Skip to main content
POST
/
api
/
leak-search
Email Breach Lookup
curl --request POST \
  --url https://api.neur-a.org/api/leak-search \
  --header 'Authorization: <authorization>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "<string>"
}
'
{
  "List": {
    "Deadeye Breach": {
      "Data": [
        {
          "Email": "someone@example.com",
          "Password": "hunter2",
          "Username": "someone",
          "Source": "ExampleBreach2023"
        }
      ],
      "InfoLeak": "Deadeye universal breach results"
    },
    "LeakOSint": {
      "Data": [
        {
          "Email": "someone@example.com",
          "Phone": "+14155550000",
          "Name": "John Doe"
        }
      ],
      "InfoLeak": "LeakOSint aggregated results"
    }
  },
  "NumOfDatabase": 2,
  "NumOfResults": 2,
  "price": "0",
  "search time": "1s"
}

​
Overview

Queries multiple breach and intelligence databases in parallel for a given email address and returns aggregated results in a unified envelope. Sources include LeakOSint, Deadeye, CSInt, Melissa, IntelVault, and Cypher.
Requires a valid API key and at least 1 remaining daily request on your plan. Free plan users have access to this endpoint within their daily limit of 10 requests.

​
Request

​
Headers

​
Authorization
string
required
Bearer token. Format: Bearer <api_key>
​
X-API-Key
string
Alternative to Authorization header. Pass your API key directly.

​
Body

​
email
string
required
The email address to search across breach databases.Example: someone@example.com
curl -X POST https://api.neur-a.org/api/leak-search \
  -H "Authorization: Bearer nra_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"email": "someone@example.com"}'

​
Response

​
Fields

​
List
object
Map of source/database names to their results. Each key is a provider name (e.g. "Deadeye Breach", "LeakOSint"). Empty object {} if no results found.
​
NumOfDatabase
integer
Number of sources that returned at least one result.
​
NumOfResults
integer
Total number of records returned across all sources.
​
price
string
Query cost. Typically "0" for metered plans.
​
search time
string
Server-side query duration, e.g. "1s".

​
Examples

{
  "List": {
    "Deadeye Breach": {
      "Data": [
        {
          "Email": "someone@example.com",
          "Password": "hunter2",
          "Username": "someone",
          "Source": "ExampleBreach2023"
        }
      ],
      "InfoLeak": "Deadeye universal breach results"
    },
    "LeakOSint": {
      "Data": [
        {
          "Email": "someone@example.com",
          "Phone": "+14155550000",
          "Name": "John Doe"
        }
      ],
      "InfoLeak": "LeakOSint aggregated results"
    }
  },
  "NumOfDatabase": 2,
  "NumOfResults": 2,
  "price": "0",
  "search time": "1s"
}

​
Error Codes

StatusMeaning
400Missing or malformed email field in request body
401Invalid or missing API key
429Daily, hourly, or monthly plan quota exceeded
500Internal error or upstream source failure