If you're stuck and can't work out why a problem is occurring with the HIBP API, when you submit a support ticket it's important to provide information in a fashion such that the issue can be replicated. Often, people are using third party apps or scripts which we can't support so the problem needs to be boiled down to the raw HTTP request. The easiest way to do this is to send either a cURL command or a Powershell command in the ticket with the API key redacted, and include the full response (both headers and body) when run locally in your environment.
With cURL
curl --header "hibp-api-key: [redacted]" -i https://haveibeenpwned.com/api/v3/breachedaccount/account-exists%40hibp-integration-tests.com
And the output:
HTTP/1.1 200 OK Date: Fri, 20 Jan 2023 21:17:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 78cad64f8d3f32a1-BNE Cache-Control: no-cache Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Pragma: no-cache X-Content-Type-Options: nosniff Set-Cookie: __cf_bm=zjzU.T7AHUCGMWRY0_rTNMwobzzkzpRzsvwS2HcPl1I-1674249449-0-AfVtZ20x1qabk41TeAzexU8Dtsq1a3YALUOZNMAS+FmvJ3NlehcpwRew1X/OXbCG3W63mJoAZpcyWUNYckYGkR0=; path=/; expires=Fri, 20-Jan-23 21:47:29 GMT; domain=.haveibeenpwned.com; HttpOnly; Secure; SameSite=None Server: cloudflare
[{"Name":"Adobe"}]
With Powershell
Invoke-WebRequest -Headers @{'hibp-api-key' = '[redacted]'} -URI https://haveibeenpwned.com/api/v3/breachedaccount/account-exists%40hibp-integration-tests.com<
And the output:
StatusCode : 200 StatusDescription : OK Content : [{"Name":"Adobe"}] RawContent : HTTP/1.1 200 OK Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 78cae607ebcae9b7-BNE Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding CF-Ca... Forms : {} Headers : {[Transfer-Encoding, chunked], [Connection, keep-alive], [CF-Ray, 78cae607ebcae9b7-BNE], [Strict-Transport-Security, max-age=31536000; includeSubDomains; preload]...} Images : {} InputFields : {} Links : {} ParsedHtml : mshtml.HTMLDocumentClass RawContentLength : 18