{"openapi": "3.1.0", "info": {"title": "RelayShield API", "version": "1.1.0", "summary": "Identity-compromise and threat-intelligence checks for developers, MSPs and AI agents.", "description": "Identity-compromise and threat-intelligence checks over a plain REST API. Every endpoint is\n`POST`, takes a JSON body, and returns a JSON envelope. Pay per call in USDC over x402 with no\nsignup and no API key, or use a key with prepaid credits and a free tier of 20 calls. Screen a\ncounterparty wallet, a token contract, an MCP server, a domain or an email against a corpus of\nover 5 million indicators.\n\n## Authentication\n\nSend your API key in either header. They are equivalent -- use whichever your HTTP client\nhandles more comfortably.\n\n```\nX-RS-API-KEY: rs_live_your_key_here\nAuthorization: Bearer rs_live_your_key_here\n```\n\nHeader names are matched case-insensitively, so a client that normalises `X-RS-API-KEY` to\n`X-Rs-Api-Key` still authenticates.\n\n**One exception.** The two **Agent and MCP security** endpoints accept `X-RS-API-KEY` or\n`X-API-Key`, and do **not** accept `Authorization: Bearer`. They are served by a separately\nisolated backend. `X-RS-API-KEY` works everywhere, so use it and the distinction never matters.\n\nGet a key at [api.relayshield.net/developers](https://api.relayshield.net/developers). AWS\nMarketplace subscribers are provisioned a key automatically when the subscription activates.\n\n## Response envelope\n\nEvery response, success or failure, is one of these two shapes:\n\n```json\n{ \"ok\": true,  \"data\": { } }\n{ \"ok\": false, \"error\": \"email is required and must be a valid address\" }\n```\n\nBranch on the HTTP status code, or on `ok` -- they always agree. `error` is a human-readable\nsentence naming the offending field; it is meant to be logged and read, not pattern-matched.\n\n## Errors\n\n| Status | Meaning | What to do |\n|---|---|---|\n| `400` | A required field is missing or malformed. | Fix the request. Retrying unchanged will fail identically. |\n| `401` | API key missing, invalid, or deactivated. | Check the header name and the key value. |\n| `402` | No credits and no active subscription. | Response carries `topup_url`. Add credits or subscribe. Not returned by the two Agent and MCP security endpoints, which do not check credits. |\n| `404` | Unknown endpoint. | Check the path. Every metered route is under `/v1/metered/`. |\n| `405` | Wrong method. | Every endpoint is `POST`, including those that take no parameters. |\n| `413` | Payload too large. | Only `secret-scan-text` returns this, at 1 MiB. Split the batch. |\n| `429` | An upstream provider rate-limited us. | Retry after a few seconds. Not billed. |\n| `500` | Internal error. | Retry. If it persists, contact support with the timestamp. |\n| `502` | An upstream data provider was unavailable. | Retry. Not billed. |\n\n**Only successful calls are billed.** A `4xx` or `5xx` never deducts credits and never emits a\nmetering event, so a retry loop against a malformed request costs nothing but time.\n\n## Rate limits\n\nThere is no fixed per-key request rate limit on metered endpoints; you are limited by credits or\nsubscription. Threat Intelligence Starter is capped at 10,000 calls/month (about 333/day);\nUnlimited is uncapped. A `429` therefore reflects an upstream provider's limit, not ours.\n\n## Timeouts and partial results\n\nSeveral endpoints query many sources and are explicitly bounded in wall-clock time rather than\nallowed to run long and be killed mid-flight. Where that applies, the response says so instead of\nreturning a shorter list that reads like a clean result -- `secret-scan` reports `coverage[].sources`,\nand `domain` returns `null` enrichment fields for lookalikes it could not finish assessing. In this\nAPI `null` means \"not determined\", never \"clean\".\n\n## Conventions\n\n- Emails and domains are lowercased and trimmed; a leading `www.` and any URL scheme are stripped.\n- Phone numbers must be E.164 (`+14155551234`).\n- Timestamps are ISO 8601 UTC.\n- Severity is always one of `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`. Vendor risk adds `CLEAN`, and\n  `oauth-watchlist` adds `NONE`.\n- Risk scores run 0-100 where higher is worse.\n\n## Other surfaces\n\nThe same corpus is also available as a STIX 2.1 / TAXII 2.1 feed at `/v1/intel/taxii/`, a\nMISP-compatible REST surface at `/v1/intel/misp`, and an x402 pay-per-call surface under\n`/v1/payg/` that needs no API key. Those are documented separately at\n[api.relayshield.net/developers](https://api.relayshield.net/developers).", "contact": {"name": "RelayShield Support", "email": "support@relayshield.net", "url": "https://api.relayshield.net/developers"}, "termsOfService": "https://relayshield.carrd.co/terms", "x-guidance": "Two ways to call this API. With an API key, every route under `/v1/metered/` is charged against prepaid credits or a subscription; get a key at https://api.relayshield.net/developers, and the first 20 calls are free. Without an API key, the same checks are under `/v1/payg/` and are paid per call in USDC over x402 on Base or Solana: send the request, take the `402` challenge, pay it, repeat. Agents should prefer `/v1/payg/`, which needs no signup and no key custody. Every endpoint is POST with a JSON body and returns `{ok, data}` or `{ok, error}`. Only successful calls are billed."}, "servers": [{"url": "https://api.relayshield.net", "description": "Production"}], "tags": [{"name": "Identity exposure", "description": "Whether a person's credentials, sessions or payment cards are already circulating."}, {"name": "Domain and infrastructure", "description": "Lookalike domains, certificate expiry, passive DNS and reputation."}, {"name": "Secrets and non-human identity", "description": "API keys, tokens and machine credentials -- in your own artifacts and in criminal corpora."}, {"name": "Vendor and organisation risk", "description": "Scoring an organisation, its vendors and its agent identities."}, {"name": "Threat intelligence", "description": "Indicator enrichment, pivoting, actor attribution and CVE correlation."}, {"name": "Crypto", "description": "Wallet address and token contract screening."}, {"name": "Agent and MCP security", "description": "MCP server reputation and AI-agent-sourced breach exposure. These two authenticate slightly differently -- see each operation."}, {"name": "Account", "description": "Free, unmetered endpoints for key validation and webhook delivery."}, {"name": "x402 pay-per-call", "description": "The same checks paid per call in USDC over x402, on Base or Solana. No API key and no signup: send the request, take the 402 challenge, pay it, repeat. Discoverable in the CDP Bazaar."}], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "components": {"securitySchemes": {"ApiKeyAuth": {"type": "apiKey", "in": "header", "name": "X-RS-API-KEY", "description": "Your RelayShield API key, e.g. `rs_live_...`."}, "BearerAuth": {"type": "http", "scheme": "bearer", "description": "The same API key sent as `Authorization: Bearer <key>`. Equivalent to X-RS-API-KEY. Accepted everywhere except the two Agent and MCP security endpoints, which take X-RS-API-KEY or X-API-Key only."}, "ApiKeyAuthAlt": {"type": "apiKey", "in": "header", "name": "X-API-Key", "description": "The same API key under an alternative header name, accepted only by the Agent and MCP security endpoints. X-RS-API-KEY works there too and is the spelling to prefer for consistency with the rest of the API."