Check whether a password was exposed

The password is converted to SHA-256 only during this request. It is never logged or stored; the response contains only the match count and domain distribution. Explicit `hunter:password` scope is required; a full-access wildcard is not sufficient.

POST/v1/hunter/password

POSTCheck whether a password was exposed

curl -X POST "https://api.darkradar.com/api/public/v1/hunter/password" \
  -H "x-api-key: $DARKRADAR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"password":"Yaz2026!"}'

Response

Success

{
  "success": true,
  "data": {
    "count": 3,
    "domains": [
      {
        "domain": "vpn.darkradar.com",
        "count": 2
      },
      {
        "domain": "mail.darkradar.com",
        "count": 1
      }
    ],
    "rateLimit": {
      "remaining": 18,
      "limit": 20
    }
  }
}

Access

Scopehunter:password

Plan entitlementintel_hunter

Request body

Fields	Values
`password` · string · required	Password to check (1–1024 characters). Only its SHA-256 hash is used on the server.

Responses

200Success

400Invalid request (malformed id, missing or invalid field)

401Key missing, invalid, expired or revoked

403Insufficient scope, no API access in plan, or product not enabled

404Record not found or not owned by this key’s firm

408The request exceeded its maximum response time

429The per-minute request limit for your firm was exceeded; wait the number of seconds in the `Retry-After` header

503Threat Investigation is temporarily unavailable; do not retry automatically, try again later yourself

Response limits

Rate limit500 requests per 15 min · per IP

Threat Investigation20 requests per 1 min · per firm