Have I Been Pwned

The Have I Been Pwned connector allows users to integrate real-time data breach information into their security workflows, enabling proactive monitoring and response to incidents of data exposure.

Have I Been Pwned is a renowned platform for checking if personal data has been compromised in data breaches. The Have I Been Pwned Turbine Connector allows users to automate the process of monitoring and responding to breaches involving their organization's domains and email accounts. By integrating with Swimlane Turbine, security teams can proactively detect compromised credentials, assess the impact of breaches, and initiate swift incident response workflows. This connector enhances cybersecurity posture by providing actionable insights and streamlining the management of breach incidents.

Connector to integrate with Have I Been Pwned API.

Prerequisites

To utilize the Have I Been Pwned connector within Swimlane Turbine, ensure you have the following:

API Key Authentication with the following parameters:

URL: The endpoint URL for the Have I Been Pwned API.

API Key: A valid API key provided by Have I Been Pwned to access their services.

Capabilities

The Have I Been Pwned has the following capabilities:

Get A Single Breached Site

Get All Breached Sites in the System

Get All Breaches for an Account

Get All Data Classes

Get All Pastes for an Account

Getting all Breached Email Addresses for a Domain

Getting all Subscribed Domains

Getting the most Recently Added Breach

Getting the Subscription Status

This connector was last tested against product version: 3.

API Documentation

Have I Been Pwned API Documentation

Additional Documentation

Have I Been Pwned Connector Documentation

Have I Been Pwned API Documentation

Configurations

Have I Been Pwned API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
hibp-api-key	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get A Single Breached Site

Retrieve detailed information about a specific breach by providing the site's name in Have I Been Pwned.

Endpoint

URL: /api/v3/breach/{{name}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.name	string	Required	Sometimes just a single breach is required and this can be retrieved by the breach "name". This is the stable value which may or may not be the same as the breach "title" (which can change).

Input Example

{"path_parameters":{"name":"Example Name"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
Name	string	Name of the resource
Title	string	Output field: Title
Domain	string	Output field: Domain
BreachDate	string	Date value
AddedDate	string	Date value
ModifiedDate	string	Date value
PwnCount	number	Count value
Description	string	Output field: Description
LogoPath	string	Output field: LogoPath
DataClasses	array	Response data
IsVerified	boolean	Output field: IsVerified
IsFabricated	boolean	Output field: IsFabricated
IsSensitive	boolean	Output field: IsSensitive
IsRetired	boolean	Output field: IsRetired
IsSpamList	boolean	Output field: IsSpamList
IsMalware	boolean	Output field: IsMalware

Output Example

{"Name":"Example Name","Title":"string","Domain":"string","BreachDate":"string","AddedDate":"string","ModifiedDate":"string","PwnCount":123,"Description":"string","LogoPath":"string","DataClasses":["string"],"IsVerified":true,"IsFabricated":true,"IsSensitive":true,"IsRetired":true,"IsSpamList":true}

Get All Breached Sites in the System

Retrieve detailed information on all breached sites in the system, including notable instances such as Adobe and Gawker.

Endpoint

URL: /api/v3/breaches

Method: GET

Input

Argument Name	Type	Required	Description
parameters.domain	string	Optional	Filters the result set to only breaches against the domain specified. It is possible that one site (and consequently domain), is compromised on multiple occasions.

Input Example

{"parameters":{"domain":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

[]

Get All Breaches For An Account

Retrieve all data breaches associated with a given account from the Have I Been Pwned API, requiring the 'account' path parameter.

