Have I Been Pwned
Have I Been Pwned · Developer tools
Check whether email addresses appear in data breaches
The client pastes their API key from Have I Been Pwned's settings. We store it encrypted.
Tested against Have I Been Pwned's live API.
Building with Have I Been Pwned? The docs have setup steps and code for every tool.
Open the Have I Been Pwned docsTools
Your agent calls any endpoint of Have I Been Pwned's API with the request tool, with the client's access attached.
Base URL for request
https://haveibeenpwned.com/api/v3
request
HTTPS ANY /v1/clients/{clientId}/haveibeenpwned/{path}
Any endpoint of Have I Been Pwned's own API, with the client's access attached.
- servicestringrequired
- This service: haveibeenpwned
- methodstringrequired
- GET, POST, PUT, PATCH or DELETE
- pathstringrequired
- The path under https://haveibeenpwned.com/api/v3
- queryobjectoptional
- Query parameters
- bodyobjectoptional
- A JSON body
Over MCP every tool also takes client_id, from list_clients. Over HTTPS send it as clientId to https://api.operate.as/v1.
What the client approves
- Use the Have I Been Pwned key you paste, with only the access you gave that key
Get started
Send your next client one link
Add a client, select the services, copy the link. You'll get an email the moment their access is ready. Start free, no card required. Paid plans are one flat monthly price, and a busy month never takes your agents offline.