Recorded Future Identity API

https://docs.recordedfuture.com/reference/identity-password
Admin
Recorded Future Identity API is a service that checks if passwords have been exposed in breach data...
Tokens:1,443
Snippets:11
Trust Score:9.7
Update:5 months ago
Show doc for...
Tokens:
Raw
### Authentication and Server Information

Source: https://docs.recordedfuture.com/reference/identity-password

This section details the authentication mechanisms and server endpoints for the Recorded Future API. It includes information on API key usage and the production server URL.

```APIDOC
## Authentication

### API Key

Recorded Future API uses an API key for authentication. The key should be provided in the `X-RFToken` header.

### Server Information

- **Production Server:** `https://api.recordedfuture.com`
```

--------------------------------

### Password Lookup

Source: https://docs.recordedfuture.com/reference/identity-password

This endpoint allows you to look up the exposure status of multiple passwords.

```APIDOC
## POST /password/lookup

### Description
Looks up the exposure status of a list of passwords.

### Method
POST

### Endpoint
/password/lookup

### Parameters
#### Request Body
- **passwords** (array) - Required - A list of password hashes to look up.
  - **password** (object) - Required - The password hash object.
    - **algorithm** (string) - Required - The hashing algorithm used.
    - **hash_prefix** (string) - Required - The hash prefix of the password.

### Request Example
{
  "passwords": [
    {
      "password": {
        "algorithm": "SHA256",
        "hash_prefix": "5baa61e4c9b93f0f0474f3c66360385a5d74fffd"
      }
    }
  ]
}

### Response
#### Success Response (200)
- **results** (array) - A list of lookup results for each password.
  - **password** (object) - The password hash object.
    - **algorithm** (string) - The hashing algorithm used.
    - **hash_prefix** (string) - The hash prefix of the password.
  - **exposure_status** (string) - The exposure status of the password (NeverExposed, Uncommon, Common).

#### Response Example
{
  "results": [
    {
      "password": {
        "algorithm": "SHA256",
        "hash_prefix": "5baa61e4c9b93f0f0474f3c66360385a5d74fffd"
      },
      "exposure_status": "Common"
    }
  ]
}
```

--------------------------------

### Password Exposure Lookup

Source: https://docs.recordedfuture.com/reference/identity-password

Checks whether specific passwords have appeared in any breach data or stealer malware logs indexed by Identity Intelligence, without associating them to any identity or domain. Submit passwords as cryptographic hashes (supporting SHA1, SHA256, MD5, NTLM, BCRYPT, and other algorithms) using either the full hash or a five-character hash prefix for privacy-preserving lookups following the k-anonymity model. Multiple passwords can be checked in a single request.

```APIDOC
## POST /password/lookup

### Description
Checks whether specific passwords have appeared in any breach data or stealer malware logs indexed by Identity Intelligence, without associating them to any identity or domain. Supports privacy-preserving lookups using full or prefix hashes.

### Method
POST

### Endpoint
/password/lookup

### Parameters
#### Request Body
- **hashes** (array of strings) - Required - A list of password hashes or hash prefixes to check.

### Request Example
```json
{
  "hashes": [
    "5d41402abc4b2a76b9719d911017c592",
    "0c40f1a"
  ]
}
```

### Response
#### Success Response (200)
- **hash** (string) - The submitted hash or prefix.
- **exposure_status** (string) - The exposure status: "Common", "ExposedMultipleTimes", "ExposedOnce", or "NeverExposed".

#### Response Example
```json
{
  "password_exposures": [
    {
      "hash": "5d41402abc4b2a76b9719d911017c592",
      "exposure_status": "ExposedMultipleTimes"
    },
    {
      "hash": "0c40f1a",
      "exposure_status": "Common"
    }
  ]
}
```
```

--------------------------------

### Lookup Passwords for Exposure

Source: https://docs.recordedfuture.com/reference/identity-password

Checks if specified passwords were exposed. This endpoint requires authentication and accepts a JSON request body containing the passwords to check.

```APIDOC
## POST /identity/password/lookup

### Description
Checks if specified passwords were exposed.

### Method
POST

### Endpoint
/identity/password/lookup

### Request Body
- **passwords** (array) - Required - A list of passwords to check for exposure.

### Request Example
{
  "passwords": [
    {
      "algorithm": "SHA256",
      "hash": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8"
    }
  ]
}

### Response
#### Success Response (200)
- **leaked_passwords** (array) - A list of passwords that were found to be exposed.
- **not_leaked_passwords** (array) - A list of passwords that were not found to be exposed.

#### Response Example
{
  "leaked_passwords": [
    {
      "algorithm": "SHA256",
      "hash": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8"
    }
  ],
  "not_leaked_passwords": []
}
```
Tokens:
Raw