<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Dark Web Threat Intelligence

## HaveIBeenPwned API v3

**Base URL:** `https://haveibeenpwned.com/api/v3/`

### Check Breached Account
```bash
curl -H "hibp-api-key: KEY" -H "user-agent: TI-Agent" \
  https://haveibeenpwned.com/api/v3/breachedaccount/user@example.com
```

### Get All Breaches
```bash
curl https://haveibeenpwned.com/api/v3/breaches
```

### Get Pastes for Account
```bash
curl -H "hibp-api-key: KEY" \
  https://haveibeenpwned.com/api/v3/pasteaccount/user@example.com
```

## Tor SOCKS Proxy Configuration

```python
import requests

proxies = {
    "http": "socks5h://127.0.0.1:9050",
    "https": "socks5h://127.0.0.1:9050",
}
resp = requests.get("http://example.onion/", proxies=proxies, timeout=30)
```

### Verify Tor Connection
```bash
curl --socks5-hostname 127.0.0.1:9050 https://check.torproject.org/api/ip
```

## DeHashed API

**Base URL:** `https://api.dehashed.com/`

### Search
```bash
curl -u email:api_key "https://api.dehashed.com/search?query=domain:example.com&size=100"
```

## IntelX API

**Base URL:** `https://2.intelx.io/`

### Search
```bash
curl -X POST -H "x-key: API_KEY" \
  https://2.intelx.io/intelligent/search \
  -d '{"term":"example.com","maxresults":10,"media":0,"sort":2,"terminate":[]}'
```

## Collection OPSEC Checklist

| Control | Implementation |
|---------|---------------|
| Network isolation | Dedicated VM with Tor-only routing |
| Identity separation | No personal accounts or identifiers |
| Data handling | TLP:RED default, encrypted storage |
| Access logging | Record all collection timestamps and sources |
| Passive only | No registration, posting, or transactions |
