InfoBreach
Sign in Create account

API reference

Programmatic access to the InfoBreach data corpus.

These pages are rendered from our OpenAPI file and cover the endpoints described in it.

Where requests go.

One base URL. Every path on the pages that follow is relative to it, and there is no version segment to keep track of.

https://infobreach.net/api

How a call is authenticated.

Send your key on every request. Either header is accepted, so pick the one that suits your client. Keys are issued and rotated from your account, on Premium and on team plans. On any other plan a key-authenticated call answers 403 with code plan_upgrade_required.

  • Authorization Bearer ib_…
  • X-API-Key ib_…

Every key starts with ib_.

One envelope, every endpoint.

A successful call answers with the envelope below. The payload named on each endpoint's page is what sits in data.

  • success boolean required

  • data any

    Endpoint-specific payload (see schema).

A failure keeps the envelope and drops the payload. The message is written for a human to read; the code is the part to branch on in your own code.

  • success boolean required

  • error string required

  • code string

    Machine-readable error tag. Omitted whenever it is empty, which is most generic errors, so branch on status too.

    One of quota_exceeded, hourly_limit, file_access_limit, plan_upgrade_required, upgrade_required, feature_not_enabled, email_verification_required, monitor_limit, monitor_surface_not_allowed, monitor_first_seen_not_allowed, monitor_webhook_invalid, monitor_webhook_not_allowed, monitor_webhook_key_required

The codes named here.

These are the values of code this file names. Generic failures omit the field, and a response can carry a code that is not listed here, so treat an unrecognised value the same way you treat a missing one.

  • quota_exceeded
  • hourly_limit
  • file_access_limit
  • plan_upgrade_required
  • upgrade_required
  • feature_not_enabled
  • email_verification_required
  • monitor_limit
  • monitor_surface_not_allowed
  • monitor_first_seen_not_allowed
  • monitor_webhook_invalid
  • monitor_webhook_not_allowed
  • monitor_webhook_key_required

The endpoints.

  • Search

    Query the breach corpus by email, username, password, hash, IP, phone, domain, or name. Wildcards on Pro and up, bulk on paid plans.

  • Stealer

    Search device records for credentials, cookies, and saved logins captured from compromised machines. Every plan can inspect the file-archive browser; below Premium its structure and counts are real and its values are masked. Row masking is per record, so a row the caller has unlocked reads in full on a plan that masks by default.

  • Unlocks

    Spend one unlock to reveal a single censored record in full. Free tier only; the paid tiers have nothing to reveal.

  • People

    Public-records aggregation - names, addresses, phones, relatives, emails. Uncensored on every plan, because the records are published filings.

  • Monitors

    Continuous watchers on assets you own. Email/webhook fan-out when new hits surface.

  • Account

    Read your plan limits, live usage counters, and your own exposure.

The file itself.

The document these pages are built from, unchanged. Point an agent at it, or read it directly.

/openapi.yaml