Compromised Employee Account Detail

GEThttps://api.deepinfo.com/v1/cti/compromised-employee-accounts/{account_id}

Returns one compromised employee account.

Example

Request

curl

curl 'https://api.deepinfo.com/v1/cti/compromised-employee-accounts/000000000000000ec9430001' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'

Python

import requests

url = "https://api.deepinfo.com/v1/cti/compromised-employee-accounts/000000000000000ec9430001"

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
}

response = requests.get(url, headers=headers)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/cti/compromised-employee-accounts/000000000000000ec9430001";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
  },
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.deepinfo.com/v1/cti/compromised-employee-accounts/000000000000000ec9430001", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/cti/compromised-employee-accounts/000000000000000ec9430001"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .GET()
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://api.deepinfo.com/v1/cti/compromised-employee-accounts/000000000000000ec9430001");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/cti/compromised-employee-accounts/000000000000000ec9430001',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/cti/compromised-employee-accounts/000000000000000ec9430001')

request = Net::HTTP::Get.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Response Body

{
  "id": "000000000000000ec9430001",
  "email": "user@acme.example",
  "domain": "acme.example",
  "is_executive": false,
  "first_name": null,
  "last_name": null,
  "title": null,
  "linkedin_url": null,
  "department": null,
  "security_profile": {
    "exposure": {
      "first_exposure_date": "2025-06-01T08:00:00Z",
      "last_exposure_date": "2025-07-31T08:00:00Z",
      "exposure_span_days": 60
    },
    "password_behavior": {
      "unique_password_count": 3,
      "avg_password_length": 9,
      "avg_strength_score": 44,
      "min_strength_score": 25,
      "max_strength_score": 62,
      "strength_distribution": {
        "very_weak": 1,
        "weak": 1,
        "medium": 1,
        "strong": 0,
        "very_strong": 0
      },
      "weak_password_percentage": 67
    },
    "reuse_analysis": {
      "password_reuse_count": 1,
      "password_reuse_percentage": 33
    },
    "composition": {
      "common_password_count": 0,
      "dictionary_word_count": 0,
      "keyboard_pattern_count": 0,
      "date_pattern_count": 0,
      "avg_character_classes": 3,
      "all_four_classes_percentage": 50,
      "dominant_structure": "********",
      "structure_variety_count": 1
    },
    "temporal": {
      "credential_timeline": [
        {
          "year": 2025,
          "month": 6,
          "count": 34
        },
        {
          "year": 2025,
          "month": 7,
          "count": 35
        }
      ],
      "exposure_velocity": 0.5,
      "exposure_accelerating": false,
      "days_since_last_exposure": 30
    }
  },
  "computed_state": "unresolved",
  "state_stats": {
    "total": 38,
    "active_count": 2,
    "inactive_count": 20,
    "unresolved_count": 33,
    "resolved_count": 13,
    "risk_accepted_count": 21,
    "ignored_count": 30,
    "false_positive_count": 38
  },
  "risk_score": 20,
  "risk_level": "low"
}

Content-Type: application/json
deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001

Request

curl

curl 'https://api.deepinfo.com/v1/cti/compromised-employee-accounts/ffffffffffffffffffffffff' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'

Python

import requests

url = "https://api.deepinfo.com/v1/cti/compromised-employee-accounts/ffffffffffffffffffffffff"

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
}

response = requests.get(url, headers=headers)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/cti/compromised-employee-accounts/ffffffffffffffffffffffff";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
  },
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.deepinfo.com/v1/cti/compromised-employee-accounts/ffffffffffffffffffffffff", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/cti/compromised-employee-accounts/ffffffffffffffffffffffff"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .GET()
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://api.deepinfo.com/v1/cti/compromised-employee-accounts/ffffffffffffffffffffffff");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/cti/compromised-employee-accounts/ffffffffffffffffffffffff',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/cti/compromised-employee-accounts/ffffffffffffffffffffffff')

request = Net::HTTP::Get.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

404 Not Found · application/json

Response Body

{
  "code": 30003,
  "details": [
    "Compromised Employee Account with id=ffffffffffffffffffffffff does not exist."
  ],
  "solution": "https://docs.deepinfo.com/reference/"
}

Content-Type: application/json
deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001

Authentication

Send your API key in the apikey request header.

