Introduction

SpyCloud's Exposure Metrics API is a programmatic interface for gathering high level breach statistics on domains and emails.

See API Guidelines for authentication, configuration, and error handling details.

Performance

The /stats/emails/{email} endpoint will also return a limited number of stats for the email domain. If your use case requires querying email address for free email services like gmail.com, yahoo.com, hotmail.com, etc then we recommend using the skip_domain query parameter to greatly improve response time. This query parameter will only return stats for the email address. Note: The domain endpoint will not return any stats for large free email service domains.

Domain Metrics (Effective 04/30/2026)

Domain (Email Domain + Target Domain)

Field	Description
`last_discovered_days_ago`	Days since the most recent record was discovered across the entire domain (employees + consumers)
`records`	Total records found with the domain (employees + consumers combined)
`related_sources`	Total distinct breach sources that contain records for the domain (employees + consumers combined)
`lookback`	Period of time the metrics are reporting over. Currently it is all time. Future feature to add time selector.

Employee (Email Domain Matches)

Field	Description
`employee_last_discovered_days_ago`	Days since the most recent employee record was discovered
`employee_records`	Total records found with the employee emails
`employee_related_sources`	Distinct breach sources containing at least one employee email
`employee_credit_card_records`	Employee records containing a credit card number
`employee_phish_records`	Employee records from phished sources
`employee_phish_records_with_password`	Employee records from phished sources that contain a password
`employee_distinct_infected_machine_ids`	Count of distinct infostealer infected machine ids found to contain at least one employee record (unique compromised devices tied to employees)
`employee_distinct_emails`	Count of distinct employee email addresses
`employee_distinct_passwords`	Count of distinct plaintext passwords appearing across all employee email records
`employee_distinct_email_password_combinations`	Count of distinct employee email + plaintext password pairings (useful for measuring credential reuse)
`employee_infected_distinct_emails`	Count of distinct employee emails appearing in infostealer records
`employee_phish_records_distinct_emails`	Count of distinct employee emails appearing in phishing records

Consumer (Target Domain Matches, Excludes Email Domain Matches)

Field	Description
`consumer_last_discovered_days_ago`	Days since the most recent consumer record was discovered
`consumer_records`	Total records found with the consumer emails
`consumer_related_sources`	Distinct breach sources containing at least one consumer email
`consumer_credit_card_records`	Consumer records containing a credit card number
`consumer_distinct_infected_machine_ids`	Count of distinct infostealer infected machine ids found to contain at least one target domain record (unique compromised devices / application exposures)
`consumer_distinct_emails`	Count of distinct consumer email addresses
`consumer_distinct_passwords`	Count of distinct plaintext passwords across all consumer records
`consumer_distinct_email_password_combinations`	Count of distinct consumer email + plaintext password pairings
`consumer_infected_distinct_emails`	Count of distinct consumer emails appearing in infostealer records

Source Types Per Segment

Segments: employee_source_type_breakdown, consumer_source_type_breakdown

Field	Description
`*_source_type`	The category of breach source: exfiltrated, exposed, scraped, unknown, combolist, infostealer, and phished
`*_record_count`	Total records of this source type within the employee or consumer segment
`*_related_sources`	Distinct count of breach sources of this source type within the segment
`*_last_seen_date`	The most recent SpyCloud publish date among the records of this source type within the segment