_by_email:
description: The email address of the user who added the comment
type: string
example: viggo@example.com
BreachedIdentity:
type: object
properties:
breach_ids:
description: The IDs of the breaches the identity is associated with
type: array
items:
type: integer
format: int64
example:
- 42
- 89
domain:
description: The breached identity domain
type: string
example: example.com
id:
description: The internal id of the identity
type: integer
format: int64
example: 101
ignored:
description: Flag indicating if the identity has been ignored
type: boolean
example: false
last_breach_date:
description: The date of the most recent breach (RFC 3339 format)
type: string
format: date-time
example: '2019-11-09T03:48:57Z'
name:
description: The breached identity name
type: string
example: jane.smith
num_breaches:
description: The total number of breaches the identity has been in
type: integer
format: int64
example: 42
severity:
description: The highest severity of the breaches the identity appears in. Will be one of "Critical", "High", "Medium", or "Low".
type: string
example: High
vip:
description: Flag indicating if the identity is a VIP
type: boolean
example: false
GetVIPListRespBody:
type: object
properties:
next_page_token:
description: 'The token to be used to retrieve the next page of results.
Will not be returned if there are no more results.'
type: string
total_results:
description: The total number of VIPs found.
type: integer
format: int64
vips:
description: The list of VIPs
type: array
items:
$ref: '#/components/schemas/VIP'
Breach:
type: object
properties:
assignee_user_email:
description: The email address of the currently assigned user. Will be blank if unassigned.
type: string
example: viggo@example.com
breach_status:
description: The status of the breach. Will be one of "active" or "archived".
type: string
example: active
breach_type:
description: The type of the breach. Will be one of "Company", "Infostealer", or "Paste".
type: string
example: Company
date_notified:
description: The date the identities were notified of the breach (ISO 3339 format). Will be null if not notified.
type: string
example: '2019-11-09T03:48:57Z'
date_occurred:
description: The date the breach occurred (ISO 3339 format)
type: string
format: date-time
example: '2019-11-09T03:48:57Z'
date_published:
description: The date the breach was published (ISO 3339 format)
type: string
format: date-time
example: '2019-11-09T03:48:57Z'
description:
description: The description of the breach
type: string
example: In November 2019, all customer records of Acme Inc. were made publicly available for 13 hours.
domain:
description: The domain of the breach
type: string
example: acme.com
employee_count:
description: The number of employees involved in the breach.
type: integer
format: int64
example: 10
exposed_data_classes:
description: The classes of data exposed in this breach eg. "Passwords", "Usernames", "Email addresses", "Social security numbers", "Banking PINs", "Credit cards".
type: array
items:
type: string
example:
- Passwords
- Usernames
- Email addresses
- Social security numbers
- Banking PINs
- Credit cards
id:
description: The internal id of the breach
type: integer
format: int64
example: 101
name:
description: The name of the breach
type: string
example: AcmeInc
severity:
description: The severity of the breach. Will be one of "Critical", "High", "Medium", or "Low".
type: string
example: High
title:
description: The title of the breach
type: string
example: Acme Inc.
total_exposures:
description: The total number of identities in the breach
type: integer
format: int64
example: 9673824
endpointError:
description: Error details coming from an endpoint
type: object
properties:
error:
description: A description of the error
type: string
securitySchemes:
API_key_in_header:
type: apiKey
in: header
name: Authorization