}}, "schemas": {"Error": {"type": "object", "description": "Failure envelope. Returned for every non-2xx response.", "required": ["ok", "error"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "description": "Human-readable description of what went wrong, naming the offending field where there is one."}, "topup_url": {"type": "string", "description": "Present only on 402. Where to add credits."}, "docs": {"type": "string", "description": "Present on 401. Link to the developer documentation."}}}}}, "paths": {"/v1/metered/breach": {"post": {"operationId": "metered_breach", "summary": "Check an email address against known data breaches", "description": "Looks the address up across 13B+ compromised accounts and returns every breach it appears in, with the date and the classes of data exposed. Call it before trusting a new user identity or granting elevated access.\n\n**Billing.** $0.10 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Identity exposure"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"email": {"type": "string", "description": "Email address to check. Case-insensitive; whitespace is trimmed. Must contain '@'.", "format": "email", "examples": ["user@example.com"]}}, "required": ["email"]}, "example": {"email": "user@example.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"observed_at": {"type": "string", "format": "date-time", "description": "When this verdict was observed. Cache keyed on this, not on receipt time."}, "valid_for_seconds": {"type": "integer", "description": "How long this verdict can be cached before it should be re-checked. Flagged results live 7 days; clean results live 12 hours, because a hit stays a hit while a clean answer is the one that flips without telling whoever cached it. A degraded result lives 5 minutes. This is a caching hint and a policy default, not a measurement and not a safety guarantee: how fast a verdict really goes stale is bounded by upstream detection latency, which we do not control."}, "expires_at": {"type": "string", "format": "date-time", "description": "observed_at plus valid_for_seconds, precomputed."}, "degraded": {"type": "boolean", "description": "True when this answer was assembled from incomplete or failed upstream data. Treat it as NO VERDICT, never as clean. An outage that returns an empty finding list is otherwise indistinguishable from a real all-clear, and it fails in the permissive direction."}, "email": {"type": "string", "description": "The normalised address that was checked."}, "record_type": {"type": "string", "description": "Always `credential_exposure`. Lets a SIEM route every identity finding on one field."}, "breach_count": {"type": "integer", "description": "Number of breaches the address appears in. 0 means no known exposure."}, "breaches": {"type": "array", "description": "One entry per breach, unordered.", "items": {"type": "object", "description": "A single breach.", "properties": {"name": {"type": "string", "description": "Breach identifier, e.g. `LinkedIn`."}, "domain": {"type": "string", "description": "Domain of the breached service. May be empty."}, "breach_date": {"type": "string", "description": "Date of the breach, YYYY-MM-DD."}, "data_classes": {"type": "array", "description": "Data types exposed.", "items": {"type": "string", "description": "e.g. `Email addresses`, `Passwords`."}}, "is_verified": {"type": "boolean", "description": "Whether the breach has been verified as genuine."}}}}}}}}, "example": {"ok": true, "data": {"email": "user@example.com", "record_type": "credential_exposure", "breach_count": 2, "breaches": [{"name": "LinkedIn", "domain": "linkedin.com", "breach_date": "2021-06-22", "data_classes": ["Email addresses", "Passwords"], "is_verified": true}, {"name": "Dropbox", "domain": "dropbox.com", "breach_date": "2012-07-01", "data_classes": ["Email addresses", "Passwords"], "is_verified": true}]}}}}}, "400": {"description": "`email` is missing or contains no '@'.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`email` is missing or contains no '@'."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "429": {"description": "Upstream breach database rate limit reached. Retry in a few seconds.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Upstream breach database rate limit reached. Retry in a few seconds."}}}}, "502": {"description": "Upstream breach database unavailable or returned an unexpected status.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Upstream breach database unavailable or returned an unexpected status."}}}}}, "x-price-usd": 0.1, "x-billing-unit": "call"}}, "/v1/metered/infostealer": {"post": {"operationId": "metered_infostealer", "summary": "Check an email address against infostealer malware logs", "description": "A single infected device exposes every saved password at once: banking, card autofill, email, SaaS, and live session cookies that bypass 2FA. This returns the infection records tied to the address, including when the device was compromised and how many corporate and personal services were on it.\n\n**Billing.** $0.50 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Identity exposure"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"email": {"type": "string", "description": "Email address to check.", "format": "email"}}, "required": ["email"]}, "example": {"email": "user@example.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"observed_at": {"type": "string", "format": "date-time", "description": "When this verdict was observed. Cache keyed on this, not on receipt time."}, "valid_for_seconds": {"type": "integer", "description": "How long this verdict can be cached before it should be re-checked. Flagged results live 7 days; clean results live 6 hours, because a hit stays a hit while a clean answer is the one that flips without telling whoever cached it. A degraded result lives 5 minutes. This is a caching hint and a policy default, not a measurement and not a safety guarantee: how fast a verdict really goes stale is bounded by upstream detection latency, which we do not control."}, "expires_at": {"type": "string", "format": "date-time", "description": "observed_at plus valid_for_seconds, precomputed."}, "degraded": {"type": "boolean", "description": "True when this answer was assembled from incomplete or failed upstream data. Treat it as NO VERDICT, never as clean. An outage that returns an empty finding list is otherwise indistinguishable from a real all-clear, and it fails in the permissive direction."}, "record_type": {"type": "string", "description": "Always `credential_exposure`."}, "email": {"type": "string", "description": "The normalised address that was checked."}, "found": {"type": "boolean", "description": "True when at least one infection record exists."}, "stealer_count": {"type": "integer", "description": "Number of distinct infected devices."}, "stealers": {"type": "array", "description": "One entry per infected device.", "items": {"type": "object", "description": "A single infostealer infection.", "properties": {"date_compromised": {"type": "string", "description": "When the device was infected."}, "computer_name": {"type": "string", "description": "Hostname recorded by the malware."}, "operating_system": {"type": "string", "description": "OS string recorded by the malware."}, "malware_path": {"type": "string", "description": "Filesystem path the stealer ran from."