Password Breach API

API reference

Password Breach HTTP endpoints on api.syndaq.com.

All Password Breach endpoints are served from https://api.syndaq.com/v1/pwbreach/.

Authenticated requests require a valid Password Breach key. Lookup routes require your pb_sec_ secret key.

Endpoints overview

Method	Path	Auth	Purpose
POST	`/v1/pwbreach/lookup`	Secret key	Check a password via JSON body
GET	`/v1/pwbreach/lookup`	Secret key	Check by `?sha1=` (40-char hex) only
GET	`/v1/pwbreach/status`	Public or secret key	Plan limits and quota snapshot

Response headers

Successful and error responses may include:

Header	Description
`X-Request-Id`	Unique ID for support and log correlation
`X-RateLimit-Limit`	Plan requests per minute for this key
`X-RateLimit-Remaining`	Requests left in the current minute window
`X-RateLimit-Reset`	Unix timestamp when the minute window resets
`X-Quota-Limit`	Monthly quota for the subscription
`X-Quota-Remaining`	Lookups left this calendar month (UTC)
`X-Quota-Period`	Current quota month (`YYYY-MM`)
`Retry-After`	Seconds to wait after HTTP 429

POST /v1/pwbreach/lookup

Checks a password against Syndaq breach intelligence.

Request

POST /v1/pwbreach/lookup
Authorization: Bearer pb_sec_YOUR_SECRET_KEY
Content-Type: application/json

{"password":"YOUR_PASSWORD_HERE"}

You may also send password as a form field, or sha1 (40-character lowercase hex) instead of plaintext.

GET requests must not send plaintext passwords. Use ?sha1= only on GET.

v1 scope

v1 reports whether the credential appears in Syndaq breach intelligence and how often (count). Responses never include the password or full password hash.

Success response (200)

{
  "success": true,
  "breached": true,
  "count": 3842,
  "cached": true,
  "request_id": "e6d04020be9b57b1e1069d6e483c0443"
}

When the password is not found:

{
  "success": true,
  "breached": false,
  "count": 0,
  "cached": true,
  "request_id": "e6d04020be9b57b1e1069d6e483c0443"
}

Response fields

Field	Type	Description
`breached`	boolean	`true` if the password appears in Syndaq breach intelligence
`count`	integer	Occurrence count (`0` when not breached)
`cached`	boolean	`true` when Syndaq already holds a recent result for this lookup

GET /v1/pwbreach/status

Returns key status, plan limits, and quota usage without performing a lookup.

Request

GET /v1/pwbreach/status
Authorization: Bearer pb_sec_YOUR_SECRET_KEY

The public key (pb_pub_) is accepted on this route.

Success response (200)

{
  "success": true,
  "status": "active",
  "product": "pwbreach",
  "plan": "starter",
  "rate_limit_per_minute": 60,
  "monthly_quota": 10000,
  "quota_unlimited": false,
  "quota_remaining": 9901,
  "quota_period": "2026-07"
}

Errors

Failed requests return JSON with success: false, error, error_code, and usually request_id.

HTTP	error_code	Typical cause
400	`invalid_password`	Missing password / invalid sha1
401	`missing_credentials`	No API key provided
401	`invalid_api_key`	Unknown, inactive, or revoked key
401	`wrong_key_type`	Public key used on a lookup endpoint
403	`ip_not_allowed`	Caller IP not on the key allowlist
429	`rate_limit_exceeded`	Per-minute limit exceeded
429	`quota_exceeded`	Monthly quota exhausted
502	`lookup_failed`	Temporary breach lookup failure
500	`internal_error`	Unexpected server error

Handle non-200 responses in your application and retry transient errors with exponential backoff.