XposedOrNot API

XposedOrNot API

🎉 Your free API for real-time data breach monitoring and analytics.

XposedOrNot API Playground    ·
 XposedOrNot.com

What is XposedOrNot API?

Data breaches happen constantly, and most people only find out long after their email and passwords are already circulating. I built XposedOrNot so you don't have to wonder. Check an email or domain and know right away whether it's turned up in a known breach.

This repo is the API that powers it all: the breach lookups, the analytics, and the alerts. It's free to use, and it's open-source, so you can read exactly how every check works rather than taking my word for it.

Give it a try below, and if you find it useful, I'd love for you to build something with it.

Devanand Premkumar, creator of XposedOrNot

Quick Example

Check if an email has been exposed in data breaches:

curl https://api.xposedornot.com/v1/check-email/test@example.com

Response:

{
  "breaches": [["Adobe", "LinkedIn"]],
  "email": "test@example.com",
  "status": "success"
}

Get detailed breach analytics:

curl "https://api.xposedornot.com/v1/breach-analytics?email=test@example.com"

Rate Limits & API Access

• No API key required for basic endpoints (/v1/check-email, /v1/breach-analytics, /v1/breaches)
• API key required for domain breach monitoring — see Domain endpoints & API keys for how to get and use one

Rate limits are applied per IP, per endpoint:

Endpoint	Per second	Per hour	Per day
GET /v1/check-email/{email}	2	25	100
GET /v1/breach-analytics	2	25	100
GET /v1/breaches	2	50	100
POST /v1/domain-breaches/	2	25	50

When a limit is exceeded the API returns 429 Too Many Requests with a Retry-After header (seconds) and a JSON body carrying retry_after and reset_time, so clients can back off precisely.

Commercial use & higher rate limits

The free API above is for personal and low-volume use, and it stays free. If you're building a product on breach data or need more throughput, xonAPI+ offers paid plans from $5/month with rate limits up to 25,000 requests/minute, API-key access, and commercial support. It's the same breach data, and it's what keeps the free tier free.

For full documentation, see the API docs and the API playground.

API Endpoints

The full, always-current spec lives at /docs (Swagger) and /openapi.json. The endpoints you'll reach for most:

Breach lookups

Method	Path	What it does
GET	/v1/check-email/{email}	Quick check: is this email in a known breach?
GET	/v1/breach-analytics?email=	Detailed breach analytics for an email
GET	/v1/breaches	List all known breaches (optional ?domain=)
GET	/v1/domain-breach-summary	Summary of breaches for a domain