API Documentation

LeakData.io API

Check breach exposure, protect users, and receive security alerts through the LeakData API.

99.9%

Uptime

<200ms

Response Time

REST API

Secure Access

Introduction

The LeakData.io API lets you add breach checks and security monitoring to your own workflows through a REST interface.

Base URL: https://leakdata.io/api/v1

Capabilities

Search exposure signals across indexed breach data
Use one unified search endpoint for email, phone, username, and domain checks
Create API keys from the dashboard
Use enterprise API/webhook access for managed integrations
Send signed SIEM/SOAR payloads to Splunk, Elastic, Sentinel and CEF/Syslog middleware

Authentication

API requests use an API key. You can create and manage keys from the dashboard.

Request Headers

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

Security warning: Never expose API keys in client-side code or public repositories.

Rate Limits

API access is currently packaged for enterprise integrations. Self-serve plans do not include public API quota.

Plan	Per minute	Daily	Monthly
Free	—	—	Not included
Pro / Elite	—	—	Not included
Enterprise	Contract	Contract	Contract

Email search

Check whether an email address appears in breach data.

POST/search

Request Body

JSON

{
  "type": "email",
  "query": "user@example.com"
}

Response

JSON

{
  "success": true,
  "found": true,
  "query": "user@example.com",
  "type": "email",
  "breaches": 3,
  "data": []
}

Domain search

Check exposure signals related to a company domain.

POST/search

Request Body

JSON

{
  "type": "domain",
  "query": "example.com"
}

Response

JSON

{
  "success": true,
  "query": "example.com",
  "type": "domain",
  "found": true,
  "breaches": 23,
  "data": []
}

Breach details

Retrieve details for a specific breach record.

GET/breaches/:id

Response

{
  "success": true,
  "breach": {
    "id": "breach-123",
    "name": "Example Breach",
    "description": "Detailed description...",
    "date": "2023-05-15",
    "recordCount": 5000000,
    "dataClasses": ["Email", "Password", "Name"],
    "isVerified": true,
    "isSensitive": true
  }
}

Alerts

List and manage user alerts.

GET/alerts

Query Parameters

page - Page number (default: 1)
limit - Records per page (default: 20)
status - Status filter (read, unread, resolved)

Code examples

JavaScript (Node.js)

const axios = require('axios');

async function checkEmail(email) {
  try {
    const response = await axios.post(
      'https://leakdata.io/api/v1/search',
      { type: 'email', query: email },
      {
        headers: {
          'Authorization': 'Bearer YOUR_API_KEY',
          'Content-Type': 'application/json'
        }
      }
    );

    console.log(response.data);
  } catch (error) {
    console.error('Error:', error.response.data);
  }
}

checkEmail('user@example.com');

Python (requests)

import requests

response = requests.post(
    'https://leakdata.io/api/v1/search',
    json={'type': 'email', 'query': 'user@example.com'},
    headers={
        'Authorization': 'Bearer YOUR_API_KEY',
        'Content-Type': 'application/json',
    },
    timeout=30,
)

response.raise_for_status()
print(response.json())

PHP (cURL)

<?php
$payload = json_encode([
    'type' => 'email',
    'query' => 'user@example.com',
]);

$request = curl_init('https://leakdata.io/api/v1/search');
curl_setopt_array($request, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_API_KEY',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $payload,
]);

$response = curl_exec($request);
curl_close($request);

echo $response;

cURL

curl --request POST 'https://leakdata.io/api/v1/search' \
  --header 'Authorization: Bearer YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"type":"email","query":"user@example.com"}'

Error codes

Code	Description
`400`	Bad Request - Invalid request parameters
`401`	Unauthorized - Invalid or missing API key
`403`	Forbidden - Access denied
`429`	Too Many Requests - Rate limit exceeded
`500`	Internal Server Error - Server error

Webhooks

Receive automatic notifications when new breach signals are detected.

Configure the webhook URL and payload preset from the dashboard. LeakData sends signed POST deliveries and stores retryable failures for operational follow-up.

Delivery headers

X-Webhook-Signature

HMAC-SHA256 signature generated over the raw JSON body with the webhook secret.

X-LeakData-Signature

Compatible sha256= signature variant for SIEM/SOAR tooling.

X-LeakData-Event-Id

Stable event id for correlation and retry tracking.

X-LeakData-Payload-Preset

Selected payload format such as splunk_hec, elastic_ecs or microsoft_sentinel.

X-Webhook-Attempt

Delivery attempt number for retry-aware receivers.

Generic payload

{
  "id": "evt_9f3a7c2e6b1d4a80",
  "type": "domain.alert",
  "created": 1770000000000,
  "data": {
    "domain": "example.com",
    "severity": "high",
    "breachCount": 2
  }
}

SIEM/SOAR

Enterprise webhooks can be delivered in the format your security stack expects. The selected preset changes the transmitted JSON body and adds compatibility headers.

LeakData JSON

generic

Default signed JSON payload. All event fields stay in the LeakData schema.

Target: Custom webhook receivers, SOAR playbooks
Header: X-LeakData-Payload-Preset

Splunk HEC

splunk_hec

Sent with time, source, sourcetype, event and fields for Splunk HTTP Event Collector.

Target: Splunk HTTP Event Collector
Header: X-Splunk-Request-Channel

Elastic ECS

elastic_ecs

Uses ECS-like event, observer, threat, rule and leakdata fields for Elastic ingest.

Target: Elastic ECS ingest
Header: X-Elastic-Event-Dataset

Microsoft Sentinel

microsoft_sentinel

Uses TimeGenerated, EventId, EventType, Severity and RawData for Log Analytics custom tables.

Target: Microsoft Sentinel custom log
Header: Log-Type

CEF / Syslog

cef_syslog

Carries a CEF-compatible message inside JSON for syslog or SOAR middleware.

Target: CEF, Syslog or SOAR middleware
Header: X-CEF-Product

Splunk HEC

{
  "time": 1770000000,
  "source": "leakdata",
  "sourcetype": "leakdata:webhook",
  "event": {
    "id": "evt_splunk",
    "type": "webhook.test",
    "created": 1770000000000,
    "data": {
      "message": "LeakData webhook test bildirimi"
    }
  },
  "fields": {
    "leakdata_event_id": "evt_splunk",
    "leakdata_event_type": "webhook.test",
    "leakdata_preset": "splunk_hec"
  }
}

Microsoft Sentinel

{
  "TimeGenerated": "2026-02-02T02:40:00.000Z",
  "EventId": "evt_sentinel",
  "EventType": "webhook.test",
  "SourceSystem": "LeakData",
  "Severity": 3,
  "RawData": {
    "id": "evt_sentinel",
    "type": "webhook.test",
    "created": 1770000000000,
    "data": {
      "message": "LeakData webhook test bildirimi"
    }
  }
}

Webhook events

Choose one or more event types when creating a webhook. Test deliveries use webhook.test and real deliveries use the selected event names below.

breach.detectedBreach match detectedA monitored identifier appears in breach data.

breach.newNew breach recordA new breach is added to the LeakData dataset.

domain.alertDomain alertA monitored company domain produces a risk signal.

search.foundSearch result foundAn API search or monitoring workflow returns a match.

monitoring.alertMonitoring alertEmail, domain or account monitoring produces an alert.

account.suspiciousSuspicious account eventAn unusual account security event is detected.

api.limit.warningAPI limit warningEnterprise API usage approaches an important threshold.