# has-have-i-been-pwned-domain-verification

> has-have-i-been-pwned-domain-verification is a paid API for AI agents from dns.intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-20).

Checks whether a domain's apex TXT records contain a Have I Been Pwned (HIBP) domain ownership verification token via Cloudflare DoH.

## Facts

- Endpoint: GET https://dns.intel.rallylive.ca/dns/verification/have-i-been-pwned?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/has-have-i-been-pwned-domain-verification-bfb4cf20
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_y3_h0mXgOhW5-1xkI6i_2

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability has-have-i-been-pwned-domain-verification-bfb4cf20
```

Example prompt: Can you check whether example.com has a Have I Been Pwned domain verification TXT record — I want to know if they're using HIBP's enterprise monitoring product?

## When to prefer this

Use this endpoint when you need to determine whether a specific domain is enrolled in Have I Been Pwned's domain monitoring or enterprise product, using DNS TXT record inspection. Prefer this over manual DNS lookups or general-purpose DNS tools when you want a purpose-built, structured boolean answer about HIBP verification status at scale or as part of an automated security assessment pipeline.

## Known failure modes

- Domain does not exist or has no TXT records — returns absence result
- Cloudflare DoH lookup failure or timeout
- Malformed domain input causing lookup error
- HIBP token present but truncated beyond recognition
- Rate limiting or payment failure for the $0.01 per lookup fee

## How this service works

Does the domain carry a have i been pwned domain-verification TXT record? Reads the apex TXT records (Cloudflare DoH) and reports whether the have-i-been-pwned ownership token is present and the token value (truncated). A present token usually means the company uses have-i-been-pwned's product; absence means not verified there. $0.01 per lookup.

## Output

Returns whether the HIBP domain ownership verification TXT record is present at the domain's apex, along with the truncated token value if found. Absence indicates the domain is not verified with HIBP's platform.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/has-have-i-been-pwned-domain-verification-bfb4cf20/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.intel.rallylive.ca](https://www.zero.xyz/host/dns.intel.rallylive.ca/llms.txt)