}, "total_corporate_services": {"type": "integer", "description": "Corporate credentials found on the device."}, "total_user_services": {"type": "integer", "description": "Personal credentials found on the device."}}}}}}}}, "example": {"ok": true, "data": {"record_type": "credential_exposure", "email": "user@example.com", "found": true, "stealer_count": 1, "stealers": [{"date_compromised": "2026-03-14", "computer_name": "DESKTOP-4K1P8Q", "operating_system": "Windows 10 Pro", "malware_path": "C:\\Users\\user\\AppData\\Local\\Temp\\setup.exe", "total_corporate_services": 7, "total_user_services": 42}]}}}}}, "400": {"description": "`email` is missing or contains no '@'.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`email` is missing or contains no '@'."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "502": {"description": "Upstream infostealer corpus unavailable.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Upstream infostealer corpus unavailable."}}}}}, "x-price-usd": 0.5, "x-billing-unit": "call"}}, "/v1/metered/sim-swap": {"post": {"operationId": "metered_sim_swap", "summary": "Detect a recent SIM swap or carrier port", "description": "Queries live carrier data for the number. A recent swap is a strong signal of an account-takeover attempt against SMS-based 2FA, so call this before trusting an SMS OTP from a number you have not seen before.\n\n**Billing.** $0.25 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Identity exposure"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"phone": {"type": "string", "description": "Phone number in E.164 format. Must start with '+'. Rejected without it, because national formats are ambiguous across carriers.", "examples": ["+14155551234"]}}, "required": ["phone"]}, "example": {"phone": "+14155551234"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"observed_at": {"type": "string", "format": "date-time", "description": "When this verdict was observed. Cache keyed on this, not on receipt time."}, "valid_for_seconds": {"type": "integer", "description": "How long this verdict can be cached before it should be re-checked. Flagged results live 24 hours; clean results live 15 minutes, because a hit stays a hit while a clean answer is the one that flips without telling whoever cached it. A degraded result lives 5 minutes. This is a caching hint and a policy default, not a measurement and not a safety guarantee: how fast a verdict really goes stale is bounded by upstream detection latency, which we do not control."}, "expires_at": {"type": "string", "format": "date-time", "description": "observed_at plus valid_for_seconds, precomputed."}, "degraded": {"type": "boolean", "description": "True when this answer was assembled from incomplete or failed upstream data. Treat it as NO VERDICT, never as clean. An outage that returns an empty finding list is otherwise indistinguishable from a real all-clear, and it fails in the permissive direction."}, "phone": {"type": "string", "description": "The number that was checked, echoed as supplied."}, "swapped": {"type": "boolean", "description": "True when the carrier reports a SIM swap or port in the lookback period. False means the carrier affirmatively reported no swap. When carrier data is unavailable the endpoint returns 503 rather than False, so a 200 response is always a real verdict."}, "swap_timestamp": {"type": "string", "description": "When the swap occurred. Empty string when no swap is reported."}, "carrier": {"type": "string", "description": "Current carrier name. Empty when the carrier does not disclose it."}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"phone": "+14155551234", "swapped": true, "swap_timestamp": "2026-08-03T09:12:44Z", "carrier": "T-Mobile USA", "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "`phone` is missing or not in E.164 format (must start with '+').", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`phone` is missing or not in E.164 format (must start with '+')."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "502": {"description": "Carrier lookup provider unavailable or returned an unexpected status.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Carrier lookup provider unavailable or returned an unexpected status."}}}}, "503": {"description": "The carrier returned no SIM swap data for this number, so no verdict was produced. This call is not billed. Retry later rather than treating it as a clean result.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "The carrier returned no SIM swap data for this number, so no verdict was produced. This call is not billed. Retry later rather than treating it as a clean result."}}}}}, "x-price-usd": 0.25, "x-billing-unit": "call"}}, "/v1/metered/session-risk": {"post": {"operationId": "metered_session_risk", "summary": "Detect stolen session cookies before they are used", "description": "Searches criminal stealer-log archives for live session cookies belonging to the address. This is the AiTM case that password rotation does not fix: a stolen cookie bypasses 2FA and stays valid until the session is explicitly invalidated.\n\n**Billing.** $0.30 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Identity exposure"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"email": {"type": "string", "description": "Email address to check.", "format": "email"}}, "required": ["email"]}, "example": {"email": "user@example.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"email": {"type": "string", "description": "The normalised address that was checked."}, "record_type": {"type": "string", "description": "`credential_exposure`. Present on the not-found response."}, "found": {"type": "boolean", "description": "True when at least one stolen session exists."}, "session_count": {"type": "integer", "description": "Number of stolen session records."}, "highest_severity": {"type": ["string", "null"], "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW", null], "description": "Highest severity across all sessions. null when none found."}, "sessions": {"type": "array", "description": "Sessions, sorted most severe first.", "items": {"type": "object", "description": "One stolen session or credential record from the criminal corpus.", "properties": {"domain": {"type": "string", "description": "Service the stolen session belongs to."}, "session_type": {"type": "string", "description": "`cookie` for a session cookie, `credential` for a username/password or token pair."}, "cookie_name": {"type": "string", "description": "Cookie or credential name. Never the value."}, "severity": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "Severity derived from the service category."}, "service_category": {"type": "string", "description": "Category of the affected service, e.g. cloud_console, identity_provider, productivity."}, "channel_source": {"type": "string", "description": "Criminal channel or archive the record was collected from."}, "ingested_at": {"type": "string", "description": "When RelayShield ingested the record."}}}}, "action_required": {"type": "string", "description": "Remediation text. Present only when found is true."}}}}}, "example": {"ok": true, "data": {"email": "user@example.com", "found": true, "session_count": 2, "highest_severity": "CRITICAL", "sessions": [{"domain": "console.aws.amazon.com", "session_type": "cookie", "cookie_name": "aws-userInfo", "severity": "CRITICAL", "service_category": "cloud_console", "channel_source": "@redline_logs_cloud", "ingested_at": "2026-07-29T04:11:56Z"}], "action_required": "IMMEDIATE: Log out of all listed services from a clean device and revoke active sessions. Changing your password alone is insufficient - stolen session cookies bypass 2FA and remain valid until explicitly invalidated."