Cyber Threat Intelligence (CTI)
Email breaches, compromised employee/client/payment credentials, compromised devices, threat actors and security news relevant to your organization.
- Base URL
https://api.deepinfo.com/v1
Email Breaches
Public data breaches that include email addresses on your domains.
| Method | Endpoint | Path |
|---|---|---|
| GET | Breached Account List/cti/email-breaches/accountsLists your breached email accounts. Filter and sort with the optional query parameters. | /cti/email-breaches/accounts |
| GET | Email Breach List/cti/email-breaches/breachesLists breaches that include your email addresses. Filter and sort with the optional query parameters. | /cti/email-breaches/breaches |
| GET | Breached Account Detail/cti/email-breaches/accounts/{account_id}Returns one breached account and its breaches. | /cti/email-breaches/accounts/{account_id} |
| GET | Email Breach Detail/cti/email-breaches/breaches/{breach_id}Returns one breach: date, description, data types and affected accounts count. | /cti/email-breaches/breaches/{breach_id} |
| GET | Email Breach Account Titles/cti/email-breaches/account-titlesLists the job titles set on breached accounts. | /cti/email-breaches/account-titles |
| GET | Email Breach Data Types/cti/email-breaches/data-typesLists every data type (kind of exposed data) found in breaches. | /cti/email-breaches/data-types |
| GET | Latest Email Breaches/cti/email-breaches/breaches/latestLists the most recent breaches affecting you. | /cti/email-breaches/breaches/latest |
| GET | Breached Account Stats/cti/email-breaches/accounts/{account_id}/statsBreach statistics for one account. | /cti/email-breaches/accounts/{account_id}/stats |
| GET | Breached Accounts Domain Stats/cti/email-breaches/accounts/stats/domainBreached account counts per domain. | /cti/email-breaches/accounts/stats/domain |
| GET | Email Breach Stats/cti/email-breaches/breaches/statsBreach statistics. | /cti/email-breaches/breaches/stats |
| PUT | Breached Account Update/cti/email-breaches/accounts/{account_id}Updates a breached account's profile with the fields in the request body. | /cti/email-breaches/accounts/{account_id} |
Compromised Employee Accounts
Employee accounts found in leaked credential data.
| Method | Endpoint | Path |
|---|---|---|
| POST | Compromised Employee Account Search/cti/compromised-employee-accounts/searchSearches employee accounts found in leaked credentials. | /cti/compromised-employee-accounts/search |
| POST | Compromised Employee Account Export/cti/compromised-employee-accounts/search:exportExports every record matching filters (no pagination). format=csv returns CSV text; format=json returns a JSON array. Large exports can time out: narrow them with filters. | /cti/compromised-employee-accounts/search:export |
| GET | Compromised Employee Account Detail/cti/compromised-employee-accounts/{account_id}Returns one compromised employee account. | /cti/compromised-employee-accounts/{account_id} |
| GET | Compromised Employee Account Risk Distribution Stats/cti/compromised-employee-accounts/stats/risk-distributionDistribution of compromised employee accounts by risk. | /cti/compromised-employee-accounts/stats/risk-distribution |
| GET | Compromised Employee Accounts Domain Stats/cti/compromised-employee-accounts/stats/domainCompromised employee account counts per domain. | /cti/compromised-employee-accounts/stats/domain |
| PUT | Compromised Employee Account Update/cti/compromised-employee-accounts/{account_id}Updates an account's profile with the fields in the request body. | /cti/compromised-employee-accounts/{account_id} |
Compromised Employee Credentials
Leaked credentials of your employees.
