# Email Breach Checker — Structured Reports (`khadinakbar/email-breach-checker`) Actor

Check 1–50 authorized email addresses for known breach exposure. Receive one structured report per completed address with breach names, dates, affected domains, exposed data classes, source attribution, checked time, and terminal outcomes. Managed access means callers provide no external API key.

- **URL**: https://apify.com/khadinakbar/email-breach-checker.md
- **Developed by:** [Khadin Akbar](https://apify.com/khadinakbar) (community)
- **Categories:** Developer tools, Automation, AI
- **Stats:** 2 total users, 1 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $10.00 / 1,000 email breach checks

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Email Breach Checker — Structured Exposure Reports

Check 1–50 email addresses you own or are authorized to investigate for known breach exposure. The Actor returns one structured dataset record per completed address with breach names, dates, affected domains, exposed data classes, account counts, source attribution, and the time of the check. Managed access is included, so callers provide no external API key.

### Best fit for this Actor

- Use it for internal security reviews, incident-response triage, and scheduled checks of approved operational mailboxes.
- Choose the default verified-only setting for a conservative report, or include unverified breach records when the investigation calls for broader context.
- Start with a focused mailbox list and retain `checkedAt` with each security decision because breach coverage changes over time.

### Focused standalone workflow

This Actor works as a focused standalone workflow for email breach exposure checks. Its output is ready for security dashboards, audit records, alerts, spreadsheets, and downstream automation.

### From an approved mailbox list to a security decision

A security owner starts with the organization’s approved support, billing, and administrator addresses. They submit the list with a bounded event-spend cap, then review `breached`, `breachCount`, `exposedDataClasses`, and the dated entries in `breaches`. Password-related exposure can trigger credential rotation and session review, while a clean report remains a useful time-bounded observation for the audit record.

### Quick start input

```json
{
  "emails": [
    "security@example.com",
    "it@example.com"
  ],
  "includeUnverified": false,
  "maxRunCostUsd": 0.02
}
```

Addresses are trimmed, lowercased, and deduplicated before lookup. The batch limit is 50 unique addresses.

### Input reference

| Field | Type | What it controls |
| --- | --- | --- |
| `emails` | array of strings | One to 50 complete email addresses, such as `security@example.com`, that the requester owns or is authorized to investigate. |
| `includeUnverified` | boolean | Includes unverified breach entries when `true`. The default `false` keeps the report focused on verified, non-sensitive, active records. |
| `maxRunCostUsd` | number | Caps Pay per event spending for completed email reports. Apify platform usage is reported separately. |

### What data you receive

One dataset item represents one completed email lookup. A clean address still produces a record with `breached: false`, `breachCount: 0`, and an empty `breaches` array.

| Field | Meaning |
| --- | --- |
| `email` | Normalized address checked in this record. |
| `breached` | `true` when at least one included breach record is present. |
| `breachCount` | Number of included breach records for the address. |
| `exposedDataClasses` | Unique exposed-data categories across the included breaches. |
| `breaches` | Structured breach names, titles, domains, dates, affected-account counts, data classes, and verification flags. |
| `provider` | Source attribution attached to the report. |
| `sourceUrl` | Source documentation or attribution URL. |
| `checkedAt` | ISO 8601 timestamp for this time-bounded observation. |

Illustrative schema-valid item:

```json
{
  "email": "security@example.com",
  "breached": true,
  "breachCount": 1,
  "exposedDataClasses": [
    "Email addresses",
    "Passwords"
  ],
  "breaches": [
    {
      "name": "ExampleBreach",
      "title": "Example Breach",
      "domain": "example.com",
      "breachDate": "2020-01-01",
      "addedDate": "2020-02-01T00:00:00Z",
      "modifiedDate": "2020-02-01T00:00:00Z",
      "pwnCount": 1000000,
      "dataClasses": [
        "Email addresses",
        "Passwords"
      ],
      "isVerified": true,
      "isSensitive": false,
      "isRetired": false,
      "isSpamList": false
    }
  ],
  "provider": "<source attribution>",
  "sourceUrl": "https://example.com/source-attribution",
  "checkedAt": "2026-01-01T00:00:00.000Z"
}
```

The Actor stores normalized breach metadata and terminal diagnostics. Submitted passwords, password hashes, external credentials, authorization headers, and raw source responses stay outside the dataset and terminal records.

### Outcomes and readback

Every execution writes the dataset plus two key-value-store records: `OUTPUT` for compact automation decisions and `RUN_SUMMARY` for detailed counts, warnings, billing totals, and continuation context.

| Outcome | Meaning |
| --- | --- |
| `COMPLETE` | Every requested address produced a persisted report. |
| `PARTIAL` | Useful reports were persisted; `RUN_SUMMARY` identifies completed work and remaining warnings. |
| `VALID_EMPTY` | A valid workflow completed without a dataset entity; ordinary clean email checks still produce persisted reports. |
| `INVALID_INPUT` | The supplied address list needs a complete email format or an allowed batch size. |
| `CONFIG_ERROR` | Managed source access needs owner configuration before the lookup can continue. |
| `UPSTREAM_FAILED` | The source route produced no usable report after bounded attempts. |

Use `OUTPUT.outcome` as the automation branch, then read the complete dataset and `RUN_SUMMARY` before acting on the result. A successful Apify status alone represents execution state; the terminal records carry the business outcome.