Endpoint

URL: /api/v3/breachedaccount/{{account}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.account	string	Required	The most common use of the API is to return a list of all breaches a particular account has been involved in. The API takes a single parameter which is the account to be searched for. The account is not case sensitive and will be trimmed of leading or trailing white spaces.
parameters.truncateResponse	boolean	Optional	By default, only the name of the breach is returned rather than the complete breach data, thus reducing the response body size by approximately 98%. The name can then be used to either retrieve a single breach or it can be found in the list of all breaches in the system. If you'd like complete breach data returned in the API call, set this to false.
parameters.domain	string	Optional	Filters the result set to only breaches against the domain specified. It is possible that one site (and consequently domain), is compromised on multiple occasions.
parameters.includeUnverified	boolean	Optional	Returns breaches that have been flagged as "unverified". By default, both verified and unverified breaches are returned when performing a search.

Input Example

{"path_parameters":{"account":"string"},"parameters":{"truncateResponse":true,"domain":"string","includeUnverified":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

[]

Get All Data Classes

Retrieve a comprehensive list of data classes recognized by Have I Been Pwned as compromised in various breaches.

Endpoint

URL: /api/v3/dataclasses

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 16 Aug 2024 11:29:35 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"1424","Connection":"keep-alive","access-control-expose-headers":"Request-Context","Cache-Control":"public, max-age=3600","Content-Encoding":"gzip","vary":"Accept-Encoding","strict-transport-security":"max-age=31536000; includeSubDomains; preload","x-frame-options":"DENY","x-content-type-options":"nosniff","referrer-policy":"strict-origin-when-cross-orig...

Get All Pastes For An Account

Retrieve all paste entries for a specified email account from Have I Been Pwned, with case-insensitive and trimmed input handling.

Endpoint

URL: /api/v3/pasteaccount/{{account}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.account	string	Required	Email address to be searched for.

Input Example

{"path_parameters":{"account":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

[]

Getting all Breached Email Addresses for a Domain

Retrieve all breached email addresses for a verified domain from Have I Been Pwned.

Endpoint

URL: /api/v3/breacheddomain/{{domain}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.domain	string	Required	Parameters for the Getting all Breached Email Addresses for a Domain action

Input Example

{"path_parameters":{"domain":"example.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
alias1	array	Output field: alias1
alias2	array	Output field: alias2
alias3	array	Output field: alias3

Output Example

Getting all Subscribed Domains

Retrieve verified domains from the Have I Been Pwned domain search dashboard.

Endpoint

URL: /api/v3/subscribeddomains

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 16 Aug 2024 11:40:08 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","CF-Ray":"8b4125d4b86379ef-HYD","CF-Cache-Status":"DYNAMIC","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff","Set-Cookie":"__cf_bm=N3s0cYvDjqBztONyJqPBqGvBI9N1tDlv7jb8IbKUUEQ-1723808408-1.0.1.1-yVp9uGzSn...","Server":"cl...

Getting the most Recently Added Breach

Retrieve the most recently added breach information from Have I Been Pwned, regardless of the actual event date.

Endpoint

URL: /api/v3/latestbreach

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
Name	string	Name of the resource
Title	string	Output field: Title
Domain	string	Output field: Domain
BreachDate	string	Date value
AddedDate	string	Date value
ModifiedDate	string	Date value
PwnCount	number	Count value
Description	string	Output field: Description
LogoPath	string	Output field: LogoPath
DataClasses	array	Response data
IsVerified	boolean	Output field: IsVerified
IsFabricated	boolean	Output field: IsFabricated
IsSensitive	boolean	Output field: IsSensitive
IsRetired	boolean	Output field: IsRetired
IsSpamList	boolean	Output field: IsSpamList
IsMalware	boolean	Output field: IsMalware
IsSubscriptionFree	boolean	Output field: IsSubscriptionFree

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 16 Aug 2024 11:47:38 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","CF-Ray":"8b4130d3ace879ef-HYD","CF-Cache-Status":"DYNAMIC","Access-Control-Allow-Origin":"*","Cache-Control":"public, max-age=300","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Vary":"Accept-Encoding","arr-disable-session-affinity":"True","request-context":"appId=cid-v1:7711...

Getting the Subscription Status

Retrieve current subscription details for Have I Been Pwned, including plan type and expiration date.

