XposedOrNot API
๐ Your free API for real-time data breach monitoring and analytics.
XposedOrNot API Playground ยท
XposedOrNot.com
## What is XposedOrNot API?
Data breaches happen constantly, and most people only find out long after their email and passwords are already circulating. I built XposedOrNot so you don't have to wonder. Check an email or domain and know right away whether it's turned up in a known breach.
This repo is the API that powers it all: the breach lookups, the analytics, and the alerts. It's free to use, and it's open-source, so you can read exactly how every check works rather than taking my word for it.
Give it a try below, and if you find it useful, I'd love for you to build something with it.
Devanand Premkumar, creator of XposedOrNot
[](https://x.com/devaonbreaches)
[](https://infosec.exchange/@DevaOnBreaches)
## Quick Example
Check if an email has been exposed in data breaches:
```bash
curl https://api.xposedornot.com/v1/check-email/test@example.com
```
Response:
```json
{
"breaches": [["Adobe", "LinkedIn"]],
"email": "test@example.com",
"status": "success"
}
```
Get detailed breach analytics:
```bash
curl "https://api.xposedornot.com/v1/breach-analytics?email=test@example.com"
```
## Rate Limits & API Access
- **No API key required** for basic endpoints (`/v1/check-email`, `/v1/breach-analytics`, `/v1/breaches`)
- **API key required** for domain breach monitoring โ see [Domain endpoints & API keys](#domain-endpoints--api-keys) for how to get and use one
Rate limits are applied **per IP, per endpoint**:
| Endpoint | Per second | Per hour | Per day |
|----------|:----------:|:--------:|:-------:|
| `GET /v1/check-email/{email}` | 2 | 25 | 100 |
| `GET /v1/breach-analytics` | 2 | 25 | 100 |
| `GET /v1/breaches` | 2 | 50 | 100 |
| `POST /v1/domain-breaches/` | 2 | 25 | 50 |
When a limit is exceeded the API returns `429 Too Many Requests` with a `Retry-After`
header (seconds) and a JSON body carrying `retry_after` and `reset_time`, so clients
can back off precisely.
### Commercial use & higher rate limits
The free API above is for personal and low-volume use, and it stays free. If
you're building a product on breach data or need more throughput,
[xonAPI+](https://plus.xposedornot.com/products/api) offers paid plans from
$5/month with rate limits up to 25,000 requests/minute, API-key access, and
commercial support. It's the same breach data, and it's what keeps the free
tier free.
For full documentation, see the [API docs](https://xposedornot.com/api_doc) and the [API playground](https://api.xposedornot.com/docs).
## API Endpoints
The full, always-current spec lives at [`/docs`](https://api.xposedornot.com/docs)
(Swagger) and [`/openapi.json`](https://api.xposedornot.com/openapi.json). The
endpoints you'll reach for most:
### Breach lookups
| Method | Path | What it does |
|--------|------|--------------|
| GET | `/v1/check-email/{email}` | Quick check: is this email in a known breach? |
| GET | `/v1/breach-analytics?email=` | Detailed breach analytics for an email |
| GET | `/v1/breaches` | List all known breaches (optional `?domain=`) |
| GET | `/v1/domain-breach-summary` | Summary of breaches for a domain |
### Stats & feeds
| Method | Path | What it does |
|--------|------|--------------|
| GET | `/v1/metrics` | Top-level breach metrics |
| GET | `/v1/metrics/detailed` | Expanded metrics |
| GET | `/v1/metrics/domain/{domain}` | Metrics for a single domain |
| GET | `/v1/analytics/pulse` | Recent breach activity pulse |
| GET | `/v1/xon-pulse` | XposedOrNot activity feed |
| GET | `/v1/rss` | Breach updates as an RSS feed |
### Domain endpoints & API keys
Breach data for a domain is only available once you've **verified ownership** of
that domain, and calls are authenticated with an API key tied to your account.
**Getting an API key** โ keys are issued and managed from the web console, not
via a public endpoint:
1. Sign in at [xposedornot.com](https://xposedornot.com).
2. Open your **CxO Dashboard** and verify the domain(s) you want to monitor.
3. Go to **API Key Management** (linked from the dashboard). Your key is shown
there; use **Reset API Key** to rotate it.
