Breach Data API
Search SpyCloud’s Breach Catalog for exposure data associated with known identifiers.
For more information about the Investigations API See API reference.
The Investigations Breach Data API is the primary API for accessing SpyCloud's recaptured breach and malware data for investigations. It provides programmatic, high-volume access to the Breach Catalog, allowing investigators and security teams to search known identifiers – from email addresses and full names to domains and infected machine IDs – and retrieve matching exposure records.
Use this API when you need direct access to SpyCloud data for investigations, enrichment, or integration into existing security workflows.
How the API works
Start with a known selector and search across SpyCloud’s Breach Catalog for matching exposure records.
| 1. Search | 2. Investigate | 3. Integrate |
|---|---|---|
| Search a known selector, such as an email address, full name, username, domain, IP address, or other supported data points. | Review matching records to understand where the selector appears and what other data was exposed with it. | Use the results to inform additional searches or enrich link analysis, SIEM, and other investigative workflows. |
The API is designed for programmatic access to large volumes of SpyCloud data, making it useful for both individual investigations and repeatable, automated workflows.
Search inputs
The Breach Data API supports 18 selectors for searching SpyCloud’s Breach Catalog.
| Selector | Selector |
|---|---|
| Email address | IP address |
| Email username | Domain |
| Username | Password |
| Phone number | Bank account number |
| Full Name | Credit card number |
| Social handle | Social Security number |
| National ID | Driver’s license number |
| Passport number | Infected machine ID |
| Log ID |
How to search by Full Name
When a name is your only lead, use the Full Name selector to find associated breach exposure records. Searches return records containing the specified name phrase, helping investigators identify potential matches and additional data points to investigate. The endpoint also supports optional fuzzy matching (fuzzy=true) to broaden results beyond standard phrase matching.
Full Name searches require at least one name and return up to 10,000 records. You can also apply filters, including date ranges, source IDs, and severity, to narrow results.
Note: Some sensitive selectors are privacy-protected within SpyCloud’s data. Bank account numbers, credit card numbers, Social Security numbers, passport numbers, National IDs, and driver’s license numbers are SHA-1 hashed before ingestion. Plaintext searches are supported for these selectors, with SpyCloud handling the hashing automatically.
Input requirements, supported hash formats, and available parameters vary by endpoint.
Access the Breach Catalog
The Investigations API provides programmatic access to SpyCloud’s Breach Catalog, including recaptured breach and malware data.
Queries return exposure records matching the selector you provide. Depending on the underlying record, results can reveal additional identity and exposure data that appeared alongside that selector, giving investigators context and new data points to continue an investigation.
Each record can also include a source_id that connects the exposure to its source. Breach Catalog endpoints let you retrieve additional information about a source when you need more context about where the data originated.
Built for high-volume investigations: Direct access to the Breach Catalog makes this API well suited for high-volume searches, batch queries, evidentiary pulls, enrichment, and automated investigative workflows.
When to use the Investigations API
Common use cases include:
- Investigate identities and accounts. Start with a known identifier, including a full name, to find associated exposure records and uncover additional investigative leads.
- Investigate organizational exposure. Search domains and other known selectors to understand exposure associated with an organization or third party.
- Investigate threat actors and infrastructure. Search known identity and technical selectors to uncover data that can support attribution and threat research.
- Enrich investigations. Add SpyCloud data to existing cases, alerts, and investigative datasets.
- Run high-volume searches. Incorporate SpyCloud data into batch jobs, repeatable searches, and automated workflows.
- Integrate SpyCloud data. Bring exposure data directly into the tools analysts already use for investigation and analysis.
Integrations
The API returns structured data that can be integrated into existing investigative and security workflows. This allows analysts to bring SpyCloud data into the tools they already use for analysis, enrichment, and correlation.
| Integration | How it works |
|---|---|
| Maltego | Use SpyCloud transforms to query exposure data and bring returned entities and relationships into visual link analysis. |
| Jupyter | Query, enrich, analyze, and visualize SpyCloud data within notebook-based investigative and research workflows. |
| Splunk | Bring SpyCloud data into Splunk for enrichment, searching, correlation, and analysis alongside other security data. |
| Vertex Synapse | Use Storm commands and flexible enrichment to incorporate SpyCloud data into intelligence fusion and link analysis workflows. |
See the individual Maltego, Jupyter, Splunk, and Vertex Synapse guides for setup and implementation details.
Considerations
The Investigations API is designed for high-volume, selector-based access to SpyCloud’s Breach Catalog. Broad searches can return large result sets, so filters and pagination can help focus and manage results.
Updated 7 days ago