XposedOrNot/XposedOrNot-API

🎉 Your free API for real-time data breach monitoring and analytics.
XposedOrNot API Playground ·
XposedOrNot.com
## What is XposedOrNot API?
Data breaches happen constantly, and most people only find out long after their email and passwords are already circulating. I built XposedOrNot so you don't have to wonder. Check an email or domain and know right away whether it's turned up in a known breach.
This repo is the API that powers it all: the breach lookups, the analytics, and the alerts. It's free to use, and it's open-source, so you can read exactly how every check works rather than taking my word for it.
Give it a try below, and if you find it useful, I'd love for you to build something with it.
Devanand Premkumar, creator of XposedOrNot
## Quick Example
Check if an email has been exposed in data breaches:
bash
curl https://api.xposedornot.com/v1/check-email/test@example.com
Response:
json
"breaches": [["Adobe", "LinkedIn"]],
"email": "test@example.com",
"status": "success"
Get detailed breach analytics:
bash
curl "https://api.xposedornot.com/v1/breach-analytics?email=test@example.com"
## Rate Limits & API Access
No API key required for basic endpoints (/v1/check-email, /v1/breach-analytics, /v1/breaches)
API key required for domain breach monitoring — see Domain endpoints & API keys for how to get and use one
Rate limits are applied per IP, per endpoint:
| Endpoint | Per second | Per hour | Per day |
| GET /v1/check-email/{email} | 2 | 25 | 100 |
| GET /v1/breach-analytics | 2 | 25 | 100 |
| GET /v1/breaches | 2 | 50 | 100 |
| POST /v1/domain-breaches/ | 2 | 25 | 50 |
When a limit is exceeded the API returns 429 Too Many Requests with a Retry-After
header (seconds) and a JSON body carrying retry_after and reset_time, so clients
can back off precisely.
### Commercial use & higher rate limits
The free API above is for personal and low-volume use, and it stays free. If
you're building a product on breach data or need more throughput,
xonAPI+ offers paid plans from
$5/month with rate limits up to 25,000 requests/minute, API-key access, and
commercial support. It's the same breach data, and it's what keeps the free
tier free.
For full documentation, see the API docs and the API playground.
## API Endpoints
The full, always-current spec lives at /docs
(Swagger) and /openapi.json. The
endpoints you'll reach for most:
### Breach lookups
| Method | Path | What it does |
| GET | /v1/check-email/{email} | Quick check: is this email in a known breach? |
| GET | /v1/breach-analytics?email= | Detailed breach analytics for an email |
| GET | /v1/breaches | List all known breaches (optional ?domain=) |
| GET | /v1/domain-breach-summary | Summary of breaches for a domain |
### Stats & feeds
| Method | Path | What it does |
| GET | /v1/metrics | Top-level breach metrics |
| GET | /v1/metrics/detailed | Expanded metrics |
| GET | /v1/metrics/domain/{domain} | Metrics for a single domain |
| GET | /v1/analytics/pulse | Recent breach activity pulse |
| GET | /v1/xon-pulse | XposedOrNot activity feed |
| GET | /v1/rss | Breach updates as an RSS feed |
### Domain endpoints & API keys
Breach data for a domain is only available once you've verified ownership of