Currently, HIBP offers a "Get all breached email addresses for a domain" API endpoint and a "Get all pastes for an account" endpoint, but no endpoint exists to search for all pastes for a domain.

The domain search API endpoint is incredibly efficient (especially for enterprise customers), but it does not return known pastes for each account. This can be very painful for multiple reasons (not limited to):

1.) Just because an account has NOT been seen in a third-party breach tracked by HIBP does NOT mean it hasn't been seen in a paste. This means we are seeing an incomplete picture of what HIBP knows about accounts in a given domain

2.) At scale, querying all of a domain's accounts one-by-one via the "Get all pastes for an account" endpoint can be a very time-consuming task, especially for domains with tens of thousands of accounts. For users with lower-tier API plans, querying tens of thousands of accounts can take 16 hours at minimum, assuming 10K accounts and the "Pwned 1" (10RPM) subscription

3.) Some users might have opsec concerns re: using HIBP to query ALL their domain accounts one-by-one versus asking HIBP to reveal what it already knows about its domain(s)