Skip to main content
POST
Check an email

Good to know

  • No match is not a guarantee. Sensitive, retired and opted-out breaches are not returned, so breached: false means “not found in public breach data”, not “never breached”.
  • Description is HTML. Render it as text, or sanitize it before inserting it into a page.
  • Records can gain new fields. New fields appear without notice. Read the ones you need and ignore the rest.
  • The email is processed by Finowl intelligence to perform the lookup. Mention this in your privacy notice.

Guide: email breach monitoring

Alert users when their email shows up in a new breach.

Authorizations

Authorization
string
header
required

Your Finowl API key, for example finowl_3f9a.... Create keys in the dashboard under API Keys.

Body

application/json
email
string<email>
required

The email address to check. Leading and trailing spaces are removed.

Maximum string length: 254
Example:

"alex.morgan@example.com"

Response

The check completed. breached is false and breaches is empty when nothing was found.

email
string
required

The email address that was checked.

breached
boolean
required

true when at least one breach was found.

breaches
object[]
required

Every breach that included this email. Empty when nothing was found.