Endpoint

URL: /api/v3/subscription/status

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SubscribedUntil	string	Output field: SubscribedUntil
SubscriptionName	string	Name of the resource
Description	string	Output field: Description
DomainSearchMaxBreachedAccounts	number	Output field: DomainSearchMaxBreachedAccounts
Rpm	number	Output field: Rpm

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 16 Aug 2024 12:02:50 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","CF-Ray":"8b41471859b279ef-HYD","CF-Cache-Status":"DYNAMIC","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff","Set-Cookie":"__cf_bm=i1p4moRPW6sBRBnzGeSfGxi5zQlwQL11Bi3pbUAxJSM-1723809770-1.0.1.1-j40wzbZTR...","Server":"cl...

Response Headers

Header	Description	Example
Accept-Ranges	HTTP response header: Accept-Ranges
Access-Control-Allow-Origin	HTTP response header: Access-Control-Allow-Origin	*
access-control-expose-headers	HTTP response header: access-control-expose-headers	Request-Context
Age	HTTP response header: Age
arr-disable-session-affinity	HTTP response header: arr-disable-session-affinity	True
Cache-Control	Directives for caching mechanisms	public, max-age=3600
CF-Cache-Status	HTTP response header: CF-Cache-Status	DYNAMIC
CF-Ray	HTTP response header: CF-Ray	8b4130d3ace879ef-HYD
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	1424
content-security-policy	HTTP response header: content-security-policy	default-src 'none';script-src 'self' www.google.com www.gstatic.com cdnjs.cloudflare.com az416426.vo.msecnd.net ajax.cloudflare.com challenges.cloudflare.com static.cloudflareinsights.com;style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com;img-src 'self' www.gstatic.com translate.google.com logos.haveibeenpwned.com;font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com;connect-src 'self' api.pwnedpasswords.com stats.g.doubleclick.net dc.services.visualstudio.com;base-uri 'self';child-src www.google.com challenges.cloudflare.com;form-action 'self' accounts.google.com www.paypal.com billing.stripe.com checkout.stripe.com billing.haveibeenpwned.com;frame-ancestors 'none';worker-src 'self';upgrade-insecure-requests;report-uri https://troyhunt.report-uri.com/r/d/csp/enforce
Content-Type	The media type of the resource	application/json; charset=utf-8
Date	The date and time at which the message was originated	Fri, 16 Aug 2024 11:47:38 GMT
Expires	The date/time after which the response is considered stale
Last-Modified	The date and time at which the origin server believes the resource was last modified
Pragma	HTTP response header: Pragma
referrer-policy	HTTP response header: referrer-policy	strict-origin-when-cross-origin
request-context	HTTP response header: request-context	appId=cid-v1:77119892-d8d8-4c8f-a69f-f4e0344e419f
Server	Information about the software used by the origin server	cloudflare
Set-Cookie	HTTP response header: Set-Cookie	__cf_bm=lwuCGJvIb6QeV.C1Mw9E4VsI3.vI1JhQXCuRXNxaSVk-1723807775-1.0.1.1-V2JGrpSRBkWM0AWTy7BpMc.ZZKIq5ijL8jdoJFPsbtbFnvauJng5H.N830i0KN.YUauwiN5WKxrVVP77g3CwzQ; path=/; expires=Fri, 16-Aug-24 11:59:35 GMT; domain=.haveibeenpwned.com; HttpOnly; Secure; SameSite=None
strict-transport-security	HTTP response header: strict-transport-security	max-age=31536000; includeSubDomains; preload
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
vary	HTTP response header: vary	Accept-Encoding
x-content-type-options	HTTP response header: x-content-type-options	nosniff
x-frame-options	HTTP response header: x-frame-options	DENY
X-Powered-By	HTTP response header: X-Powered-By
x-xss-protection	HTTP response header: x-xss-protection	1; mode=block