HEROIC API Reference (7.3.0)

HEROIC offers a powerful suite of enterprise-grade APIs designed to detect and investigate exposed data across billions of breach records. With tens of billions of compromised records indexed, the HEROIC API allows you to search and retrieve breach data across multiple identity types and sources.

To use the HEROIC API, you must have an active HEROIC Enterprise Account. Click here to sign up.

Base URL

The Base URL for our APIs is https://api.heroic.com/v7

Obtaining the API key

To obtain a key:

• Log into your HEROIC Enterprise account.
• Go to API Key Management.
• Create or manage your API keys.

Authentication

All requests must include an API key in the header: x-api-key: YOUR_API_KEY

Contact support@heroic.com for assistance.

HEROIC is committed to protecting sensitive personal information (PII) in all API responses. To ensure privacy and compliance, all PII fields such as credit card numbers, SSNs, and passwords are masked or redacted in the data returned by our APIs.

• Credit card numbers: Randomly masked to show up to 6 digits (e.g., 543210XXXXXX1234).
• SSNs: Only last 2 digits are visible (e.g., 123-456-78**).
• Passwords: Only last 2 characters are visible (e.g., admin@12**).

This masking ensures that sensitive data cannot be reconstructed or misused, while still allowing for effective breach investigation and analysis. If you require access to unmasked data for legitimate security or compliance reasons, please contact HEROIC support for more information on our data access policies.

The breach catalog includes general information about what was exposed, when the breach occurred, and what type of data was involved. It's useful for displaying or investigating breach events at a high level.

APIs for data breach search for accounts.

HEROIC's Credit Card Search API provides access to both legacy (free) and active (paid) stolen credit card data found across darknet markets and hacker forums. Free cards typically originate from older leaks and are useful for identifying previously compromised information, while paid cards are current, often functional, and marketed on underground platforms. HEROIC collects associated metadata such as BINs, expiration dates, issuing countries, prices, and seller reputations. Users can perform single BIN lookups, submit bulk queries, configure automated monitoring, and download results in formats including CSV, Excel, or JSON.

Search Capabilities and Limitations The API enables structured searches, including masked or SHA-256-hashed card numbers, owner names, CVV codes, and expiration dates. Users can apply advanced filters and syntax to refine results and maintain privacy. Monitoring options are available for ongoing updates. While powerful, the system is affected by common challenges—such as disappearing data, duplicate listings, low-quality or fake records, and the migration of card sales to newer platforms like Telegram and Discord. HEROIC continues to improve its scraping and detection capabilities, with regular updates and expanding coverage to adapt to the evolving threat landscape.

What types of credit cards are indexed by HEROIC? HEROIC tracks two primary categories of compromised credit card data uncovered across the deep and dark web:

• Free Cards – These are stolen credit card records that have been made publicly available without cost on underground forums and leak sites. While HEROIC's systems have cataloged millions of such entries, the majority are from older breaches and are typically no longer valid for transactions. You can explore this data through the database search feature in the HEROIC Control Center.
• Paid Cards – These are active, for-sale credit cards commonly listed on darknet marketplaces. Sold much like regular merchandise, these records are often fresh and functional, requiring a payment to access. HEROIC continuously scans and logs these listings to provide real-time intelligence on emerging threats.