Calls & numbers

Has my number been leaked?

API · Pro2026-10-28

Coverage: Areas come from the official numbering plan of each edition’s country. Spain lists a province for every landline range; many other countries list their area codes and cities. Mobile numbers have no area in any country, and a few countries do not publish a plan we can read yet: there we only show the type of line.

Open tool

On this page

Purpose

Check whether your phone number appears in known data breaches. We show only the answer, never the breach details.

Requirements

Tool plan: Pro

Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.

Activate NoCall Pro to check whether your number appears in known data breaches.

Enter the full number with its international code. For a national number, first check the edition country or country selector.

How to use it

Open tool
Enter the full number with its international code. For a national number, first check the edition country or country selector.
Check
Read the available fields alongside their limitations. An empty result does not prove safety or identify a person.

Synthetic example

Invented example, not a real lookup. Do not call or open its links.

+44 1632 960123

Interpret the result

Your phone number is at risk.

Your phone number was not found in known data breaches.

Limitations

This result covers known breaches and does not guarantee complete security.

We show only the result. We never display breach names, exposed fields, sources or leaked values.

Troubleshooting

If the input is invalid, check its format and country. Retry connection errors; respect the waiting period when a limit is reached.

Invalid phone number

The security check or API connection did not respond in time. Try again in a few seconds.

You've used all phone-number lookups allowed today. Please try again tomorrow.

Use with the API

Needs an API key and credits. Each completed call costs 1 credit, even when there is no data. An active Pro account includes 20 credits per UTC calendar month, shared by every API route and spent first; unused monthly credits do not roll over. Credits bought on your account page work without Pro and never expire.

Errors are never charged: 401 invalid_api_key (missing or invalid key), 403 pro_required (no Pro credits and no purchased credits), 422 invalid input, 429 quota_exceeded (no credits left), rate_limit_exceeded or ai_busy (the AI of sms-check is at capacity), 503 tool_warming (the data is still being prepared) or tool or provider unavailable. After a 429 or 503, retry once the seconds in the Retry-After header have passed.

Whether the number appears in known data-breach exposure. Boolean only: no breach names or leaked data.

Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.

POST https://api.nocall.io/v2/phone-exposure
POST https://api.nocall.io/v2/tools  {"tool":"phone-exposure","phone":"+12025550123","country":"US"}

Parameters

Name	Type	Required	Description
phone	string (1–40)	Yes	Phone number in E.164 (+34…) or national format.
country	string (enum, 56)	No (default: "ES")	Two-letter country code, for example ES or US, used for national input and for the country's data.

REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/phone-exposure' \
  --header "Authorization: Bearer $NOCALL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $REQUEST_ID" \
  --data '{"phone":"+12025550123","country":"US"}'

import json
import os
import urllib.request
import uuid

api_key = os.environ.get('NOCALL_API_KEY')
if not api_key:
    raise SystemExit('Set NOCALL_API_KEY')

request = urllib.request.Request(
    'https://api.nocall.io/v2/phone-exposure',
    method='POST',
    data=json.dumps({'phone': '+12025550123', 'country': 'US'}).encode(),
    headers={
        'Authorization': 'Bearer ' + api_key,
        'Content-Type': 'application/json',
        'Idempotency-Key': str(uuid.uuid4()),
    },
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)
print(result['data']['result'], result['meta']['unitsCharged'])

import { randomUUID } from 'node:crypto';

const requestId = randomUUID();
const apiKey = process.env.NOCALL_API_KEY;
if (!apiKey) throw new Error('Set NOCALL_API_KEY');

const response = await fetch('https://api.nocall.io/v2/phone-exposure', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer ' + apiKey,
    'Content-Type': 'application/json',
    'Idempotency-Key': requestId,
  },
  body: JSON.stringify({ phone: '+12025550123', country: 'US' }),
});
const result = await response.json();
if (!response.ok) throw new Error(result.error?.code ?? 'request_failed');
console.log(result.data.result, result.meta.unitsCharged);

Example response (200)

This is the documented example from the API reference. Lookups use a fictional number, and aggregates and AI answers show the shape of the result, not live data.

{
  "data": {
    "tool": "phone-exposure",
    "result": {
      "atRisk": false
    }
  },
  "meta": {
    "requestId": "req_example",
    "unitsCharged": 1,
    "usage": {
      "periodStart": "2026-10-01",
      "unitLimit": 20,
      "unitsUsed": 3,
      "unitsRemaining": 17
    }
  }
}

Result fields (data.result)

Field	Type	Description
atRisk	boolean	Whether the number appears in known data-breach exposure. No breach names or leaked data.

API reference