Endpoint catalogue, privacy & notes

Frammenti di codice

curl "https://api.oanor.com/pwned-api/v1/meta" \
  -H "x-oanor-key: oanor_test_..."

await fetch("https://api.oanor.com/pwned-api/v1/meta", {
  headers: { "x-oanor-key": "oanor_test_..." }
});

$ch = curl_init("https://api.oanor.com/pwned-api/v1/meta");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-oanor-key: oanor_test_..."]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$out = curl_exec($ch);

import requests
requests.get(
    "https://api.oanor.com/pwned-api/v1/meta",
    headers={"x-oanor-key": "oanor_test_..."}
)

Risposta di esempio

Una risposta reale di questo endpoint, acquisita dall'ultimo health check.

{
    "data": {
        "note": "Pwned Passwords lets you check whether a password has appeared in known data breaches (over 800 million unique breached passwords), so you can block compromised credentials. /v1/check?password=… tells you if a password has been breached and how many times — the password is SHA-1 hashed in memory, only the first 5 hash characters are sent to HIBP (k-anonymity), and the password is never stored or logged; you can instead pass sha1=<40-hex SHA-1> to avoid sending the password at all. /v1/range?prefix=5BAA6 returns the raw k-anonymity range — every breached SHA-1 suffix beginning with that 5-character prefix and its breach count — so you can do the matching entirely on your own side (the recommended zero-exposure flow). Data from Have I Been Pwned (Troy Hunt), CC BY 4.0. A breach / credential-security resource — distinct from password generators, cryptographic hashing and bcrypt. Ideal for sign-up, password-reset and account-security flows (NIST 800-63b breached-password screening).",
        "source": "Have I Been Pwned — Pwned Passwords (api.pwnedpasswords.com)",
        "privacy": "k-anonymity: only the first 5 characters of a SHA-1 hash are ever sent to HIBP. Passwords passed to /v1/check are hashed in memory and never stored or logged; for zero exposure use /v1/range and match client-side.",
        "endpoints": [
            "/v1/check",
            "/v1/range",
            "/v1/meta"
        ]
    },
    "meta": {
        "timestamp": "2026-06-01T16:22:52.341Z",
        "request_id": "e69b7d73-5223-4098-ba66-264f77f80941"
    },
    "status": "ok",
    "message": "Meta retrieved",
    "success": true
}