Monitors

Continuous watchers on assets you own. Email/webhook fan-out when new hits surface.

GET /monitors

Send your key with this call.

POST /monitors

Send your key with this call.

JSON body, required.

asset string required

The thing to watch - email, username, domain, or IP.
asset_type string required

One of email, username, domain, ip
surface string default "all"

Which surfaces the monitor watches. all covers the breach index and the stealer logs. stealer watches stealer logs only and is an admin-granted mode.

One of all, stealer
notify_email boolean default false
notify_webhook string, uri

URL for webhook delivery. Both https:// and http:// are accepted. Webhook delivery itself is Premium and Team only.
notify_webhook_secret string

Shared secret for the webhook. Carries the integration key when the webhook is a PagerDuty endpoint, in which case it is required.
stealer_first_seen_only boolean default false

Admin-granted feature. Only notify for stealer credentials this monitor has not recorded before.

200 Monitor created.
- success boolean required
- data object
  - id string
  - user_id string
  - asset string
  - asset_type string
    
    One of email, username, domain, ip
  - status string
    
    One of active, paused
  - surface string
    
    One of all, stealer
  - notify_email boolean
  - notify_webhook string
  - notify_webhook_secret string
  - stealer_first_seen_only boolean
  - last_checked string, date-time
  - last_hit_count integer
  - last_source_preview array of string
  - last_stealer_count integer
  - last_stealer_preview array of string
  - hits_total integer
  - last_hit_at string, date-time
  - last_notified_at string, date-time
  - created_at string, date-time
  - updated_at string, date-time
400 The request was malformed or invalid.
- success boolean required
- error string required
- code string
  
  Machine-readable error tag. Omitted whenever it is empty, which is most generic errors, so branch on status too.
  
  One of quota_exceeded, hourly_limit, file_access_limit, plan_upgrade_required, upgrade_required, feature_not_enabled, email_verification_required, monitor_limit, monitor_surface_not_allowed, monitor_first_seen_not_allowed, monitor_webhook_invalid, monitor_webhook_not_allowed, monitor_webhook_key_required
403 A monitor setting your plan or account doesn't allow.

The same shape as 400.

GET /monitors/{id}

Send your key with this call.

PATCH /monitors/{id}

Send your key with this call.

JSON body, required.

status string

One of active, paused
notify_email boolean
notify_webhook string

Pass empty string to clear.
notify_webhook_secret string

Shared secret for the webhook, or the PagerDuty integration key. Pass empty string to clear.
stealer_first_seen_only boolean

Only notify for stealer credentials this monitor has not recorded before.

200 Updated monitor.
- success boolean required
- data object
  - id string
  - user_id string
  - asset string
  - asset_type string
    
    One of email, username, domain, ip
  - status string
    
    One of active, paused
  - surface string
    
    One of all, stealer
  - notify_email boolean
  - notify_webhook string
  - notify_webhook_secret string
  - stealer_first_seen_only boolean
  - last_checked string, date-time
  - last_hit_count integer
  - last_source_preview array of string
  - last_stealer_count integer
  - last_stealer_preview array of string
  - hits_total integer
  - last_hit_at string, date-time
  - last_notified_at string, date-time
  - created_at string, date-time
  - updated_at string, date-time
400 The request was malformed or invalid.
- success boolean required
- error string required
- code string
  
  Machine-readable error tag. Omitted whenever it is empty, which is most generic errors, so branch on status too.
  
  One of quota_exceeded, hourly_limit, file_access_limit, plan_upgrade_required, upgrade_required, feature_not_enabled, email_verification_required, monitor_limit, monitor_surface_not_allowed, monitor_first_seen_not_allowed, monitor_webhook_invalid, monitor_webhook_not_allowed, monitor_webhook_key_required
403 A monitor setting your plan or account doesn't allow.

The same shape as 400.
404 Resource doesn't exist or isn't owned by the authenticated user.

The same shape as 400.

DELETE /monitors/{id}

Send your key with this call.