Path Parameters

Parameter	Required	Description
`account_id`	Required	Example`000000000000000ec9430001`

Response Fields

Field	Type	Description
`id`	string
`email`	string
`domain`	string
`is_executive`	boolean
`first_name`	string
`last_name`	string
`title`	string
`linkedin_url`	string
`department`	string
`security_profile`	object
`computed_state`	string	One of `newly_detected`, `unresolved`, `marked_as_resolved`, `risk_accepted`, `ignored`, `marked_as_false_positive`, `not_applicable`, `verified_resolved`
`state_stats`	object
`risk_score`	integer
`risk_level`	string	One of `low`, `medium`, `high`, `critical`

Response Schema

Inferred from examples Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

Field	Type	Example
`id`	string	`"000000000000000ec9430001"`
`email`	string
`domain`	string	`"acme.example"`
`is_executive`	boolean	`false`
`first_name`	null
`last_name`	null
`title`	null
`linkedin_url`	null
`department`	null
`security_profile`	object
`security_profile.exposure`	object
`security_profile.exposure.first_exposure_date`	string	`"2025-06-01T08:00:00Z"`
`security_profile.exposure.last_exposure_date`	string	`"2025-07-31T08:00:00Z"`
`security_profile.exposure.exposure_span_days`	number	`60`
`security_profile.password_behavior`	object
`security_profile.password_behavior.unique_password_count`	number	`3`
`security_profile.password_behavior.avg_password_length`	number	`9`
`security_profile.password_behavior.avg_strength_score`	number	`44`
`security_profile.password_behavior.min_strength_score`	number	`25`
`security_profile.password_behavior.max_strength_score`	number	`62`
`security_profile.password_behavior.strength_distribution`	object
`security_profile.password_behavior.strength_distribution.very_weak`	number	`1`
`security_profile.password_behavior.strength_distribution.weak`	number	`1`
`security_profile.password_behavior.strength_distribution.medium`	number	`1`
`security_profile.password_behavior.strength_distribution.strong`	number	`0`
`security_profile.password_behavior.strength_distribution.very_strong`	number	`0`
`security_profile.password_behavior.weak_password_percentage`	number	`67`
`security_profile.reuse_analysis`	object
`security_profile.reuse_analysis.password_reuse_count`	number	`1`
`security_profile.reuse_analysis.password_reuse_percentage`	number	`33`
`security_profile.composition`	object
`security_profile.composition.common_password_count`	number	`0`
`security_profile.composition.dictionary_word_count`	number	`0`
`security_profile.composition.keyboard_pattern_count`	number	`0`
`security_profile.composition.date_pattern_count`	number	`0`
`security_profile.composition.avg_character_classes`	number	`3`
`security_profile.composition.all_four_classes_percentage`	number	`50`
`security_profile.composition.dominant_structure`	string
`security_profile.composition.structure_variety_count`	number	`1`
`security_profile.temporal`	object
`security_profile.temporal.credential_timeline`	array<object>
`security_profile.temporal.credential_timeline[].year`	number	`2025`
`security_profile.temporal.credential_timeline[].month`	number	`6`
`security_profile.temporal.credential_timeline[].count`	number	`34`
`security_profile.temporal.exposure_velocity`	number	`0.5`
`security_profile.temporal.exposure_accelerating`	boolean	`false`
`security_profile.temporal.days_since_last_exposure`	number	`30`
`computed_state`	string	`"unresolved"`
`state_stats`	object
`state_stats.total`	number	`38`
`state_stats.active_count`	number	`2`
`state_stats.inactive_count`	number	`20`
`state_stats.unresolved_count`	number	`33`
`state_stats.resolved_count`	number	`13`
`state_stats.risk_accepted_count`	number	`21`
`state_stats.ignored_count`	number	`30`
`state_stats.false_positive_count`	number	`38`
`risk_score`	number	`20`
`risk_level`	string	`"low"`

Examples

Selecting one loads it into the request and response panels.

Reference updated September 27, 2026