--- title: Have I Been Pwned slug: connectors/have-i-been-pwned docTags: createdAt: 2026-06-09T16:29:48.952Z --- The Have I Been Pwned connector allows users to integrate real-time data breach information into their security workflows, enabling proactive monitoring and response to incidents of data exposure. Have I Been Pwned is a renowned platform for checking if personal data has been compromised in data breaches. The Have I Been Pwned Turbine Connector allows users to automate the process of monitoring and responding to breaches involving their organization's domains and email accounts. By integrating with Swimlane Turbine, security teams can proactively detect compromised credentials, assess the impact of breaches, and initiate swift incident response workflows. This connector enhances cybersecurity posture by providing actionable insights and streamlining the management of breach incidents. Connector to integrate with Have I Been Pwned API. ## Prerequisites To utilize the Have I Been Pwned connector within Swimlane Turbine, ensure you have the following: - API Key Authentication with the following parameters: - URL: The endpoint URL for the Have I Been Pwned API. - API Key: A valid API key provided by Have I Been Pwned to access their services. ## Capabilities The Have I Been Pwned has the following capabilities: - Get A Single Breached Site - Get All Breached Sites in the System - Get All Breaches for an Account - Get All Data Classes - Get All Pastes for an Account - Getting all Breached Email Addresses for a Domain - Getting all Subscribed Domains - Getting the most Recently Added Breach - Getting the Subscription Status This connector was last tested against product version: 3. ## API Documentation - [Have I Been Pwned API Documentation](https://haveibeenpwned.com/API/v3) ## Additional Documentation - [Have I Been Pwned Connector Documentation](https://docs.swimlane.com/connectors/have-i-been-pwned) - [Have I Been Pwned API Documentation](https://haveibeenpwned.com/API/v3) # Configurations ## Have I Been Pwned API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | hibp-api-key | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get A Single Breached Site Retrieve detailed information about a specific breach by providing the site's name in Have I Been Pwned. ### Endpoint - **URL:** `/api/v3/breach/{{name}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.name` | string | Required | Sometimes just a single breach is required and this can be retrieved by the breach "name". This is the stable value which may or may not be the same as the breach "title" (which can change). | ### Input Example `{"path_parameters":{"name":"Example Name"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Name` | string | Name of the resource | | `Title` | string | Output field: Title | | `Domain` | string | Output field: Domain | | `BreachDate` | string | Date value | | `AddedDate` | string | Date value | | `ModifiedDate` | string | Date value | | `PwnCount` | number | Count value | | `Description` | string | Output field: Description | | `LogoPath` | string | Output field: LogoPath | | `DataClasses` | array | Response data | | `IsVerified` | boolean | Output field: IsVerified | | `IsFabricated` | boolean | Output field: IsFabricated | | `IsSensitive` | boolean | Output field: IsSensitive | | `IsRetired` | boolean | Output field: IsRetired | | `IsSpamList` | boolean | Output field: IsSpamList | | `IsMalware` | boolean | Output field: IsMalware | ### Output Example `{"Name":"Example Name","Title":"string","Domain":"string","BreachDate":"string","AddedDate":"string","ModifiedDate":"string","PwnCount":123,"Description":"string","LogoPath":"string","DataClasses":["string"],"IsVerified":true,"IsFabricated":true,"IsSensitive":true,"IsRetired":true,"IsSpamList":true}` ## Get All Breached Sites in the System Retrieve detailed information on all breached sites in the system, including notable instances such as Adobe and Gawker. ### Endpoint - **URL:** `/api/v3/breaches` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.domain` | string | Optional | Filters the result set to only breaches against the domain specified. It is possible that one site (and consequently domain), is compromised on multiple occasions. | ### Input Example `{"parameters":{"domain":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `[]` ## Get All Breaches For An Account Retrieve all data breaches associated with a given account from the Have I Been Pwned API, requiring the 'account' path parameter. ### Endpoint - **URL:** `/api/v3/breachedaccount/{{account}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.account` | string | Required | The most common use of the API is to return a list of all breaches a particular account has been involved in. The API takes a single parameter which is the account to be searched for. The account is not