API Documentation

Build secure integrations with LeakData

Check breach exposure, protect users, and receive security alerts through the LeakData API.

Starting points

What do you want to do?

Choose a goal and jump directly to the relevant endpoint, security guidance, and implementation example.

QuickstartYour first request in 3 steps

The shortest implementation path from authentication to a valid request.

1
Authenticate
Send your API key as a Bearer header with every request.
Authorization: Bearer YOUR_API_KEY
2
Send an example request
Send an authenticated POST request to exposure search.
3
Handle the response
Bring the returned exposure signals and sources into your application workflow.

Endpoint index

API reference

Review the published v1 endpoints at a glance and open the detailed section.

OpenAPI specification

Introduction

The LeakData.io API lets you add breach checks and security monitoring to your own workflows through a REST interface.

Base URL: https://leakdata.io/api/v1

Capabilities

Search exposure signals across indexed breach data
Use one unified search endpoint for email, phone, username, and domain checks
Create API keys from the dashboard
Use enterprise API/webhook access for managed integrations
Send signed SIEM/SOAR payloads to Splunk, Elastic, Sentinel and CEF/Syslog middleware

Authentication

API requests use an API key. You can create and manage keys from the dashboard.

Request Headers

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

Security warning: Never expose API keys in client-side code or public repositories.

Rate Limits

API access is currently packaged for enterprise integrations. Self-serve plans do not include public API quota.

Plan	Per minute	Daily	Monthly
Free	—	—	Not included
Pro / Elite	—	—	Not included
Enterprise	Contract	Contract	Contract

Exposure search

Search indexed exposure signals through one authenticated endpoint.

POST/search

Supported search types: email, phone, username, and domain.

Request Body

JSON

{
  "type": "email",
  "query": "user@example.com"
}

Response

JSON

{
  "success": true,
  "found": true,
  "query": "user@example.com",
  "type": "email",
  "breaches": 3,
  "data": []
}

Monitored domains

List the domain monitoring records available to the authenticated API key owner.

GET/domains

Response

JSON

{
  "success": true,
  "count": 1,
  "domains": [{
    "id": "domain_123",
    "domain": "example.com",
    "verified": true,
    "status": "active",
    "vulnerabilities": 0,
    "alerts": 0
  }],
  "timestamp": "2026-08-08T00:00:00.000Z"
}

Password safety with k-anonymity

Check a password hash prefix without sending the password or its full hash.

Send only the first five characters of the uppercase SHA-1 hash. LeakData never receives the original password or full hash.

GET/password/check/5BAA6

Response

{
  "hashes": {
    "1E4C9B93F3F0682250B6CF8331B7EE68FD8": 12345,
    "ABCDEF0123456789ABCDEF0123456789ABC": 6789
  }
}

Alerts

List the authenticated user's security alerts.

GET/alerts

Query Parameters

limit - Maximum records returned (default: 10, maximum: 100)
status - Status filter (read, unread, all)
severity - Severity filter (low, medium, high, critical)

Code examples

JavaScript (Node.js)

const axios = require('axios');

async function checkEmail(email) {
  try {
    const response = await axios.post(
      'https://leakdata.io/api/v1/search',
      { type: 'email', query: email },
      {
        headers: {
          'Authorization': 'Bearer YOUR_API_KEY',
          'Content-Type': 'application/json'
        }
      }
    );

    console.log(response.data);
  } catch (error) {
    console.error('Error:', error.response.data);
  }
}

checkEmail('user@example.com');

Python (requests)

import requests

response = requests.post(
    'https://leakdata.io/api/v1/search',
    json={'type': 'email', 'query': 'user@example.com'},
    headers={
        'Authorization': 'Bearer YOUR_API_KEY',
        'Content-Type': 'application/json',
    },
    timeout=30,
)

response.raise_for_status()
print(response.json())

PHP (cURL)

<?php
$payload = json_encode([
    'type' => 'email',
    'query' => 'user@example.com',
]);

$request = curl_init('https://leakdata.io/api/v1/search');
curl_setopt_array($request, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer YOUR_API_KEY',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $payload,
]);

$response = curl_exec($request);
curl_close($request);

echo $response;

cURL

curl --request POST 'https://leakdata.io/api/v1/search' \
  --header 'Authorization: Bearer YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"type":"email","query":"user@example.com"}'

Error codes

Code	Description
`400`	Bad Request - Invalid request parameters
`401`	Unauthorized - Invalid or missing API key
`403`	Forbidden - Access denied
`429`	Too Many Requests - Rate limit exceeded
`500`	Internal Server Error - Server error

Webhooks

Receive automatic notifications when new breach signals are detected.

