VigicapConnector
Have I Been Pwned
API credential, entered client by client.
Public breach-notification service. Vigicap queries the client's domain and reads how many addresses appear in known breaches and across how many distinct incidents — never passwords, which this API does not expose. This connector proposes no ReCyF level: a breach measures past exposure, not a control in place. The domain must be verified on the HIBP account and the subscription must cover domain search.
01
What to create in the tool
The access is created in Have I Been Pwned, not in Vigicap. Vigicap never asks for an administrator's password: it expects an API credential that you create, that you can see, and that you can revoke without us.
Where to generate it
Créez une clé sur https://haveibeenpwned.com/API/Key avec un abonnement couvrant la recherche par domaine, puis vérifiez le domaine du client dans le tableau de bord HIBP (Domain search). Sans cette vérification, l'API répond 403 même avec une clé valide.
Minimum role
Une clé d'API Have I Been Pwned avec un abonnement permettant la recherche par domaine, et le domaine du client vérifié dans le tableau de bord HIBP. La clé ne donne accès qu'aux domaines vérifiés sur le compte qui la détient : elle ne peut pas interroger un domaine tiers.
Taken from the vendor's own role model, and checked before publication.
02
What to enter in Vigicap
The exact fields of the connection form, in the order they appear. Values marked “secret” never travel back to the browser: they are encrypted at rest and deleted on disconnection.
The form starts with the instance address, entered separately from the fields below. The public catalogue does not yet publish whether this connector needs one, or what it looks like — so this list is exact about everything else, and silent about that first field.
- Clé d'API HIBPsecret
Souscrite sur haveibeenpwned.com/API/Key, avec la recherche par domaine.
- Domaine du client
Doit être vérifié sur le compte HIBP qui détient la clé.
exemple.fr
03
Per-client routing
The connection is made client by client: one credential per client, entered on that client's record. Nothing is shared between two clients, and disconnecting one leaves the other untouched.
04
What it does, and what it does not do
ReCyF objectives it pre-fills
This connector feeds no ReCyF objective, and that is not a gap: it does not measure a client's posture.
Read-only
The reads are read-only: Vigicap writes nothing into the tool while reading it.
What is read, what is kept, for how long and with which rights: the same register, connector by connector, in the data inventory.
Verification
The API is public and documented, but it can only be reached with a paid subscription the vendor issues no trial for: there is no instance we can obtain to run it against. This is not “not yet done” — it would take a customer lending us their tenant.
The trademarks and logos mentioned belong to their respective owners and identify the tools Vigicap is compatible with — see the legal notice.