}}}}}, "400": {"description": "`email` is missing or contains no '@'.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`email` is missing or contains no '@'."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "500": {"description": "Session corpus query failed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Session corpus query failed."}}}}}, "x-price-usd": 0.3, "x-billing-unit": "call"}}, "/v1/metered/oauth-watchlist": {"post": {"operationId": "metered_oauth_watchlist", "summary": "Find exposed OAuth tokens and SaaS credentials", "description": "Combines breach history against a watchlist of OAuth-capable apps with a live search of the stealer-log corpus. Returns matched apps with direct revoke links, plus any stolen credentials, category-scored: cloud consoles and code repositories CRITICAL, identity providers and payment processors HIGH, productivity SaaS MEDIUM.\n\n**Billing.** $0.30 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** The stealer-corpus half of this check is non-fatal: if that query fails, breach-history results are still returned rather than failing the whole call.", "tags": ["Identity exposure"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"email": {"type": "string", "description": "Email address to check.", "format": "email"}}, "required": ["email"]}, "example": {"email": "user@example.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"observed_at": {"type": "string", "format": "date-time", "description": "When this verdict was observed. Cache keyed on this, not on receipt time."}, "valid_for_seconds": {"type": "integer", "description": "How long this verdict can be cached before it should be re-checked. Flagged results live 7 days; clean results live 12 hours, because a hit stays a hit while a clean answer is the one that flips without telling whoever cached it. A degraded result lives 5 minutes. This is a caching hint and a policy default, not a measurement and not a safety guarantee: how fast a verdict really goes stale is bounded by upstream detection latency, which we do not control."}, "expires_at": {"type": "string", "format": "date-time", "description": "observed_at plus valid_for_seconds, precomputed."}, "degraded": {"type": "boolean", "description": "True when this answer was assembled from incomplete or failed upstream data. Treat it as NO VERDICT, never as clean. An outage that returns an empty finding list is otherwise indistinguishable from a real all-clear, and it fails in the permissive direction."}, "email": {"type": "string", "description": "The normalised address that was checked."}, "matched_count": {"type": "integer", "description": "OAuth-capable apps matched via breach history."}, "matched_apps": {"type": "array", "description": "Apps matched from breach history.", "items": {"type": "object", "description": "A matched OAuth app.", "properties": {"app": {"type": "string", "description": "App or service name."}, "source": {"type": "string", "description": "Always `breach_history` for this list."}, "breach_date": {"type": "string", "description": "Date of the breach, YYYY-MM-DD."}, "data_classes": {"type": "array", "description": "Data types exposed.", "items": {"type": "string", "description": "Data class."}}, "revoke_url": {"type": "string", "description": "Direct link to the app's revoke-access page."}}}}, "stolen_token_count": {"type": "integer", "description": "Credential records found in the stealer corpus."}, "stolen_tokens": {"type": "array", "description": "Stolen credentials, sorted most severe first.", "items": {"type": "object", "description": "One stolen session or credential record from the criminal corpus.", "properties": {"domain": {"type": "string", "description": "Service the stolen session belongs to."}, "session_type": {"type": "string", "description": "`cookie` for a session cookie, `credential` for a username/password or token pair."}, "cookie_name": {"type": "string", "description": "Cookie or credential name. Never the value."}, "severity": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "Severity derived from the service category."}, "service_category": {"type": "string", "description": "Category of the affected service, e.g. cloud_console, identity_provider, productivity."}, "channel_source": {"type": "string", "description": "Criminal channel or archive the record was collected from."}, "ingested_at": {"type": "string", "description": "When RelayShield ingested the record."}}}}, "highest_severity": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW", "NONE"], "description": "Highest severity across both signals. `NONE` when nothing was found."}, "recommendation": {"type": "string", "description": "Remediation text derived from the most severe signal present."}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"email": "user@example.com", "matched_count": 1, "matched_apps": [{"app": "Dropbox", "source": "breach_history", "breach_date": "2012-07-01", "data_classes": ["Email addresses", "Passwords"], "revoke_url": "https://www.dropbox.com/account/connected_apps"}], "stolen_token_count": 0, "stolen_tokens": [], "highest_severity": "HIGH", "recommendation": "Revoke OAuth access for matched apps immediately using the revoke_url for each. Also audit all connected apps at myaccount.google.com/permissions and myapps.microsoft.com.", "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "`email` is missing or contains no '@'.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`email` is missing or contains no '@'."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "429": {"description": "Upstream breach database rate limit reached.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Upstream breach database rate limit reached."}}}}, "502": {"description": "Upstream breach database unavailable.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Upstream breach database unavailable."}}}}}, "x-price-usd": 0.3, "x-billing-unit": "call"}}, "/v1/metered/identity-graph": {"post": {"operationId": "metered_identity_graph", "summary": "Correlate an email to phones and domains seen alongside it", "description": "Pivot from one compromised identifier to every other identifier that appeared next to it in criminal channel dumps. Correlated values are stored encrypted and decrypted per request.\n\n**Billing.** $0.35 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Identity exposure"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"email": {"type": "string", "description": "Anchor email address.", "format": "email"}}, "required": ["email"]}, "example": {"email": "user@example.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"email": {"type": "string", "description": "The anchor address."}, "found": {"type": "boolean", "description": "True when at least one correlated identifier exists."}, "correlated_identifiers": {"type": "integer", "description": "Total correlated phones plus domains."}, "correlated_phones": {"type": "array", "description": "Phone numbers seen alongside this address.", "items": {"type": "string", "description": "Phone number."}}, "correlated_domains": {"type": "array", "description": "Domains seen alongside this address.", "items": {"type": "string", "description": "Domain."