---
title: "List identity breaches"
method: GET
path: "/user_risk/identity_breaches/list"
tags: ["userrisk"]
---

# List identity breaches

`GET /user_risk/identity_breaches/list`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/user_risk/identity_breaches/list`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/user_risk/identity_breaches/list/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieve a list of identity breaches for your organization.

Required API key permissions: `User Risk` (select when creating API key in Account Settings)

## Query parameters

- `page_size` integer
- `page_token` string
- `sort_by` 'title' | 'breach_date' | 'published_date'
- `sort_dir` 'asc' | 'desc'
- `statuses` string[]
- `breach_date_min` string
- `breach_date_max` string
- `published_date_min` string
- `published_date_max` string
- `data_classes` string[]

## Response `200`

A list of identity breaches

- IdentityBreachesListResponse
  - `identity_breaches` IdentityBreach[], required: The list of identity breaches.
    - `breach_date` string, date-time: The date when the breach occurred.
    - `breach_type` string, string, required: The type of the breach.
    - `description` string, required: A description of the breach.
    - `domain` string, required: The domain associated with the breach.
    - `exposed_data_types` string[], required: A list of data types exposed in the breach.
    - `id` string, required: The unique identifier of the identity breach.
    - `name` string, required: The name of the breach.
    - `published_date` string, date-time: The date when the breach was published.
    - `status` string, string, required: The status of the identity breach risk.
    - `title` string, required: The title of the breach.
  - `next_page_token` string: The token to be used to retrieve the next page of results. Will not be returned if there are no more results.

## Other responses

- `403`: Your API key does not have permission to perform this action.
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

## Changes

- **2026-11-07** `d044bf6dc61e`: 2 info
  - added the new optional `query` request parameter `sort_by`
  - added the new optional `query` request parameter `sort_dir`

[Operation history](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/changes/user_risk/identity_breaches/list/get.md)

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)