<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Detecting Credential Compromise

## Credential Compromise Detection APIs

### Have I Been Pwned API

| Endpoint | Description |
|---|---|
| `GET /api/v3/breachedaccount/{account}` | Check breached account |
| `GET /api/v3/breach/{name}` | Get breach details |
| `GET /range/{hashPrefix}` | k-Anonymity password check |

### Microsoft Entra ID — Risk Detections

| Endpoint | Description |
|---|---|
| `GET /identityProtection/riskDetections` | All risk detections |
| `GET /identityProtection/riskDetections?$filter=riskType eq 'leakedCredentials'` | Leaked creds |
| `GET /identityProtection/riskyUsers` | Users with active risk |

### Agent Script

```bash
# Check breach database
node agent.js check-breach --email user@example.com

# Analyze auth anomalies
node agent.js analyze-anomalies --user-id user@example.com --window 24

# Respond to compromise
node agent.js respond --user-id user@example.com --actions force_password_reset revoke_sessions
```
