---
title: "Get a list of breached identities"
method: GET
path: "/breaches"
tags: ["breaches"]
---

# Get a list of breached identities

`GET /breaches`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/breaches`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/breaches/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns a list of identities ordered by last breached date.

Required API key permissions: `IdentityBreaches` (select when creating API key in Account Settings)

## Query parameters

- `page_token` string
- `page_size` integer
- `sort_by` 'name' | 'domain' | 'num_breaches' | 'date_last_breach'
- `sort_desc` boolean
- `breach_id` string

## Response `200`

A list of breached identities

- BreachedIdentitiesResponsePayloadBody
  - `breached_identities` BreachedIdentity[]: The list of breached identities
    - `breach_ids` integer[]: The IDs of the breaches the identity is associated with
    - `domain` string: The breached identity domain
    - `id` integer: The internal id of the identity
    - `ignored` boolean: Flag indicating if the identity has been ignored
    - `last_breach_date` string, date-time: The date of the most recent breach (RFC 3339 format)
    - `name` string: The breached identity name
    - `num_breaches` integer: The total number of breaches the identity has been in
    - `severity` string: The highest severity of the breaches the identity appears in. Will be one of "Critical", "High", "Medium", or "Low".
    - `vip` boolean: Flag indicating if the identity is a VIP
  - `breaches` Breach[]: The list of breaches
    - `assignee_user_email` string: The email address of the currently assigned user. Will be blank if unassigned.
    - `breach_status` string: The status of the breach. Will be one of "active" or "archived".
    - `breach_type` string: The type of the breach. Will be one of "Company", "Infostealer", or "Paste".
    - `date_notified` string: The date the identities were notified of the breach (ISO 3339 format). Will be null if not notified.
    - `date_occurred` string, date-time: The date the breach occurred (ISO 3339 format)
    - `date_published` string, date-time: The date the breach was published (ISO 3339 format)
    - `description` string: The description of the breach
    - `domain` string: The domain of the breach
    - `employee_count` integer: The number of employees involved in the breach.
    - `exposed_data_classes` string[]: The classes of data exposed in this breach eg. "Passwords", "Usernames", "Email addresses", "Social security numbers", "Banking PINs", "Credit cards".
    - `id` integer: The internal id of the breach
    - `name` string: The name of the breach
    - `severity` string: The severity of the breach. Will be one of "Critical", "High", "Medium", or "Low".
    - `title` string: The title of the breach
    - `total_exposures` integer: The total number of identities in the breach
  - `next_page_token` string: The token to be used to retrieve the next page of results. Will not be returned if there are no more results.
  - `total_results` integer: The total number of breached identities found.

## Other responses

- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)