# SpyCloud

**Canonical:** https://apis.io/providers/spycloud/  
**Website:** https://spycloud.com/  
**APIs profiled:** 7

SpyCloud is an Austin, Texas based identity threat protection company that operates one of the largest repositories of recaptured darknet data — breach records, infostealer malware logs, phishing captures and combolists — and exposes it programmatically through a family of high-volume REST APIs. Security, fraud, identity and investigations teams query recaptured credentials, session cookies, exposed PII and infected-device telemetry to prevent account takeover, ransomware, session hijacking and online fraud. The public API surface spans nine separately-licensed products: Enterprise (Employee) ATO Prevention, Consumer ATO Prevention, Cybercrime Investigations, Data Partnership, IDLink identity correlation, Compromised Credit Card, Prospecting, NIST Password check, and Session Identity Protection. All are REST/JSON, authenticated with an x-api-key header, IP allow-listed, cursor-paginated at 1,000 records per page, and backed by a 99.9% uptime SLA.

## Kin Score — 54.0 / 100 (developing)

Scored 2026-08-12 under rubric 0.11.0. Trend: flat (+0.0 from 54.0).

| Facet | Score |
|---|---|
| Discoverability | 92.6 |
| Contract Quality | 58.2 |
| Governance | 11.5 |
| Operational Transparency | 42.1 |
| Developer Ergonomics | 56.0 |
| Commercial Clarity | 60.5 |

## Agent readiness — 50.7 (agent-ready)

| Dimension | Value |
|---|---|
| Spec Presence | yes |
| Agentic Access | derived |
| MCP Server | derived |
| Auth Clarity | yes |
| Idempotency | no |
| Error Semantics | documented |
| OpenAPI Examples | verified |
| Rate Limit Signal | documented |
| Event Surface Described | no |
| Agent Skills | derived |
| Well Known Catalog | yes |
| Consent Identity | yes |
| Agent Card | no |
| Dry Run Mode | no |

## APIs (7)

- **SpyCloud Breach API** — The Breach API from SpyCloud — 23 operation(s) for breach.
- **SpyCloud Check API** — The Check API from SpyCloud — 2 operation(s) for check.
- **SpyCloud Compass API** — The Compass API from SpyCloud — 5 operation(s) for compass.
- **SpyCloud Data API** — The Data API from SpyCloud — 2 operation(s) for data.
- **SpyCloud Query API** — The Query API from SpyCloud — 3 operation(s) for query.
- **SpyCloud Stats API** — The Stats API from SpyCloud — 2 operation(s) for stats.
- **SpyCloud Watchlist API** — The Watchlist API from SpyCloud — 5 operation(s) for watchlist.

## MCP servers (1)

- **spycloud-mcp.yml**

## Agentic access (1)

- **Spycloud Agentic Access** — 69 operations · 2 acting

## Security (4)

- **Spycloud Authentication** — apiKey · 2 schemes
- **Spycloud Domain Security** — TLSv1.3 · HSTS · DNSSEC · DMARC
- **Spycloud Vulnerability Disclosure** — security.txt · contact published
- **Spycloud Trust Center** — SOC 2, ISO 27001

## Tags

Cybersecurity, Threat Intelligence, Identity, Fraud Prevention, Account Takeover, Dark Web, Breach Data, Malware, Authentication, Security

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/spycloud/). Scores are computed from the provider's own public artifacts under a published rubric.