**Using the key** โ pass it in the `x-api-key` header. The domain-breaches
endpoint takes no body; it returns breaches across *all* the domains you've
verified:
```bash
curl -L -X POST \
-H "x-api-key: " \
-H "Content-Length: 0" \
https://api.xposedornot.com/v1/domain-breaches/
```
An invalid key (or one with no verified domains) returns `401 Invalid or missing
API key`; omitting the `x-api-key` header entirely returns `422`. See the
[API docs](https://xposedornot.com/api_doc) for the full domain verification and
alert-subscription flows.
## Use it from your AI tools (MCP)
XposedOrNot ships a built-in [Model Context Protocol](https://modelcontextprotocol.io)
server, so AI assistants can check breaches directly. Point your MCP client at
`https://api.xposedornot.com/mcp` (Streamable HTTP, JSON-RPC 2.0 over POST).
No API key or authentication is needed; all tools are read-only and never
return passwords.
Tools exposed:
- **`check_email_breaches`**: check if an email appears in any known breach
- **`get_breach_analytics`**: detailed breach history, risk score and paste
exposure for an email
- **`list_breaches`**: browse the breach catalog, filter by domain or breach ID
- **`domain_breach_summary`**: aggregate breach counts for a domain
- **`get_breach_metrics`**: system-wide breach statistics
- **`get_recent_breaches`**: most recently added breaches, newest first
Quick connect:
```bash
claude mcp add --transport http xposedornot https://api.xposedornot.com/mcp
```
For Cline, Cursor, Gemini CLI and other clients, see
[llms-install.md](llms-install.md). A machine-readable server card is at
`https://api.xposedornot.com/.well-known/mcp/server-card.json`.
A quick `tools/list` call:
```bash
curl -X POST https://api.xposedornot.com/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```
## Why use XposedOrNot API?
XposedOrNot was the first open-source tool to monitor and alert on data breaches, and this API gives you direct access to everything it has collected and keeps current. With it you can:
- Check whether an email has appeared in a known data breach, with stats on where and when
- See if an email shows up in public pastes
- Run a single combined search across both breaches and pastes
- Check whether a password has been exposed without ever revealing your identity
Prefer to just look something up without writing code? You can do all of this on the website too: https://xposedornot.com.
## Security
This project is fully open-source and uses automated security tooling (Black, Pylint, CodeQL, OpenSSF Scorecard). For security details, see [SECURITY.md](SECURITY.md).
Please do not report security vulnerabilities through public GitHub issues. Instead, refer to our [Responsible Disclosure Guidelines](https://xposedornot.com/responsible-disclosure) for reporting these issues in a secure manner.
## Prerequisites
- **Docker** (recommended): Docker 20.10+ and Docker Compose V2
- **Local install**: Python 3.11+, Google Cloud SDK
## Quick Start for Local Development
### Using Docker Compose (Recommended)
1. **Clone the Repository:**
```shell
git clone https://github.com/XposedOrNot/XposedOrNot-API
```
2. **Update the necessary environment variables in the docker-compose.yml file if needed, then run:**
```shell
docker compose up
```
This command will build API and Datastore Docker images. Note that the project source directory is mapped in the Docker container, so any changes in the source code won't require rebuilding the Docker image.
### Local Installation
1. **Clone the Repository:**
```shell
git clone https://github.com/XposedOrNot/XposedOrNot-API
```
2. **Install Required Packages**
```shell
sudo apt-get install -y python3-pip build-essential libffi-dev python3-dev
```
Then [install the gcloud CLI](https://cloud.google.com/sdk/docs/install) โ it's not in the stock Debian/Ubuntu repositories and is needed for step 4 (Datastore authentication or the local emulator).
3. **Install Python Libraries**
```shell
pip3 install -r requirements.txt
```
4. **Setup Google Cloud Datastore**
Before running XposedOrNot-API, choose one of the following options:
- [Run local Google DataStore emulator](https://cloud.google.com/datastore/docs/tools/datastore-emulator)
and debug using the local emulator rather than directly connect to Google DataStore.
