# Pwned Password Check

Has this password appeared in a known breach? Send its SHA-1 hash — k-anonymity means only the first five characters ever leave — and get back how many times it has been seen.

- Method: `GET`
- Path: `/v1/security/pwned-password`

**Parameters**

| Name | Type | | Description |
|---|---|---|---|
| `hash` | string | required | The 40-character uppercase SHA-1 of the password to check. Never the password itself. |
| `max_age` | integer (seconds) | optional | Ask for data no older than this. Clamped to the product's own floor, so it can narrow the window but never force a refresh on every call. |

**Example request**

```bash
curl https://api.diraz.ae/v1/security/pwned-password \
  -H "Authorization: Bearer drz_live_…"
```

**Example response**

```json
{
  "data": {
    "prefix": "5BAA6",
    "suffix": "1E4C9B93F3F0682250B6CF8331B7EE68FD8",
    "count": 39566291,
    "pwned": true
  },
  "meta": {
    "request_id": "req_7Q2fK4mZ",
    "as_of": "2026-08-20T16:30:00.000Z",
    "age_seconds": 120,
    "next_update_at": "2026-08-20T17:00:00.000Z"
  }
}
```