### Pricing

This Actor uses Pay per event plus Apify platform usage. Each completed, persisted email report creates one `email-breach-check` event, including a clean report, and the start event covers initialization. Set `maxRunCostUsd` to bound report-event spending; Apify platform usage remains a separate line item. Open the live Actor Pricing tab for the current event rates and platform-usage terms.

Event-cost formula:

```text
completed reports × email-breach-check event rate + Actor start event
```

### Use through the API

Start an execution with the real Actor slug:

```bash
curl -X POST "https://api.apify.com/v2/acts/khadinakbar~email-breach-checker/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "emails": ["security@example.com"],
    "includeUnverified": false,
    "maxRunCostUsd": 0.01
  }'
```

Use the returned `defaultDatasetId` to retrieve every report:

```bash
curl -H "Authorization: Bearer $APIFY_TOKEN" \
  "https://api.apify.com/v2/datasets/$DATASET_ID/items?clean=true&format=json"
```

For multi-address batches, paginate the dataset until every persisted report has been read.

### Use with AI agents through Apify MCP

Configure the Actor through `https://mcp.apify.com`, then give the agent a bounded, authorized objective:

> Check these authorized operational email addresses for known breach exposure. Keep `includeUnverified` false, cap report-event cost with `maxRunCostUsd`, read `OUTPUT`, `RUN_SUMMARY`, and the complete dataset, then return `breached`, `breachCount`, `exposedDataClasses`, breach dates, source URL provenance, and `checkedAt`. State the terminal outcome and paginate when the dataset preview is incomplete.

The Actor performs a read-only lookup and writes results only to its Apify dataset and key-value store. Agents can use `OUTPUT.outcome` for branching and `sourceUrl` plus `checkedAt` for provenance.

### Best results

- Provide complete email addresses from an approved scope and keep each batch focused on one review or incident.
- Start with `includeUnverified: false`; enable it when broader investigative context is useful.
- Set `maxRunCostUsd` before execution so automation has a clear report-event boundary.
- Preserve `checkedAt` and `sourceUrl` when exporting findings because every report is a dated observation.
- Confirm `OUTPUT.outcome`, read `RUN_SUMMARY`, and retrieve the full dataset before starting remediation.

### Responsible use

Submit only addresses you own or are explicitly authorized to investigate. Handle email addresses and resulting security observations under applicable law, organizational policy, retention rules, and disclosure requirements. Treat each result as decision support for a qualified security review.

### Builder's note

I designed the data contract around one complete, normalized record per checked address. I found that this makes clean and breached results equally useful in automation: both carry a timestamp, source attribution, billing unit, and terminal context, while detailed breach entries remain easy to filter by date, domain, verification status, or exposed data class.

# Actor input Schema

## `emails` (type: `array`):

Use this list for email addresses you own or are authorized to investigate. Enter complete addresses such as security@example.com. The Actor lowercases and deduplicates 1–50 entries. This field accepts email addresses rather than usernames, domains, or passwords.

## `includeUnverified` (type: `boolean`):

Use this option when broader investigative context should include unverified breach entries. Set true to include them or false to keep the conservative verified-only view. The default is false. Sensitive and retired entries remain excluded from returned reports.

## `maxRunCostUsd` (type: `number`):

Use this amount to cap Pay per event spending for completed email reports. Enter a USD value such as 0.10. The default 0.50 covers the full 50-address batch at the current event rate. Apify platform usage is calculated and reported separately.

## Actor input object example

```json
{
  "emails": [
    "security@example.com",
    "it@example.com"
  ],
  "includeUnverified": false,
  "maxRunCostUsd": 0.1
}
```

# Actor output Schema

## `emailReports` (type: `string`):

One normalized breach-status report per completed authorized email check.

## `compactOutput` (type: `string`):

Stable machine-readable outcome, counts, charge totals, and warnings.

## `runSummary` (type: `string`):

Detailed run outcome, lookup attempts, event counts, warnings, and safe diagnostics.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "emails": [
        "security@example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("khadinakbar/email-breach-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "emails": ["security@example.com"] }

# Run the Actor and wait for it to finish
run = client.actor("khadinakbar/email-breach-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "emails": [
    "security@example.com"
  ]
}' |
apify call khadinakbar/email-breach-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,khadinakbar/email-breach-checker"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/tBAgOXVGh483NTaVO/builds/jsqylw9HrjSbHEwjf/openapi.json