Breachsense CTI API Documentation

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

The NHI (Non-Human Identity) endpoint surfaces leaked API keys, OAuth tokens, and service credentials extracted from stealer logs, ransomware-leaked files, and exposed code repositories.

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Test Data :

Endpoint

Supported Parameters

Output

Endpoint

Supported Parameters

Output

Webhook payload format

When you configure a webhook URL via action=add&notify=https://your-webhook, alerts are delivered as HTTP POST with Content-Type: application/json.

The body is a JSON array of result objects, the same shape you’d receive in an HTTP response from the corresponding API endpoint, with two extra fields per object:

If you’ve configured basic auth via action=add&creds=user:pass, the request includes an Authorization: Basic ... header. Webhooks are sent per ingest cycle, not batched across cycles — expect multiple POSTs if many results match a single ingest.

Sending a test alert

Use this to verify a webhook is reachable, validate your alert-handling code against a known payload, or sanity-check a notification recipient was added correctly.

curl https://api.breachsense.com/account?lic=[License]&action=test&ast=[MonitoredAsset]

The asset must already be configured for monitoring (action=add&ast=... first). The test fans out to every notification target configured for that asset, both webhooks and emails. To target a single webhook, append it after a :: separator:

curl https://api.breachsense.com/account?lic=[License]&action=test&ast=example.com::https://hooks.example.com/breachsense

Test payload (sent to webhooks as a JSON array of one object):

[
  {
    "fnd": "20260510",
    "src": "dashboard.example.com/admin/login",
    "usr": "admin@example.com",
    "pwd": "admin123",
    "fle": "File.txt",
    "api": "combo",
    "ast": "example.com",
    "test": true
  }
]

The test: true field lets your receiver distinguish a test fixture from a real alert and skip ingestion of the synthetic credentials. Otherwise the payload shape matches a real combo-endpoint alert exactly.

Daily limit: 20 test alerts per license. Counter resets every 24 hours.

Response includes per-webhook delivery status:

{
  "status": "success",
  "message": "Test alert sent",
  "remaining_today": 19,
  "delivered": { "webhooks_ok": 1, "webhooks_failed": 0, "emails_queued": 0 },
  "webhooks": [{ "url": "https://hooks.example.com/breachsense", "status": 200 }]
}

Status codes:

Rotating your license key

If your license key is exposed (committed to a public repository, shared in chat, leaked in logs), rotate it self-serve:

curl https://api.breachsense.com/account?lic=[CurrentLicense]&action=rotate

The new license key is emailed to your configured notification recipients, not returned in the HTTP response. Even if the rotation request itself is intercepted, the new key only reaches you via email.

Requirements:

• Paid plan (Trial keys cannot be rotated, contact support@breachsense.com if a trial key is compromised)
• At least one notification recipient configured: curl https://api.breachsense.com/account?lic=[License]&action=add&notify=you@example.com
• One rotation per 24 hours per license

The old key is invalidated immediately on success.

Status codes: