<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Leaked Credentials

## HaveIBeenPwned API v3

### Breached Account
```bash
curl -s -H "hibp-api-key: $HIBP_KEY" -H "user-agent: OSINT-Agent" \
  "https://haveibeenpwned.com/api/v3/breachedaccount/user@example.com?truncateResponse=false"
```

### Paste Account
```bash
curl -s -H "hibp-api-key: $HIBP_KEY" -H "user-agent: OSINT-Agent" \
  "https://haveibeenpwned.com/api/v3/pasteaccount/user@example.com"
```

### All Breaches
```bash
curl -s "https://haveibeenpwned.com/api/v3/breaches"
```

### Single Breach
```bash
curl -s "https://haveibeenpwned.com/api/v3/breach/Adobe"
```

### Pwned Passwords (k-Anonymity)
```bash
# First 5 chars of SHA-1 hash
curl -s "https://api.pwnedpasswords.com/range/5BAA6"
```

### Rate Limits
- Authenticated: ~10 requests per minute
- Pwned Passwords: no rate limit (k-anonymity)

## h8mail

### Single Email
```bash
h8mail -t user@example.com
```

### Bulk Check
```bash
h8mail -t emails.txt -o results.csv
```

### With Breach Compilation
```bash
h8mail -t emails.txt --breach-compilation /path/to/breachcomp
```

### With API Keys
```bash
h8mail -t emails.txt -k h8mail_config.ini
```

### Config File Format
```ini
[h8mail]
hibp=YOUR_HIBP_KEY
dehashed_email=YOUR_EMAIL
dehashed_key=YOUR_KEY
```

## Dehashed API

### Search
```bash
curl -s -u "email:api_key" \
  "https://api.dehashed.com/search?query=domain:example.com&size=100"
```

### Fields Available
```
email, username, password, hashed_password, ip_address, name, phone, database_name
```

## Password Analysis

### SHA-1 k-Anonymity Check (Python)
```python
import hashlib, requests
sha1 = hashlib.sha1(b"password").hexdigest().upper()
resp = requests.get(f"https://api.pwnedpasswords.com/range/{sha1[:5]}")
matches = [l for l in resp.text.splitlines() if l.startswith(sha1[5:])]
```

## Environment Variables

| Variable | Description |
|----------|-------------|
| `HIBP_API_KEY` | HaveIBeenPwned API key |
| `DEHASHED_EMAIL` | Dehashed account email |
| `DEHASHED_KEY` | Dehashed API key |
