Breachsense CTI API Documentation

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

The NHI (Non-Human Identity) endpoint surfaces leaked API keys, OAuth tokens, and service credentials extracted from stealer logs, ransomware-leaked files, and exposed code repositories.

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Endpoint

Supported Parameters

Output

Webhook payload format

When you configure a webhook URL via action=add&notify=https://your-webhook, alerts are delivered as HTTP POST with Content-Type: application/json.

The body is a JSON array of result objects, the same shape you’d receive in an HTTP response from the corresponding API endpoint, with two extra fields per object:

If you’ve configured basic auth via action=add&creds=user:pass, the request includes an Authorization: Basic ... header. Webhooks are sent per ingest cycle, not batched across cycles, so expect multiple POSTs if many results match a single ingest.

Sending a test alert

Use this to verify a webhook is reachable, validate your alert-handling code against a known payload, or sanity-check a notification recipient was added correctly.

curl https://api.breachsense.com/account?lic=[License]&action=test&ast=[MonitoredAsset]

The asset must already be configured for monitoring (action=add&ast=... first). The test fans out to every notification target configured for that asset, both webhooks and emails. To target a single webhook, append it after a :: separator:

curl https://api.breachsense.com/account?lic=[License]&action=test&ast=example.com::https://hooks.example.com/breachsense

Test payload (sent to webhooks as a JSON array of one object):

[
  {
    "fnd": "20260510",
    "src": "dashboard.example.com/admin/login",
    "usr": "admin@example.com",
    "pwd": "admin123",
    "fle": "File.txt",
    "api": "combo",
    "ast": "example.com",
    "test": true
  }
]

The test: true field lets your receiver distinguish a test fixture from a real alert and skip ingestion of the synthetic credentials. Otherwise the payload shape matches a real combo-endpoint alert exactly.

Daily limit: 20 test alerts per license. Counter resets every 24 hours.

Response includes per-webhook delivery status:

{
  "status": "success",
  "message": "Test alert sent",
  "remaining_today": 19,
  "delivered": { "webhooks_ok": 1, "webhooks_failed": 0, "emails_queued": 0 },
  "webhooks": [{ "url": "https://hooks.example.com/breachsense", "status": 200 }]
}

Status codes:

Suppressing credential alerts (whitelist)

Whitelist username:password pairs you don’t want alerts for, such as rotated or old passwords, test or honeypot accounts, and pairs you’ve already remediated. The alert pipeline checks each license’s whitelist before sending a credential alert (the stealer, combo, and creds matches) and drops anything that matches, which cuts alert fatigue. This affects notifications only: a whitelisted pair still shows up in your normal API query results.

Two forms are supported:

• An exact pair, user@example.com:OldPass123, suppresses alerts for just that pair.
• A username on its own, user@example.com, suppresses every credential alert for that account.

The username is normalized to lowercase and matched case-insensitively; the password is matched exactly. Entries go in the ast parameter alongside a bare whitelist flag, and the feature is available on every tier (up to 1000 entries per license).

# whitelist an exact pair
curl "https://api.breachsense.com/account?lic=[License]&action=add&ast=user@example.com:OldPass123&whitelist"

# whitelist a whole username
curl "https://api.breachsense.com/account?lic=[License]&action=add&ast=user@example.com&whitelist"

# list current whitelist entries
curl "https://api.breachsense.com/account?lic=[License]&action=list&whitelist"

# remove an entry
curl "https://api.breachsense.com/account?lic=[License]&action=del&ast=user@example.com:OldPass123&whitelist"

action=add&whitelist requires an ast value and is idempotent (re-adding an existing entry returns Already whitelisted). action=list&whitelist returns a JSON array of the current entries, or [] when none are set.

Rotating your license key

If your license key is exposed (committed to a public repository, shared in chat, leaked in logs), rotate it self-serve:

curl https://api.breachsense.com/account?lic=[CurrentLicense]&action=rotate

The new license key is emailed to your configured notification recipients, not returned in the HTTP response. Even if the rotation request itself is intercepted, the new key only reaches you via email.

Requirements:

• Paid plan (Trial keys cannot be rotated, contact support@breachsense.com if a trial key is compromised)
• At least one notification recipient configured: curl https://api.breachsense.com/account?lic=[License]&action=add&notify=you@example.com
• One rotation per 24 hours per license

The old key is invalidated immediately on success.

Status codes:

Downloading your audit log

Pull a record of the API activity on your license so you can review what was queried, without us exporting it for you. The log is strictly scoped to the license passed in lic.

curl https://api.breachsense.com/account?lic=[License]&action=audit

By default this returns the last 30 days. To set a different window, use either days or an explicit from/to range:

curl "https://api.breachsense.com/account?lic=[License]&action=audit&days=7"
curl "https://api.breachsense.com/account?lic=[License]&action=audit&from=2026-06-01&to=2026-06-15"

Activity is retained for 35 days; anything older ages out and cannot be queried. The response echoes back the resolved time window it applied.

Response is a JSON object with a count, the resolved window_days, and an events array:

{
  "count": 1,
  "window_days": 7,
  "events": [
    {
      "endpoint": "/creds",
      "method": "HEAD",
      "search": "ignore@example.com",
      "status": 200,
      "time": "2026-06-18T19:01:49Z",
      "ip": "203.0.113.10",
      "user_agent": "curl/8.4.0"
    }
  ]
}

A window with no activity returns the same shape with count: 0 and an empty events array.

Each event records one request counted against your license:

• the search term that was queried (search)
• the endpoint and HTTP method (endpoint, method)
• the HTTP status code returned (status)
• the timestamp in UTC (time)
• the IP address the request came from (ip)
• the User-Agent that made the request (user_agent)

License-rotation events are merged into the same stream. The log reflects every request that counts against your license’s monthly usage, including automated monitoring runs performed on your behalf, not only requests you send directly.

A single request returns at most 5,000 events, newest first. If a window holds more than that, narrow it with days or an explicit from/to range to page through the rest.

Status codes: