Guillaume BOURGEOIS
2a1eb73115
HIBP API v3 + Pwned Passwords, 6 commands: account breaches/pastes, list/get breach, password pwned check (k-anonymity, password never transmitted). API-key auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
73 lines
2.6 KiB
YAML
73 lines
2.6 KiB
YAML
id: hibp
|
|
name: Have I Been Pwned
|
|
version: 1.0.0
|
|
description: "Have I Been Pwned (API v3 + Pwned Passwords) — breach enrichment: check an email for breaches and pastes, list and read breaches, and check whether a password appears in breaches (k-anonymity, password never sent). API-key authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: account breaches/pastes, list/get breach, password pwned check."
|
|
category: enrichment
|
|
|
|
# Per-instance configuration. The API key is sent as the 'hibp-api-key' header
|
|
# (required for account lookups). A User-Agent is always sent, as HIBP requires.
|
|
config_schema:
|
|
properties:
|
|
api_key:
|
|
type: string
|
|
description: "Have I Been Pwned API key"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- api_key
|
|
|
|
commands:
|
|
- id: account_breaches
|
|
name: hibp-account-breaches
|
|
description: "Get the breaches an email address appears in."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
email: { type: string, description: "Email address to check" }
|
|
required: [email]
|
|
outputs_schema: { properties: {} }
|
|
- id: account_pastes
|
|
name: hibp-account-pastes
|
|
description: "Get the pastes an email address appears in."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
email: { type: string, description: "Email address to check" }
|
|
required: [email]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_breaches
|
|
name: hibp-list-breaches
|
|
description: "List all breaches in the system (optionally filtered by domain)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
domain: { type: string, description: "Optional domain filter" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_breach
|
|
name: hibp-get-breach
|
|
description: "Get the details of a single breach by name."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
name: { type: string, description: "Breach name (e.g. Adobe)" }
|
|
required: [name]
|
|
outputs_schema: { properties: {} }
|
|
- id: password_pwned
|
|
name: hibp-password-pwned
|
|
description: "Check whether a password appears in known breaches (via k-anonymity; the password itself is never transmitted)."
|
|
inputs_schema:
|
|
properties:
|
|
password: { type: string, description: "The password to check" }
|
|
required: [password]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: hibp-test-connection
|
|
description: "Verify the API key (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|