| Method | Endpoint | Path |
|---|---|---|
| POST | Compromised Employee Credential Search/cti/compromised-employee-credentials/searchSearches leaked employee credentials and their state. | /cti/compromised-employee-credentials/search |
| POST | Compromised Employee Credential Export/cti/compromised-employee-credentials/search:exportExports every record matching filters (no pagination). format=csv returns CSV text; format=json returns a JSON array. Large exports can time out: narrow them with filters. | /cti/compromised-employee-credentials/search:export |
| POST | Compromised Employee Credential Accept Risk/cti/compromised-employee-credentials/search:accept-riskAccepts the risk of the compromised employee credentials that match filters (risk_accepted). | /cti/compromised-employee-credentials/search:accept-risk |
| POST | Compromised Employee Credential Ignore/cti/compromised-employee-credentials/search:ignoreIgnores the compromised employee credentials that match filters (ignored). | /cti/compromised-employee-credentials/search:ignore |
| POST | Compromised Employee Credential Mark False Positive/cti/compromised-employee-credentials/search:mark-false-positiveMarks the compromised employee credentials that match filters as false positive (marked_as_false_positive). | /cti/compromised-employee-credentials/search:mark-false-positive |
| POST | Compromised Employee Credential Mark Resolved/cti/compromised-employee-credentials/search:mark-resolvedMarks the compromised employee credentials that match filters as resolved (marked_as_resolved). | /cti/compromised-employee-credentials/search:mark-resolved |
| POST | Compromised Employee Credential Revert/cti/compromised-employee-credentials/search:revertReverts the compromised employee credentials that match filters to their previous, active state. Only states set by a user can be reverted. | /cti/compromised-employee-credentials/search:revert |
| GET | Compromised Employee Credential Exposure Timeline/cti/compromised-employee-credentials/stats/exposure-timelineTime series of newly exposed employee credentials. | /cti/compromised-employee-credentials/stats/exposure-timeline |
| GET | Compromised Employee Credential Stats/cti/compromised-employee-credentials/statsCompromised employee credential statistics. | /cti/compromised-employee-credentials/stats |
| GET | Compromised Employee Credential Status Stats/cti/compromised-employee-credentials/stats/statusCompromised employee credential counts per state. | /cti/compromised-employee-credentials/stats/status |
Compromised Client Credentials
Leaked credentials of your customers on your services.
| Method | Endpoint | Path |
|---|---|---|
| POST | Compromised Client Credential Search/cti/compromised-client-credentials/searchSearches leaked credentials of your customers and their state. | /cti/compromised-client-credentials/search |
| POST | Compromised Client Credential Export/cti/compromised-client-credentials/search:exportExports every record matching filters (no pagination). format=csv returns CSV text; format=json returns a JSON array. Large exports can time out: narrow them with filters. | /cti/compromised-client-credentials/search:export |
| POST | Compromised Client Credential Accept Risk/cti/compromised-client-credentials/search:accept-riskAccepts the risk of the compromised client credentials that match filters (risk_accepted). | /cti/compromised-client-credentials/search:accept-risk |
| POST | Compromised Client Credential Ignore/cti/compromised-client-credentials/search:ignoreIgnores the compromised client credentials that match filters (ignored). | /cti/compromised-client-credentials/search:ignore |
| POST | Compromised Client Credential Mark False Positive/cti/compromised-client-credentials/search:mark-false-positiveMarks the compromised client credentials that match filters as false positive (marked_as_false_positive). | /cti/compromised-client-credentials/search:mark-false-positive |
| POST | Compromised Client Credential Mark Resolved/cti/compromised-client-credentials/search:mark-resolvedMarks the compromised client credentials that match filters as resolved (marked_as_resolved). | /cti/compromised-client-credentials/search:mark-resolved |
| POST | Compromised Client Credential Revert/cti/compromised-client-credentials/search:revertReverts the compromised client credentials that match filters to their previous, active state. Only states set by a user can be reverted. | /cti/compromised-client-credentials/search:revert |
| GET | Compromised Client Credential Stats/cti/compromised-client-credentials/statsCompromised client credential statistics. | /cti/compromised-client-credentials/stats |
Compromised Payment Credentials
Leaked payment card data related to your organization.
