Data Breach Watch API

One REST API over our database of U.S. data breaches. Summary-level data is open and needs no key. Certainty, notification timelines, response grades and litigation signals are available with an API key.

REST

JSON over HTTPS

100/hr

Anonymous rate limit

4 tiers

Anonymous to Scale

OpenAPI

3.0 spec included

Base URL

https://databreach.watch/api/public/v1

Endpoints: GET /breaches, GET /breaches/{id-or-slug}, GET /ping. Responses are JSON.

The older /functions/v1/public-api URL still works but is deprecated. It returns a Deprecation header pointing here.

Access tiers

Tier	Key	Limit	Page size
Anonymous	None	100 requests / hour per IP	25
Free	Required	500 calls / month	100
Pro	Required	5,000 calls / month, 5 webhooks	100
Scale	Required	50,000 calls / month, 25 webhooks	100

Send your key in the X-LegalPulse-Key header. Request one on the LegalPulse page. Invalid keys are rejected with 401 rather than falling back to anonymous access.

Fields by tier

Field	Anonymous	Free	Pro / Scale
`company, sector, date_discovered`
`summary, data_types, states_affected`
`permalink, last_updated`
`certainty_level, status`
`affected_count`
`risk_level, response_grade`
`full_summary, source_urls`
`notification timeline`
`litigation count and docket links`
`priority and fit scoring`

Fields your tier cannot access are omitted from the response rather than returned as null, so you can detect gating. Every response includes a tier field and an X-Upgrade-Hint header.

Query parameters

Parameter	Type	Description
`company`	string	Filter by company name (partial match)
`sector`	string	Filter by sector
`state`	string	Filter by affected state
`date_from`	date	Breaches discovered on or after this date (YYYY-MM-DD)
`date_to`	date	Breaches discovered on or before this date
`limit`	integer	Results per page (default 25, max 25 anonymous / 100 keyed)
`offset`	integer	Pagination offset (default 0)
`format`	string	Set to "openapi" on /breaches to get the OpenAPI 3.0 spec

Examples

List recent breaches

Returns the 10 most recent public breaches

https://databreach.watch/api/public/v1/breaches?limit=10

Search by company

Find breaches matching a company name

https://databreach.watch/api/public/v1/breaches?company=T-Mobile

Filter by sector

Healthcare breaches, limited to 5 results

https://databreach.watch/api/public/v1/breaches?sector=Healthcare&limit=5

Filter by state

Breaches affecting California residents

https://databreach.watch/api/public/v1/breaches?state=California

Date range

Breaches discovered in Q1 2026

https://databreach.watch/api/public/v1/breaches?date_from=2026-01-01&date_to=2026-03-31

Single breach by slug or ID

Full record for one breach

https://databreach.watch/api/public/v1/breaches/acme-corp-2026-march

With an API key

curl -H "X-LegalPulse-Key: your_key" "https://databreach.watch/api/public/v1/breaches?limit=5"

Sample response (anonymous)

{
  "total": 444,
  "limit": 1,
  "offset": 0,
  "tier": "anonymous",
  "max_page_size": 25,
  "citation": {
    "attribution": "Data Breach Watch (databreach.watch)",
    "guidance": "Link to the breach permalink, attribute to Data Breach Watch, and note the certainty level."
  },
  "breaches": [
    {
      "id": "abc-123",
      "company": "Acme Corp",
      "sector": "Technology",
      "date_discovered": "2026-03-01",
      "summary": "Acme Corp reported a data breach...",
      "data_types": ["Email", "SSN", "Password"],
      "states_affected": ["California", "New York"],
      "last_updated": "2026-03-04T18:12:00Z",
      "permalink": "https://databreach.watch/breach/acme-corp-2026-march"
    }
  ]
}

Rate limits

Anonymous: 100 requests per hour per IP address.

Keyed: monthly quota by tier, counted per key.

Exceeding a limit returns 429 with a Retry-After header. Successful responses include X-RateLimit-Limit and X-RateLimit-Remaining.

Attribution

Use of this API requires attribution to Data Breach Watch and a link to the breach permalink. Note the certainty level when publishing, and use language like "reports suggest" for breaches that are not yet confirmed.

OpenAPI specification

The full OpenAPI 3.0 spec is available for Swagger, Postman, or AI agents:

Get breach alerts delivered to your inbox

Stay informed about new data breaches. Free, no spam.

Free, no spam. Unsubscribe anytime.