```shell
# For posix platforms, e.g. linux, mac:
gcloud beta emulators datastore start
```
- [Authenticate to Google DataStore](https://cloud.google.com/sdk/gcloud/reference/beta/auth/application-default) and directly debug using Google DataStore.
5. **Run the application**
```shell
python3 main.py
```
## Configuration
Configuration is read from environment variables. For Docker Compose these are
already set in `docker-compose.yml`; for a local install, copy `.env.example` to
`.env` and fill in the values (or export them in your shell).
### Required (the app won't start without these)
| Variable | What it's for |
|----------|---------------|
| `SECRET_APIKEY` | Secret used to sign issued API keys |
| `SECURITY_SALT` | Salt for signing verification tokens |
| `WTF_CSRF_SECRET_KEY` | CSRF protection secret |
| `ENCRYPTION_KEY` | Fernet key for encrypting stored data |
| `AUTH_EMAIL` | Cloudflare account email |
| `AUTHKEY` | Cloudflare API key |
| `CF_MAGIC` | Cloudflare integration token |
| `CF_UNBLOCK_MAGIC` | Cloudflare unblock token |
| `MJ_API_KEY` | Mailjet API key, for sending alert emails ([mailjet.com](https://www.mailjet.com/)) |
| `MJ_API_SECRET` | Mailjet API secret |
> For local development you can set these to any placeholder value; the defaults
> in `docker-compose.yml` show the expected format.
### Redis (rate limiting & state)
| Variable | Default | Notes |
|----------|---------|-------|
| `REDIS_HOST` | `localhost` | Redis host |
| `REDIS_PORT` | `6379` | Redis port |
| `REDIS_DB` | `0` | Redis database number |
| `REDIS_PASSWORD` | _(none)_ | Set if your Redis requires auth |
### Google Cloud (Datastore & Pub/Sub)
| Variable | Default | Notes |
|----------|---------|-------|
| `PROJECT_ID` | _(none)_ | GCP project ID |
| `DATASTORE_EMULATOR_HOST` | _(none)_ | Point at the local emulator, e.g. `localhost:8000` |
| `TOPIC_ID` | _(none)_ | Pub/Sub topic for the live-visitor globe feed |
### Optional
| Variable | Default | Notes |
|----------|---------|-------|
| `ENVIRONMENT` | `production` | `production` or `development` |
| `BASE_URL` | `https://api.xposedornot.com` | Public base URL used in links |
| `PORT` | `8080` | Port the server listens on |
| `ENABLE_SCHEDULER` | `false` | Run the background digest scheduler |
| `DEBUG_EMAIL` | _(none)_ | Override recipient for debug emails |
| `SENIORITY_ENRICH_URL` / `SENIORITY_ENRICH_SECRET` | _(none)_ | External seniority-enrichment service |
| `DOMAIN_EMAIL_LIMITS_ENABLED` | `true` | Kill switch for domain email verification anti-bombing limits |
| `DOMAIN_EMAIL_RECIPIENT_COOLDOWN_SECONDS` | `900` | Cooldown between challenges to the same role address |
| `DOMAIN_EMAIL_DOMAIN_MAX_PER_HOUR` | `5` | Max verification emails per domain per hour |
| `DOMAIN_EMAIL_IP_MAX_PER_HOUR` | `10` | Max verification emails per client IP per hour |
| `DOMAIN_EMAIL_GLOBAL_DAILY_BUDGET` | `2000` | Global daily cap on verification emails |
## Contributing
Please read [CONTRIBUTING.md](CONTRIBUTING.md) for details on our code of conduct, and the process for submitting pull requests to us.
## Authors
* **Devanand Premkumar** - *Initial work* - [DevaOnBreaches](https://github.com/DevaOnBreaches)
## License
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details
## Acknowledgments
* Thanks to the Python community and the maintainers of every library this project leans on. XposedOrNot stands on your work.
* And to everyone who has reviewed the code and reported issues: thank you. A second set of eyes catches what I can't.
## Show Your Support
If this saved you some trouble, a few things genuinely help:
- โญ Star the repo so others can find it
- Fork it and send a pull request; contributions are welcome
- Share it with someone who'd find it useful