| Method | Endpoint | Path |
|---|---|---|
| POST | Compromised Payment Credential Search/cti/compromised-payment-credentials/searchSearches leaked payment cards and their state. | /cti/compromised-payment-credentials/search |
| POST | Compromised Payment Credential Export/cti/compromised-payment-credentials/search:exportExports every record matching filters (no pagination). format=csv returns CSV text; format=json returns a JSON array. Large exports can time out: narrow them with filters. | /cti/compromised-payment-credentials/search:export |
| GET | Compromised Payment Credential Detail/cti/compromised-payment-credentials/{credential_id}Returns one compromised payment credential. | /cti/compromised-payment-credentials/{credential_id} |
| POST | Compromised Payment Credential Accept Risk/cti/compromised-payment-credentials/search:accept-riskAccepts the risk of the compromised payment credentials that match filters (risk_accepted). | /cti/compromised-payment-credentials/search:accept-risk |
| POST | Compromised Payment Credential Ignore/cti/compromised-payment-credentials/search:ignoreIgnores the compromised payment credentials that match filters (ignored). | /cti/compromised-payment-credentials/search:ignore |
| POST | Compromised Payment Credential Mark False Positive/cti/compromised-payment-credentials/search:mark-false-positiveMarks the compromised payment credentials that match filters as false positive (marked_as_false_positive). | /cti/compromised-payment-credentials/search:mark-false-positive |
| POST | Compromised Payment Credential Mark Resolved/cti/compromised-payment-credentials/search:mark-resolvedMarks the compromised payment credentials that match filters as resolved (marked_as_resolved). | /cti/compromised-payment-credentials/search:mark-resolved |
| POST | Compromised Payment Credential Revert/cti/compromised-payment-credentials/search:revertReverts the compromised payment credentials that match filters to their previous, active state. Only states set by a user can be reverted. | /cti/compromised-payment-credentials/search:revert |
| GET | Compromised Payment Credential Stats/cti/compromised-payment-credentials/statsCompromised payment credential statistics. | /cti/compromised-payment-credentials/stats |
Compromised Devices
Infected devices (infostealer logs) linked to your employees.
| Method | Endpoint | Path |
|---|---|---|
| POST | Compromised Device Search/cti/compromised-devicesSearches compromised (infostealer-infected) devices linked to your employees. | /cti/compromised-devices |
| GET | Compromised Device Detail/cti/compromised-devices/{compromised_employee_device_id}Returns one compromised device. | /cti/compromised-devices/{compromised_employee_device_id} |
Threat Actors
Threat actors and what they target.
| Method | Endpoint | Path |
|---|---|---|
| POST | Threat Actor Search/cti/threat-actors/searchSearches threat actors. | /cti/threat-actors/search |
| GET | Threat Actor Detail/cti/threat-actors/{threat_actor_id}Returns one threat actor profile. | /cti/threat-actors/{threat_actor_id} |
| GET | Most Actor Hosting Countries by Threat Actors/cti/threat-actors/stats/most-actor-hosting-countriesCountries hosting the most threat actors. | /cti/threat-actors/stats/most-actor-hosting-countries |
| GET | Most Targeted Countries by Threat Actors/cti/threat-actors/stats/most-targeted-countriesCountries most targeted by threat actors (size: number of rows). | /cti/threat-actors/stats/most-targeted-countries |
| GET | Most Targeted Industries by Threat Actors/cti/threat-actors/stats/most-targeted-industriesIndustries most targeted by threat actors. | /cti/threat-actors/stats/most-targeted-industries |
| GET | Most Targeted Organizations by Threat Actors/cti/threat-actors/stats/most-targeted-organizationsOrganizations most targeted by threat actors. | /cti/threat-actors/stats/most-targeted-organizations |
| GET | Most Used CVEs by Threat Actors/cti/threat-actors/stats/most-used-cvesCVEs most used by threat actors. | /cti/threat-actors/stats/most-used-cves |
| GET | Most Used Tools by Threat Actors/cti/threat-actors/stats/most-used-toolsTools most used by threat actors. | /cti/threat-actors/stats/most-used-tools |
Security News
Curated cybersecurity news.
| Method | Endpoint | Path |
|---|---|---|
| POST | Security News Search/cti/news/searchSearches curated cybersecurity news. | /cti/news/search |
| GET | Security News Detail/cti/news/{id}Returns one news item. | /cti/news/{id} |