# CyberPulse Domain Breach & Credential Exposure Check

> CyberPulse Domain Breach & Credential Exposure Check is a paid API for AI agents from cyberpulse-six.vercel.app, paid per call via x402, $0.15/call, status unknown (last checked 2026-09-15).

Returns known data breaches, credential dumps, dark-web signals, and regulatory notification duties for a given domain

## Facts

- Endpoint: GET https://cyberpulse-six.vercel.app/api/cyber/breach-check
- Price: $0.15/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cyberpulse-domain-breach-credential-exposure-check-31af5efc
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_I7URVhB7uGNGlgKUGo4oB

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cyberpulse-domain-breach-credential-exposure-check-31af5efc
```

Example prompt: Can you check the breach history and credential exposure for acme.com — I need to know about any known credential dumps, dark-web signals, and whether we have any GDPR or CCPA notification obligations?

## When to prefer this

Use this endpoint when you need historical breach intelligence and credential-exposure data tied to a specific domain, especially when regulatory compliance obligations (GDPR, CCPA, PDPA, LGPD, POPIA) need to be surfaced alongside the breach data. Prefer this over generic OSINT or attack-surface endpoints when the primary concern is credential leaks, dark-web dumps, and breach notification duties rather than live infrastructure vulnerabilities.

## Known failure modes

- Domain not found or no breach history returns empty results
- Invalid domain format returns a 400-level error
- Unauthorized or missing payment triggers 402 Payment Required
- Rate limiting may return 429 if calls exceed quota
- Service unavailable during maintenance returns 503

## How this service works

Data-breach lookup and credential-exposure check for any domain. Surfaces known data breaches, credential dumps, dark-web signals, and regulatory notification duties (GDPR, CCPA, PDPA, LGPD, POPIA), for security and compliance agents. Authorized security use only.

## Output

A structured report containing known data breaches associated with the queried domain, references to credential dumps and dark-web signals, and a breakdown of regulatory notification duties triggered under frameworks including GDPR, CCPA, PDPA, LGPD, and POPIA.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "lang": {
       "type": "string",
       "description": "en | es | fr | de | ja | zh | ko | pt | ar | hi (default: en)"
      },
      "domain": {
       "type": "string",
       "description": "Domain to check — e.g. \"example.com\" | \"company.org\" — checks breach history for this domain"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "errors": {
     "type": "object",
     "description": "Documented error responses, keyed by HTTP status code",
     "additionalProperties": {
      "type": "object",
      "required": [
       "description"
      ],
      "properties": {
       "example": {
        "type": "object"
       },
       "description": {
        "type": "string"
       }
      }
     }
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "domain": "example.com",
  "breach_summary": {
   "known_breaches_count": 2,
   "overall_exposure_level": "HIGH",
   "estimated_records_exposed": 85000
  },
  "known_breaches": [
   {
    "date": "2022-09-15",
    "verified": true,
    "breach_name": "Example Corp 2022",
    "breach_cause": "SQL injection",
    "data_types_exposed": [
     "email",
     "password_hash",
     "phone"
    ],
    "records_compromised": 85000
   }
  ],
  "credential_exposure": {
   "hash_types": [
    "MD5 (crackable)"
   ],
   "password_hashes_found": true,
   "credential_stuffing_risk": "HIGH",
   "plaintext_passwords_found": false
  },
  "regulatory_implications": "GDPR: 72-hour notification to supervisory authority required if EU residents affected. CCPA: notification to California residents if 500+ affected."
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cyberpulse-domain-breach-credential-exposure-check-31af5efc/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from cyberpulse-six.vercel.app](https://www.zero.xyz/host/cyberpulse-six.vercel.app/llms.txt)