case sensitive and will be trimmed of leading or trailing white spaces. | | `parameters.truncateResponse` | boolean | Optional | By default, only the name of the breach is returned rather than the complete breach data, thus reducing the response body size by approximately 98%. The name can then be used to either retrieve a single breach or it can be found in the list of all breaches in the system. If you'd like complete breach data returned in the API call, set this to false. | | `parameters.domain` | string | Optional | Filters the result set to only breaches against the domain specified. It is possible that one site (and consequently domain), is compromised on multiple occasions. | | `parameters.includeUnverified` | boolean | Optional | Returns breaches that have been flagged as "unverified". By default, both verified and unverified breaches are returned when performing a search. | ### Input Example `{"path_parameters":{"account":"string"},"parameters":{"truncateResponse":true,"domain":"string","includeUnverified":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `[]` ## Get All Data Classes Retrieve a comprehensive list of data classes recognized by Have I Been Pwned as compromised in various breaches. ### Endpoint - **URL:** `/api/v3/dataclasses` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 16 Aug 2024 11:29:35 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"1424","Connection":"keep-alive","access-control-expose-headers":"Request-Context","Cache-Control":"public, max-age=3600","Content-Encoding":"gzip","vary":"Accept-Encoding","strict-transport-security":"max-age=31536000; includeSubDomains; preload","x-frame-options":"DENY","x-content-type-options":"nosniff","referrer-policy":"strict-origin-when-cross-orig...` ## Get All Pastes For An Account Retrieve all paste entries for a specified email account from Have I Been Pwned, with case-insensitive and trimmed input handling. ### Endpoint - **URL:** `/api/v3/pasteaccount/{{account}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------------------------- | | `path_parameters.account` | string | Required | Email address to be searched for. | ### Input Example `{"path_parameters":{"account":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `[]` ## Getting all Breached Email Addresses for a Domain Retrieve all breached email addresses for a verified domain from Have I Been Pwned. ### Endpoint - **URL:** `/api/v3/breacheddomain/{{domain}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------------------------------------------------------------------- | | `path_parameters.domain` | string | Required | Parameters for the Getting all Breached Email Addresses for a Domain action | ### Input Example `{"path_parameters":{"domain":"example.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `alias1` | array | Output field: alias1 | | `alias2` | array | Output field: alias2 | | `alias3` | array | Output field: alias3 | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 16 Aug 2024 11:29:35 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"1424","Connection":"keep-alive","access-control-expose-headers":"Request-Context","Cache-Control":"public, max-age=3600","Content-Encoding":"gzip","vary":"Accept-Encoding","strict-transport-security":"max-age=31536000; includeSubDomains; preload","x-frame-options":"DENY","x-content-type-options":"nosniff","referrer-policy":"strict-origin-when-cross-orig...` ## Getting all Subscribed Domains Retrieve verified domains from the Have I Been Pwned domain search dashboard. ### Endpoint - **URL:** `/api/v3/subscribeddomains` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 16 Aug 2024 11:40:08 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","CF-Ray":"8b4125d4b86379ef-HYD","CF-Cache-Status":"DYNAMIC","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff","Set-Cookie":"__cf_bm=N3s0cYvDjqBztONyJqPBqGvBI9N1tDlv7jb8IbKUUEQ-1723808408-1.0.1.1-yVp9uGzSn...","Server":"cl...` ## Getting the most Recently Added Breach Retrieve the most recently added breach information from Have I Been Pwned, regardless of the actual event date. ### Endpoint - **URL:** `/api/v3/latestbreach` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Name` | string | Name of the resource | | `Title` | string | Output field: Title | | `Domain` | string | Output field: Domain | | `BreachDate` | string | Date value | | `AddedDate` | string | Date value | | `ModifiedDate` | string | Date value | | `PwnCount` | number | Count value | | `Description` | string | Output field: Description | | `LogoPath` | string | Output field: LogoPath | | `DataClasses` | array | Response data | | `IsVerified` | boolean | Output field: IsVerified | | `IsFabricated` | boolean | Output field: IsFabricated | | `IsSensitive` | boolean | Output field: IsSensitive | | `IsRetired` | boolean | Output field: IsRetired | | `IsSpamList` | boolean | Output field: IsSpamList | | `IsMalware` | boolean | Output field: IsMalware | | `IsSubscriptionFree` | boolean | Output field: IsSubscriptionFree | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 16 Aug 2024 11:47:38 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","CF-Ray":"8b4130d3ace879ef-HYD","CF-Cache-Status":"DYNAMIC","Access-Control-Allow-Origin":"*","Cache-Control":"public, max-age=300","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Vary":"Accept-Encoding","arr-disable-session-affinity":"True","request-context":"appId=cid-v1:7711...