}}, "sources": {"type": "array", "description": "Dumps or channels the correlations came from.", "items": {"type": "string", "description": "Source name."}}, "recommendation": {"type": "string", "description": "Remediation text. Present only when found is true."}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"email": "user@example.com", "found": true, "correlated_identifiers": 2, "correlated_phones": ["+14155551234"], "correlated_domains": ["example-corp.com"], "sources": ["@combolist_daily"], "recommendation": "All listed identifiers were found alongside this email in criminal channel dumps. Treat each as potentially compromised - change passwords and check accounts linked to any of the correlated phone numbers or domains.", "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "`email` is missing or contains no '@'.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`email` is missing or contains no '@'."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "500": {"description": "Identity graph query failed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Identity graph query failed."}}}}}, "x-price-usd": 0.35, "x-billing-unit": "call"}}, "/v1/metered/card-exposure": {"post": {"operationId": "metered_card_exposure", "summary": "Check a card against the stolen-card corpus", "description": "Pass a client-computed SHA-256 of the digit-only card number, a 6-8 digit BIN, or both. RelayShield never accepts or stores a raw card number, and a rejected value is never logged.\n\n**Billing.** $0.30 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Identity exposure"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"pan_hash": {"type": "string", "description": "64-character lowercase SHA-256 hex digest of the digit-only card number (no spaces, no dashes). Computed client-side.", "pattern": "^[a-f0-9]{64}$"}, "bin": {"type": "string", "description": "6 to 8 digit Bank Identification Number.", "pattern": "^[0-9]{6,8}$"}}, "description": "At least one of: `pan_hash`, `bin`."}, "example": {"bin": "424242"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"card_exposed": {"type": "boolean", "description": "True when the exact card hash is in the corpus. Present only when pan_hash was supplied."}, "last4": {"type": "string", "description": "Last 4 digits of the exposed card. Present only on a pan_hash hit."}, "first_seen": {"type": "string", "description": "When the card was first seen. Present only on a pan_hash hit."}, "bin_exposed_card_count": {"type": "integer", "description": "Exposed cards sharing this BIN. Present only when bin was supplied."}, "bin_last_seen": {"type": ["string", "null"], "description": "Most recent sighting for this BIN. null when none."}}}}}, "example": {"ok": true, "data": {"bin_exposed_card_count": 1183, "bin_last_seen": "2026-08-01T22:14:03Z"}}}}}, "400": {"description": "Neither `pan_hash` nor `bin` supplied, `pan_hash` is not a 64-char SHA-256 hex digest, or `bin` is not 6-8 digits.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Neither `pan_hash` nor `bin` supplied, `pan_hash` is not a 64-char SHA-256 hex digest, or `bin` is not 6-8 digits."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "500": {"description": "Stolen-card corpus lookup failed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Stolen-card corpus lookup failed."}}}}}, "x-price-usd": 0.3, "x-billing-unit": "call"}}, "/v1/metered/domain": {"post": {"operationId": "metered_domain", "summary": "Scan a domain for active phishing lookalikes", "description": "Generates typosquat, homoglyph and phishing-prefix permutations, keeps the ones that actually resolve, then enriches each with Safe Browsing status, registration age and Certificate Transparency activity. A lookalike registered in the last 30 days with a fresh certificate is being stood up right now.\n\n**Billing.** $0.30 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** Enrichment is bounded to 15 seconds. A lookalike whose enrichment does not finish in time is still returned, with its enrichment fields set to null rather than omitted -- null means unknown here, never 'clean'.", "tags": ["Domain and infrastructure"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Domain to protect. A scheme or leading `www.` is stripped for you.", "examples": ["acme.com"]}}, "required": ["domain"]}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"observed_at": {"type": "string", "format": "date-time", "description": "When this verdict was observed. Cache keyed on this, not on receipt time."}, "valid_for_seconds": {"type": "integer", "description": "How long this verdict can be cached before it should be re-checked. Flagged results live 24 hours; clean results live 1 hour, because a hit stays a hit while a clean answer is the one that flips without telling whoever cached it. A degraded result lives 5 minutes. This is a caching hint and a policy default, not a measurement and not a safety guarantee: how fast a verdict really goes stale is bounded by upstream detection latency, which we do not control."}, "expires_at": {"type": "string", "format": "date-time", "description": "observed_at plus valid_for_seconds, precomputed."}, "degraded": {"type": "boolean", "description": "True when this answer was assembled from incomplete or failed upstream data. Treat it as NO VERDICT, never as clean. An outage that returns an empty finding list is otherwise indistinguishable from a real all-clear, and it fails in the permissive direction."}, "domain": {"type": "string", "description": "The normalised domain that was scanned."}, "lookalikes_found": {"type": "integer", "description": "Permutations that resolve."}, "lookalikes": {"type": "array", "description": "One entry per active lookalike.", "items": {"type": "object", "description": "One active lookalike domain, enriched with intent signals.", "properties": {"domain": {"type": "string", "description": "The lookalike domain that resolves."}, "gsb_flagged": {"type": ["boolean", "null"], "description": "True if Google Safe Browsing lists it. null when enrichment timed out."}, "registration_age_days": {"type": ["integer", "null"], "description": "Days since registration via RDAP. Under 30 is a strong phishing signal. null when unavailable."}, "cert_count": {"type": ["integer", "null"], "description": "Certificates seen in Certificate Transparency logs."}, "cert_recent": {"type": ["boolean", "null"], "description": "True if a certificate was issued recently, indicating the lookalike is being stood up now."}, "latest_cert_issued": {"type": ["string", "null"], "description": "Issue date of the most recent certificate."}}}}, "candidates_checked": {"type": "integer", "description": "Permutations actually resolved within the scan window. Previously this reported the number generated, which overstated coverage whenever the sweep was truncated."}, "candidates_total": {"type": "integer", "description": "Permutations generated for this domain."}, "candidates_unchecked": {"type": "integer", "description": "Permutations whose DNS lookup did not finish in time. Non-zero means the sweep was truncated, `degraded` is true, and a low lookalikes_found is not evidence that the domain is clean."}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"domain": "acme.com", "lookalikes_found": 2, "lookalikes": [{"domain": "acnne.com", "gsb_flagged": true, "registration_age_days": 11, "cert_count": 2, "cert_recent": true, "latest_cert_issued": "2026-07-29"}], "candidates_checked": 214, "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "`domain` is missing or contains no '.'