Email Breach Checker — Structured Exposure Reports

Check 1–50 email addresses that you own or are explicitly authorized to investigate. Each completed lookup writes one structured record with provider-reported breach names, available dates and metadata, source attribution, and a timestamp. Managed provider access is included; callers never supply an external API key.

When to use it

• Use it for approved security reviews, incident-response triage, and periodic checks of organization-controlled mailboxes.
• Do not use it to investigate people without authority, to collect passwords, or to make employment, credit, insurance, or other high-impact decisions.
• Treat a clean result as a dated observation: it is emitted only when the provider returns an explicit empty breach-history array. Missing provider coverage fails honestly instead of being labeled clean.

Input

{
  "emails": ["security@example.com", "it@example.com"],
  "includeUnverified": false,
  "maxRunCostUsd": 0.4
}

Field	Type	Meaning
emails	array	One to 50 complete, authorized email addresses. Entries are trimmed, lowercased, and deduplicated.
includeUnverified	boolean	Retained for compatibility. The managed provider does not expose verification-state filtering, so this does not alter returned results.
maxRunCostUsd	number	Caps event spend for persisted reports. The default is $10.00, covering 50 records at the documented $0.20 event rate; Apify platform usage is separate.

Output

Every completed email gets one dataset row. Provider metadata that is not returned is represented as null or an empty array, never inferred.

{
  "email": "security@example.com",
  "breached": true,
  "breachCount": 1,
  "exposedDataClasses": [],
  "breaches": [
    {
      "name": "ExampleBreach",
      "title": null,
      "domain": null,
      "breachDate": "2020-01-01",
      "addedDate": null,
      "modifiedDate": null,
      "pwnCount": null,
      "dataClasses": [],
      "isVerified": null,
      "isSensitive": null,
      "isRetired": null,
      "isSpamList": null
    }
  ],
  "provider": "Digital Footprint breach history via official API",
  "sourceUrl": "https://digifootprint.dev/email-enrichment-api",
  "checkedAt": "2026-09-05T12:00:00.000Z"
}

The dataset and terminal records never include submitted passwords, password hashes, provider credentials, authorization headers, or raw provider responses.

Outcomes

Each run writes both OUTPUT and RUN_SUMMARY.

Outcome	Meaning
COMPLETE	Every requested email produced a persisted report.
PARTIAL	At least one report was persisted, but another email stopped at a documented limit or provider issue.
INVALID_INPUT	The supplied email list or spending cap can be corrected by the caller.
CONFIG_ERROR	The owner-managed provider credential or credit balance needs attention.
UPSTREAM_FAILED	The provider could not return usable breach history for any requested email.

Read OUTPUT.outcome, then the full dataset and RUN_SUMMARY. An Apify SUCCEEDED status alone is not the business result.

Pricing

The Actor uses Pay per event plus Apify platform usage. One persisted report, including a clean report, creates one email-breach-check event. The candidate event rate is $0.20 per report, plus the $0.00005 Actor-start event and platform usage. Set maxRunCostUsd before running to cap report-event charges.

completed reports × $0.20 + $0.00005 Actor start + Apify platform usage

Always check the live Pricing tab before a production run; a public price increase may have an announced effective date.

API and MCP

curl -X POST "https://api.apify.com/v2/acts/khadinakbar~email-breach-checker/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"emails":["security@example.com"],"maxRunCostUsd":0.2}'

For an agent, use this bounded objective:

Check only these authorized operational email addresses for known breach history. Set a report-event cap, read OUTPUT, RUN_SUMMARY, and the full dataset, then report breached, breachCount, breach names, source URL, and checkedAt. Treat CONFIG_ERROR and UPSTREAM_FAILED as errors, not clean results.

Responsible use

Use only for lawful, authorized cybersecurity or safety purposes. Apply your organization’s data-retention, disclosure, and access-control rules to email addresses and breach observations. Results are decision support, not proof of compromise or a substitute for a qualified security review.