Searches across breach databases for leaked credentials and data.
Response fields vary depending on the breach source. Common fields include:
email, username, password, ip, domain, source, date, dbnamePagination: Use nextCursorMark as cursor for next page.
API key for authentication (lowercase header name)
Search query (email, username, domain, etc.)
Pagination cursor from previous response
Search session ID from /service/search/init
Filter to specific breach databases (comma-separated or single)