Monitor
Daily exposure monitoring for domains you own and people you name. Three layers: employees on your systems and elsewhere (DNS-verified company domain), and users of your app (licensed app login host, e.g. app.acme.com). Alerts report where credentials appeared — never passwords. No auto-enroll.
Returns monitor settings, per-domain layer counts (employees on your systems, employees elsewhere, users of your app) with breach locations, and enrolled people (emails masked). Never returns passwords or usernames.
Workspace secret key (sk_test_… / sk_live_…). Prefer test keys in these docs. Create keys in the console — never commit real values.
In: header
Header Parameters
Optional client correlation id. Echoed on the response; minted when omitted.
8 <= length <= 128Response Body
application/json
application/problem+json
application/problem+json
curl -X GET "https://example.com/api/v1/monitor"{ "monitorEnabled": true, "monitorStealer": true, "monitorDomainExposure": true, "lastRunAt": "2019-08-24T14:15:22Z", "domains": [ { "domain": "string", "role": "company", "layers": { "employeeOnSystem": { "count": 0, "baseline": 0 }, "employeeElsewhere": { "count": 0, "baseline": 0 }, "platformUser": { "count": 0, "baseline": 0 }, "corpus": { "count": 0, "baseline": 0 } }, "breachLocations": [ { "layer": "employee_on_system", "domain": "string", "source": "string" } ], "lastCheckedAt": "2019-08-24T14:15:22Z", "lastAlertedAt": "2019-08-24T14:15:22Z" } ], "identities": [ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "emailMasked": "string", "emailDomain": "string", "userId": "string", "audience": "employee", "status": "active", "enrolledAt": "2019-08-24T14:15:22Z", "breachHits": 0, "credentialLogHits": 0, "breachLocations": [ "string" ], "firstSeenInLogsAt": "2019-08-24T14:15:22Z", "lastSeenInLogsAt": "2019-08-24T14:15:22Z", "lastCheckedAt": "2019-08-24T14:15:22Z", "lastAlertedAt": "2019-08-24T14:15:22Z" } ]}Watch specific employees or customers by email. Requires a live secret key (sk_live_…). Set audience to say who each person is.
Workspace secret key (sk_test_… / sk_live_…). Prefer test keys in these docs. Create keys in the console — never commit real values.
In: header
Header Parameters
Optional client correlation id. Echoed on the response; minted when omitted.
8 <= length <= 128Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Enroll specific people to watch. Say who each one is: employee (staff) or customer (end user of your app). No auto-enroll.
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X POST "https://example.com/api/v1/monitor" \ -H "Content-Type: application/json" \ -d '{ "email": "alex@acme.com", "audience": "employee" }'{ "ok": true, "results": [ { "emailMasked": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "ok": true, "error": "string" } ]}Workspace secret key (sk_test_… / sk_live_…). Prefer test keys in these docs. Create keys in the console — never commit real values.
In: header
Header Parameters
Optional client correlation id. Echoed on the response; minted when omitted.
8 <= length <= 128Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/problem+json
application/problem+json
curl -X PATCH "https://example.com/api/v1/monitor" \ -H "Content-Type: application/json" \ -d '{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "status": "active" }'{ "ok": true}