.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`domain` is missing or contains no '.'."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.3, "x-billing-unit": "call"}}, "/v1/metered/cert-expiry": {"post": {"operationId": "metered_cert_expiry", "summary": "Check TLS certificate expiry from CT logs", "description": "Reads Certificate Transparency logs and reports days remaining on the certificate most likely deployed right now (the unexpired entry with the latest not_before). Relevant as CA/Browser Forum rules shrink standard certificate lifetimes toward 47 days by 2029.\n\n**Billing.** $0.05 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** `cert_found: true` with `days_remaining: null` and `risk_level: CRITICAL` means historical certificates exist but none are currently valid -- distinct from `cert_found: false`, which means the domain has never appeared in CT logs.", "tags": ["Domain and infrastructure"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Domain to check. A leading `www.` is stripped.", "examples": ["acme.com"]}}, "required": ["domain"]}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"domain": {"type": "string", "description": "The normalised domain."}, "cert_found": {"type": "boolean", "description": "True when CT logs hold any certificate for the domain."}, "expires_at": {"type": ["string", "null"], "description": "Expiry timestamp. null when no live certificate."}, "days_remaining": {"type": ["integer", "null"], "description": "Days until expiry. null when no live certificate."}, "risk_level": {"type": ["string", "null"], "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW", null], "description": "CRITICAL at 7 days or fewer, HIGH at 14, MEDIUM at 30, otherwise LOW. null when no certificates exist at all."}, "issued_at": {"type": ["string", "null"], "description": "Issue timestamp of the live certificate."}, "recommendation": {"type": "string", "description": "Plain-English action."}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"domain": "acme.com", "cert_found": true, "expires_at": "2026-08-19T23:59:59+00:00", "days_remaining": 15, "risk_level": "MEDIUM", "issued_at": "2026-05-21T00:00:00+00:00", "recommendation": "Certificate renews in 15 days - no action needed yet, but confirm your renewal automation is configured.", "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "`domain` is missing or contains no '.'.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`domain` is missing or contains no '.'."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "502": {"description": "Certificate Transparency log lookup failed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Certificate Transparency log lookup failed."}}}}}, "x-price-usd": 0.05, "x-billing-unit": "call"}}, "/v1/metered/ip-intel": {"post": {"operationId": "metered_ip_intel", "summary": "Passive DNS and reputation for a domain or IP", "description": "Pass a domain for its historical IP resolutions, or an IP for reverse resolutions, AS owner and country. RelayShield's own IOC corpus is consulted first; a hit there is a stronger signal than a third-party vote count and short-circuits the external lookup.\n\n**Billing.** $0.10 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** Responses are cached, so repeat lookups of the same value within the cache window are served from cache.", "tags": ["Domain and infrastructure"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Domain to look up. A leading `www.` is stripped."}, "ip": {"type": "string", "description": "IP address to look up. Takes precedence when both are supplied."}}, "description": "At least one of: `domain`, `ip`."}, "example": {"domain": "example.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"queried": {"type": "string", "description": "The value that was looked up."}, "query_type": {"type": "string", "enum": ["domain", "ip"], "description": "Which lookup ran."}, "found": {"type": "boolean", "description": "True when the value is known to any source."}, "reputation": {"type": ["integer", "null"], "description": "Reputation score. null on a RelayShield-corpus hit or when not found."}, "malicious_votes": {"type": ["integer", "null"], "description": "Engines flagging it malicious. On a corpus hit this is the corpus hit count."}, "suspicious_votes": {"type": ["integer", "null"], "description": "Engines flagging it suspicious."}, "source": {"type": "string", "description": "Present and set to `relayshield_ioc_corpus` when the answer came from RelayShield's own corpus."}, "resolutions": {"type": "array", "description": "Up to 10 historical resolutions, newest first.", "items": {"type": "object", "description": "One resolution record.", "properties": {"date": {"type": ["string", "null"], "description": "When the resolution was observed."}, "hostname": {"type": "string", "description": "Present when query_type is `ip`."}, "ip_address": {"type": "string", "description": "Present when query_type is `domain`."}}}}, "as_owner": {"type": "string", "description": "Autonomous system owner. Present only when query_type is `ip`."}, "country": {"type": "string", "description": "Two-letter country code. Present only when query_type is `ip`."}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"queried": "93.184.216.34", "query_type": "ip", "found": true, "reputation": -4, "malicious_votes": 2, "suspicious_votes": 1, "resolutions": [{"date": "2026-06-02T00:00:00+00:00", "hostname": "example.com"}], "as_owner": "EDGECAST", "country": "US", "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "Neither `domain` nor `ip` supplied.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Neither `domain` nor `ip` supplied."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "502": {"description": "Upstream reputation provider unavailable.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Upstream reputation provider unavailable."}}}}}, "x-price-usd": 0.1, "x-billing-unit": "call"}}, "/v1/metered/secret-scan": {"post": {"operationId": "metered_secret_scan", "summary": "Find published secrets across six public artifact sources", "description": "Scans GitHub repositories plus npm, PyPI, Docker Hub, Hugging Face and Postman public workspaces and collections for secrets already published against your domain. Secrets ship inside released packages and images constantly, and repo-only scanners never see them. Every hit is verified against the matching credential pattern before it is reported, so a docs example or a placeholder is not billed to you as a CRITICAL.\n\n**Billing.** $0.35 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** Artifact discovery runs under a 75-second budget. If it is exhausted, remaining sources are skipped and `coverage[].sources` reports exactly what ran -- reduced coverage is stated rather than returned as a false all-clear. A partial scan is never cached, so a rate-limited moment cannot be frozen in as a 24-hour clean result.", "tags": ["Secrets and non-human identity"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Your own domain."}, "vendor_domains": {"type": "array", "description": "Additional supply-chain domains.", "items": {"type": "string", "description": "Domain."}}, "include_artifact_sources": {"type": "boolean", "description": "When false, only GitHub is scanned. Defaults to true. Set false for a faster, repo-only scan."}}, "description": "At least one of: `domain`, `vendor_domains`."