Request
Supported types are
username, name, email, hostname, mac_address, ip_address, org_alias, bin, cve, domain, password, hashed_password, vin, address, and phone.
Filter by date added
from and to filter on when FullHunt indexed the record (date_added), not on the breach date. Either can be sent alone. Dates are day-first; DD/MM/YYYY is also accepted. An unparseable date, or from after to, returns 400.
For domain queries, a date filter is answered from already-indexed records only, with no live refresh. For other types, results come from a live lookup and are stamped with today’s date, so a range that excludes today returns nothing.
cve query can return vulnerability intelligence rather than credential records.
Data controls
- Do not display or log raw passwords.
- Hashes can still be sensitive and should be access-controlled.
- Do not use returned credentials to access another service.
- Store source, breach date, ingestion date, tenant, and incident disposition.
- Apply retention and deletion requirements before enabling collection.
- Restrict free-form searches that could retrieve unrelated personal data.
404 response means no result was returned for the query; it does not prove that no exposure exists.