# Have I Been Pwned Domain Breach Lookup

> Have I Been Pwned Domain Breach Lookup is a paid API for AI agents from api.agentstools.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Returns known public data breaches that affected a given domain, with normalized metadata from the Have I Been Pwned catalogue including breach names, dates, account counts, and data classes exposed.

## Facts

- Endpoint: GET https://api.agentstools.dev/breach/domain
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/have-i-been-pwned-domain-breach-lookup-ddbd82e8
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_dwmJYPwaiG-V-uLJyrCMs

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability have-i-been-pwned-domain-breach-lookup-ddbd82e8
```

Example prompt: Can you check the Have I Been Pwned breach catalogue for adobe.com and tell me which known public breaches affected that domain, what types of data were exposed, and how many accounts were involved in each?

## When to prefer this

Use this endpoint when you need to know which public, catalogued data breaches have historically exposed accounts associated with a specific domain — ideal for security assessments, vendor due diligence, corporate risk profiling, or educating users about their organization's breach history. Prefer this over individual email lookups when the goal is domain-level exposure analysis rather than checking a specific person's account compromise status.

## Known failure modes

- Domain not found in HIBP catalogue returns an empty breach list (not an error)
- Malformed domain input may return a 400 bad request
- Network timeout if HIBP upstream is slow
- Payment not processed (402) if x402 payment header is missing or invalid
- Rate limiting if called in rapid succession without valid payment

## How this service works

List the known public data breaches that affected a domain, from the Have I Been Pwned breach catalogue. Returns normalized breach metadata (name, date, account count, data classes, stealer-log and verified flags) plus a summary. This is which known breaches touched the domain, not whether a specific account is compromised. Breach indicators, not a guarantee.

## Output

A list of normalized breach records from the HIBP catalogue that touched the queried domain, each including breach name, date, number of affected accounts, data classes exposed (e.g. passwords, email addresses, phone numbers), whether it was verified, and whether it was a stealer-log breach — plus an overall summary of breach exposure for the domain.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "url": {
       "type": "string",
       "description": "Alternative input: a URL (its host is used)"
      },
      "host": {
       "type": "string",
       "description": "Alternative input: a bare hostname"
      },
      "domain": {
       "type": "string",
       "description": "Domain to look up (e.g. example.com)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/have-i-been-pwned-domain-breach-lookup-ddbd82e8/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agentstools.dev](https://www.zero.xyz/host/api.agentstools.dev/llms.txt)