` ## Getting the Subscription Status Retrieve current subscription details for Have I Been Pwned, including plan type and expiration date. ### Endpoint - **URL:** `/api/v3/subscription/status` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `SubscribedUntil` | string | Output field: SubscribedUntil | | `SubscriptionName` | string | Name of the resource | | `Description` | string | Output field: Description | | `DomainSearchMaxBreachedAccounts` | number | Output field: DomainSearchMaxBreachedAccounts | | `Rpm` | number | Output field: Rpm | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 16 Aug 2024 12:02:50 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","CF-Ray":"8b41471859b279ef-HYD","CF-Cache-Status":"DYNAMIC","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff","Set-Cookie":"__cf_bm=i1p4moRPW6sBRBnzGeSfGxi5zQlwQL11Bi3pbUAxJSM-1723809770-1.0.1.1-j40wzbZTR...","Server":"cl...` # Response Headers | **Header** | **Description** | **Example** | | ----------------------------- | ------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Accept-Ranges | HTTP response header: Accept-Ranges | | | Access-Control-Allow-Origin | HTTP response header: Access-Control-Allow-Origin | \* | | access-control-expose-headers | HTTP response header: access-control-expose-headers | Request-Context | | Age | HTTP response header: Age | | | arr-disable-session-affinity | HTTP response header: arr-disable-session-affinity | True | | Cache-Control | Directives for caching mechanisms | public, max-age=3600 | | CF-Cache-Status | HTTP response header: CF-Cache-Status | DYNAMIC | | CF-Ray | HTTP response header: CF-Ray | 8b4130d3ace879ef-HYD | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Length | The length of the response body in bytes | 1424 | | content-security-policy | HTTP response header: content-security-policy | default-src 'none';script-src 'self' [www.google.com](http://www.google.com) [www.gstatic.com](http://www.gstatic.com) cdnjs.cloudflare.com az416426.vo.msecnd.net ajax.cloudflare.com challenges.cloudflare.com static.cloudflareinsights.com;style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com;img-src 'self' [www.gstatic.com](http://www.gstatic.com) translate.google.com logos.haveibeenpwned.com;font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com;connect-src 'self' api.pwnedpasswords.com stats.g.doubleclick.net dc.services.visualstudio.com;base-uri 'self';child-src [www.google.com](http://www.google.com) challenges.cloudflare.com;form-action 'self' accounts.google.com [www.paypal.com](http://www.paypal.com) billing.stripe.com checkout.stripe.com billing.haveibeenpwned.com;frame-ancestors 'none';worker-src 'self';upgrade-insecure-requests;report-uri [https://troyhunt.report-uri.com/r/d/csp/enforce](https://troyhunt.report-uri.com/r/d/csp/enforce) | | Content-Type | The media type of the resource | application/json; charset=utf-8 | | Date | The date and time at which the message was originated | Fri, 16 Aug 2024 11:47:38 GMT | | Expires | The date/time after which the response is considered stale | | | Last-Modified | The date and time at which the origin server believes the resource was last modified | | | Pragma | HTTP response header: Pragma | | | referrer-policy | HTTP response header: referrer-policy | strict-origin-when-cross-origin | | request-context | HTTP response header: request-context | appId=cid-v1:77119892-d8d8-4c8f-a69f-f4e0344e419f | | Server | Information about the software used by the origin server | cloudflare | | Set-Cookie | HTTP response header: Set-Cookie | \_\_cf\_bm=lwuCGJvIb6QeV.C1Mw9E4VsI3.vI1JhQXCuRXNxaSVk-1723807775-1.0.1.1-V2JGrpSRBkWM0AWTy7BpMc.ZZKIq5ijL8jdoJFPsbtbFnvauJng5H.N830i0KN.YUauwiN5WKxrVVP77g3CwzQ; path=/; expires=Fri, 16-Aug-24 11:59:35 GMT; domain=.haveibeenpwned.com; HttpOnly; Secure; SameSite=None | | strict-transport-security | HTTP response header: strict-transport-security | max-age=31536000; includeSubDomains; preload | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | vary | HTTP response header: vary | Accept-Encoding | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | x-frame-options | HTTP response header: x-frame-options | DENY | | X-Powered-By | HTTP response header: X-Powered-By | | | x-xss-protection | HTTP response header: x-xss-protection | 1; mode=block |