Configure the webhook URL and payload preset from the dashboard. LeakData sends signed POST deliveries and stores retryable failures for operational follow-up.

Delivery headers

X-Webhook-Signature: HMAC-SHA256 signature generated over the raw JSON body with the webhook secret.
X-LeakData-Signature: Compatible sha256= signature variant for SIEM/SOAR tooling.
X-LeakData-Event-Id: Stable event id for correlation and retry tracking.
X-LeakData-Payload-Preset: Selected payload format such as splunk_hec, elastic_ecs or microsoft_sentinel.
X-Webhook-Attempt: Delivery attempt number for retry-aware receivers.

Generic payload

{
  "id": "evt_9f3a7c2e6b1d4a80",
  "type": "domain.alert",
  "created": 1770000000000,
  "data": {
    "domain": "example.com",
    "severity": "high",
    "breachCount": 2
  }
}

SIEM/SOAR

Enterprise webhooks can be delivered in the format your security stack expects. The selected preset changes the transmitted JSON body and adds compatibility headers.

LeakData JSON

generic

Default signed JSON payload. All event fields stay in the LeakData schema.

Target: Custom webhook receivers, SOAR playbooks
Header: X-LeakData-Payload-Preset

Splunk HEC

splunk_hec

Sent with time, source, sourcetype, event and fields for Splunk HTTP Event Collector.

Target: Splunk HTTP Event Collector
Header: X-Splunk-Request-Channel

Elastic ECS

elastic_ecs

Uses ECS-like event, observer, threat, rule and leakdata fields for Elastic ingest.

Target: Elastic ECS ingest
Header: X-Elastic-Event-Dataset

Microsoft Sentinel

microsoft_sentinel

Uses TimeGenerated, EventId, EventType, Severity and RawData for Log Analytics custom tables.

Target: Microsoft Sentinel custom log
Header: Log-Type

CEF / Syslog

cef_syslog

Carries a CEF-compatible message inside JSON for syslog or SOAR middleware.

Target: CEF, Syslog or SOAR middleware
Header: X-CEF-Product

Splunk HEC

{
  "time": 1770000000,
  "source": "leakdata",
  "sourcetype": "leakdata:webhook",
  "event": {
    "id": "evt_splunk",
    "type": "webhook.test",
    "created": 1770000000000,
    "data": {
      "message": "LeakData webhook test notification"
    }
  },
  "fields": {
    "leakdata_event_id": "evt_splunk",
    "leakdata_event_type": "webhook.test",
    "leakdata_preset": "splunk_hec"
  }
}

Microsoft Sentinel

{
  "TimeGenerated": "2026-02-02T02:40:00.000Z",
  "EventId": "evt_sentinel",
  "EventType": "webhook.test",
  "SourceSystem": "LeakData",
  "Severity": 3,
  "RawData": {
    "id": "evt_sentinel",
    "type": "webhook.test",
    "created": 1770000000000,
    "data": {
      "message": "LeakData webhook test notification"
    }
  }
}

Webhook events

Choose one or more event types when creating a webhook. Test deliveries use webhook.test and real deliveries use the selected event names below.

breach.detectedBreach match detectedA monitored identifier appears in breach data.

breach.newNew breach recordA new breach is added to the LeakData dataset.

domain.alertDomain alertA monitored company domain produces a risk signal.

search.foundSearch result foundAn API search or monitoring workflow returns a match.

monitoring.alertMonitoring alertEmail, domain or account monitoring produces an alert.

account.suspiciousSuspicious account eventAn unusual account security event is detected.

api.limit.warningAPI limit warningEnterprise API usage approaches an important threshold.

Quickstart

Your first request in 3 steps

The shortest implementation path from authentication to a valid request.

1
Authenticate
Send your API key as a Bearer header with every request.
Authorization: Bearer YOUR_API_KEY

Send an example request

Send an authenticated POST request to exposure search.

cURL

curl --request POST 'https://leakdata.io/api/v1/search' \
  --header 'Authorization: Bearer YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"type":"email","query":"user@example.com"}'

3
Handle the response
Bring the returned exposure signals and sources into your application workflow.

Need help?

Contact

This site uses cookies

What do you want to do?

Authenticate

Send an example request

Handle the response

API reference

Introduction

Capabilities

Authentication

Rate Limits

Exposure search

Request Body

Response

Monitored domains

Response

Password safety with k-anonymity

Response

Alerts

Query Parameters

Code examples

Error codes

Webhooks

Delivery headers

Generic payload

SIEM/SOAR

LeakData JSON

Splunk HEC

Elastic ECS

Microsoft Sentinel

CEF / Syslog

Splunk HEC

Microsoft Sentinel

Webhook events