}, "example": {"domain": "acme.com", "vendor_domains": ["vendor-one.com"]}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"domains_checked": {"type": "integer", "description": "Domains actually scanned. Capped at 5 after deduplication."}, "found": {"type": "boolean", "description": "True when at least one verified secret was found."}, "findings": {"type": "array", "description": "Findings, sorted most severe first.", "items": {"type": "object", "description": "One verified secret.", "properties": {"source": {"type": "string", "enum": ["github", "npm", "pypi", "dockerhub", "huggingface"], "description": "Artifact source it was found in."}, "type": {"type": "string", "description": "Credential type, e.g. aws_access_key, github_pat, stripe_secret_key."}, "description": {"type": "string", "description": "What the credential grants."}, "severity": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "Severity of the credential type."}, "repo": {"type": "string", "description": "Repository or package the secret is in."}, "file": {"type": "string", "description": "Path within the artifact."}, "url": {"type": "string", "description": "Direct link to the match."}, "preview": {"type": "string", "description": "Redacted context. Never the secret value."}, "domain": {"type": "string", "description": "Which supplied domain this finding belongs to."}, "surfaced_by": {"type": "string", "description": "Present only when the query that surfaced the hit differs from the credential type finally classified."}}}}, "highest_severity": {"type": ["string", "null"], "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW", null], "description": "Highest severity across findings. null when none."}, "coverage": {"type": "array", "description": "Per-domain scan coverage, reported so a caller can tell a fresh all-clear from a stale one.", "items": {"type": "object", "description": "Coverage for one domain.", "properties": {"domain": {"type": "string", "description": "Domain."}, "cached": {"type": "boolean", "description": "True when served from the 24-hour cache rather than freshly scanned."}, "sources": {"type": "array", "description": "Sources that actually ran for this domain.", "items": {"type": "string", "description": "Source name."}}}}}, "recommendation": {"type": "string", "description": "Remediation text."}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"domains_checked": 1, "found": true, "highest_severity": "CRITICAL", "findings": [{"source": "pypi", "type": "aws_access_key", "description": "AWS IAM access key ID with matching secret", "severity": "CRITICAL", "repo": "acme-sdk", "file": "acme_sdk/config.py", "url": "https://pypi.org/project/acme-sdk/", "preview": "Match in acme_sdk/config.py", "domain": "acme.com"}], "coverage": [{"domain": "acme.com", "cached": false, "sources": ["github", "npm", "pypi", "dockerhub", "huggingface"]}], "recommendation": "CRITICAL: 1 high-value secret(s) found in public repositories. Rotate these credentials immediately - GitHub repos are indexed and may already have been scraped by automated secret hunters.", "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "Neither `domain` nor `vendor_domains` supplied.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Neither `domain` nor `vendor_domains` supplied."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.35, "x-billing-unit": "call"}}, "/v1/metered/secret-scan-text": {"post": {"operationId": "metered_secret_scan_text", "summary": "Scan supplied text or a diff for secrets", "description": "Pattern-scans content you send, with no external lookups. Built for pre-commit hooks and CI: send a unified diff and only added lines are scanned, so pre-existing secrets in a file do not block every commit that touches it. Priced well below secret-scan because this fires on every commit.\n\n**Billing.** $0.05 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** The scanned content never reaches RelayShield's logs: only pattern names and counts are logged. Findings carry a fingerprint rather than the matched value.", "tags": ["Secrets and non-human identity"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"content": {"type": "string", "description": "Raw file content to scan. Mutually exclusive with `diff`."}, "diff": {"type": "string", "description": "Unified diff. Only added lines are scanned. Mutually exclusive with `content`."}, "filename": {"type": "string", "description": "Optional filename, echoed on each finding as `file`. Used with `content`."}}, "description": "At least one of: `content`, `diff`."}, "example": {"diff": "--- a/config.py\n+++ b/config.py\n@@ -1,2 +1,3 @@\n import os\n+AWS_SECRET = \"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\"\n"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"found": {"type": "boolean", "description": "True when at least one secret was detected."}, "bytes_scanned": {"type": "integer", "description": "UTF-8 byte length of the payload."}, "findings": {"type": "array", "description": "Findings, sorted by severity then line number.", "items": {"type": "object", "description": "One detected secret.", "properties": {"type": {"type": "string", "description": "Credential type."}, "description": {"type": "string", "description": "What the credential grants."}, "severity": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "Severity of the credential type."}, "line": {"type": "integer", "description": "1-indexed line number in the payload."}, "byte_offset": {"type": "integer", "description": "Byte offset of the match."}, "length": {"type": "integer", "description": "Length of the matched value."}, "fingerprint": {"type": "string", "description": "Stable non-reversible fingerprint of the value. Lets you dedupe across runs without transmitting the secret."}, "llm_provider": {"type": "string", "description": "LLM or AI provider when the credential is provider-attributable, otherwise empty."}, "file": {"type": "string", "description": "The `filename` you supplied, or the path parsed from the diff."}}}}, "findings_count": {"type": "integer", "description": "Total findings."}, "severity_counts": {"type": "object", "description": "Counts keyed by severity.", "properties": {}}, "highest_severity": {"type": ["string", "null"], "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW", null], "description": "Highest severity found. null when clean."}, "recommendation": {"type": "string", "description": "Remediation text."}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"found": true, "bytes_scanned": 142, "findings": [{"type": "aws_secret_key", "description": "AWS IAM secret access key", "severity": "CRITICAL", "line": 3, "byte_offset": 74, "length": 40, "fingerprint": "b7f0a2c914e6", "llm_provider": "", "file": "config.py"}], "findings_count": 1, "severity_counts": {"CRITICAL": 1}, "highest_severity": "CRITICAL", "recommendation": "CRITICAL secrets detected. Do not commit. Rotate any credential that has already left this machine, then remove it from the working tree.", "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "Neither `content` nor `diff` supplied, both supplied, or either is not a string.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Neither `content` nor `diff` supplied, both supplied, or either is not a string."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "413": {"description": "Payload exceeds 1,048,576 bytes (1 MiB). Split the scan into smaller batches -- the payload is rejected, never silently truncated.