EmailCount API

Email Count Filter allows any cyber-enabled user to easily check the count of compromised accounts found in the DBD API - Data Breach Detection.
This service can be used by all registered cyber users, query consumption is similar to all other Cyber APIs.

HTTP Get Parameters

In order to use the emailCountFilter, you need to call an endpoint URL with your private access token, as shown in the following URL schema.

http://webhose.io/emailCountFilter?token=XXXXX-XXXXX&format=json&q=email.value:[QUERY VALUE]
Parameter
Description
Example

q

A string query containing the email filter that define which leaked documents will be returned.

Find any leaked documents containing email: xxx123@gmail.com

email.value:xxx123@gmail.com

token

Your private access token. You get a unique access token when you sign up.

ts

The "ts" (timestamp) parameter tells the system to return results that were crawled after this timestamp (Unix Timestamp in milliseconds).
Default Value can be used , this is an OPTIONAL parameter.

&ts=1459835503426

format

The output format of the results set can either be:


  • json
  • xml

The default is json

&format=xml

Query Filter

As explained above, the only available filter is EmailCount.

Query Modes

User can query in the following two modes.

  • Exact Email Query: User can check for a compromised account by the exact email value.
    Example : q=email.value:john.wick@mycompany.com
  • Domain-Based Email Query: User can check for compromised accounts by the domain name of the organization.
    Example : q=email.value:*@mycompany.com

Note: Any other variation of the query is not relevant and might result in an error.

OUTPUT

Field Name
Description
Type

total_results

Total Number of compromised email records found in the Data Breach Repository.

Integer

min_num_of_results

The minimum number of compromised email records found in the Date Breach Repository.

Integer

Output Fields Logic

  • Only one of the output fields is the relevant per query, which means that the other shall be '0'.
  • In case the expected number of records is bigger than 1000 (>1000) the valid field is
    min_num_of_results
    Example: q=email.value:*@bigcompany.com, the expected number of results is at least 22704 records.
    In this case, the results will look as follow:
{
	total_results: 0,
	min_num_of_results: 22704,
}
  • In case the expected number of records is smaller than 1000 (<1000) the valid field is total_results.
    Example: q=email.value:*@smallcompany.com, the expected number of results is less than 1000 records.
    In this case, the results will look as follow:
{
	total_results: 75,
	min_num_of_results: 0,
}

EmailCount API


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.