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Payload exceeds 1,048,576 bytes (1 MiB). Split the scan into smaller batches -- the payload is rejected, never silently truncated."}}}}}, "x-price-usd": 0.05, "x-billing-unit": "call"}}, "/v1/metered/nhi-exposure": {"post": {"operationId": "metered_nhi_exposure", "summary": "Find machine credentials in stealer logs", "description": "Scans the stealer-log corpus for non-human identity credentials tied to your domains: AWS IAM keys, GitHub PATs, Stripe secrets, private keys and Slack tokens. This is not a repo scan -- it is the criminal side, where leaked keys are already circulating.\n\n**Billing.** $0.40 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Secrets and non-human identity"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Your own domain."}, "vendor_domains": {"type": "array", "description": "Additional supply-chain domains.", "items": {"type": "string", "description": "Domain."}}}, "description": "At least one of: `domain`, `vendor_domains`."}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"domains_checked": {"type": "integer", "description": "Domains scanned. Capped at 10 after deduplication."}, "found": {"type": "boolean", "description": "True when at least one credential was found."}, "findings": {"type": "array", "description": "Findings, sorted most severe first.", "items": {"type": "object", "description": "One non-human identity credential found in the stealer log corpus.", "properties": {"domain": {"type": "string", "description": "Domain the finding was matched against."}, "type": {"type": "string", "description": "Credential type, e.g. aws_access_key, github_pat, stripe_secret_key, private_key."}, "description": {"type": "string", "description": "What the credential grants and why it matters."}, "severity": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "Severity of this credential type."}, "preview": {"type": "string", "description": "Redacted context. Never the full secret value."}, "source": {"type": "string", "description": "Channel or archive the record came from."}, "ingested_at": {"type": "string", "description": "When RelayShield ingested the record."}}}}, "highest_severity": {"type": ["string", "null"], "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW", null], "description": "Highest severity found. null when none."}, "recommendation": {"type": "string", "description": "Remediation text."}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"domains_checked": 1, "found": true, "highest_severity": "CRITICAL", "findings": [{"domain": "acme.com", "type": "aws_access_key", "description": "AWS IAM access key", "severity": "CRITICAL", "preview": "AKIA****************", "source": "@cloud_creds_daily", "ingested_at": "2026-07-30T18:22:41Z"}], "recommendation": "CRITICAL: 1 high-value credential(s) detected. Rotate immediately - API keys and private keys found in stealer logs may be actively exploited. Check your cloud provider IAM access logs for unauthorised activity.", "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "Neither `domain` nor `vendor_domains` supplied.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Neither `domain` nor `vendor_domains` supplied."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.4, "x-billing-unit": "call"}}, "/v1/metered/llm-credential-exposure": {"post": {"operationId": "metered_llm_credential_exposure", "summary": "Find exposed LLM and AI provider API keys", "description": "The LLMjacking case: a stolen inference key is an uncapped billing liability, not just a data exposure. Covers 14 providers including OpenAI, Anthropic, Google Gemini, xAI, Amazon Bedrock, Groq, Replicate, LangSmith, Hugging Face, NVIDIA NIM, DeepSeek, Moonshot, Qwen and Alibaba Cloud -- four of which the most widely deployed open-source secret scanner ships no detection rules for at all.\n\nAvailable pay-per-call on any metered key at $0.40, or under a dedicated unlimited license ($39/mo or $399/yr) that covers this endpoint only.\n\n**Billing.** $0.40 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** A clean result is scoped, not absolute: this covers keys with a recognisable LLM-provider format. An exposed AWS key with Bedrock access also enables LLMjacking and surfaces under nhi-exposure instead.", "tags": ["Secrets and non-human identity"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Your own domain."}, "vendor_domains": {"type": "array", "description": "Additional supply-chain domains.", "items": {"type": "string", "description": "Domain."}}}, "description": "At least one of: `domain`, `vendor_domains`."}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"domains_checked": {"type": "integer", "description": "Domains scanned. Capped at 10 after deduplication."}, "found": {"type": "boolean", "description": "True when at least one key was found."}, "findings": {"type": "array", "description": "Findings, sorted most severe first.", "items": {"type": "object", "description": "One exposed LLM provider key.", "properties": {"domain": {"type": "string", "description": "Domain the finding was matched against."}, "type": {"type": "string", "description": "Credential type."}, "llm_provider": {"type": "string", "description": "Provider the key belongs to, e.g. openai, anthropic, deepseek."}, "description": {"type": "string", "description": "What the key grants."}, "severity": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "Severity."}, "preview": {"type": "string", "description": "Redacted context. Never the key value."}, "source": {"type": "string", "description": "Channel or archive the record came from."}, "ingested_at": {"type": "string", "description": "When RelayShield ingested the record."}}}}, "highest_severity": {"type": ["string", "null"], "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW", null], "description": "Highest severity found. null when none."}, "providers_affected": {"type": "array", "description": "Distinct providers with an exposed key, sorted.", "items": {"type": "string", "description": "Provider name."}}, "recommendation": {"type": "string", "description": "Remediation text."}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"domains_checked": 1, "found": true, "highest_severity": "CRITICAL", "providers_affected": ["anthropic", "openai"], "findings": [{"domain": "acme.com", "type": "llm_credential", "llm_provider": "openai", "description": "OpenAI API key", "severity": "CRITICAL", "preview": "sk-****", "source": "@ai_keys_market", "ingested_at": "2026-08-01T06:40:12Z"}], "recommendation": "CRITICAL: 2 exposed LLM/AI provider API key(s) detected (anthropic, openai). This is a live, uncapped billing liability, not just a data exposure - rotate immediately and check your provider's usage dashboard for anomalous spend right now, don't wait for the invoice.", "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "Neither `domain` nor `vendor_domains` supplied.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Neither `domain` nor `vendor_domains` supplied."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.4, "x-billing-unit": "call"}}, "/v1/metered/supply-chain": {"post": {"operationId": "metered_supply_chain", "summary": "Assess breach and infostealer risk across vendors", "description": "One call covers up to 10 vendor domains. Each gets a breach and infostealer assessment plus a 0-100 dark-web composite; results come back sorted worst-first.\n\n**Billing.** $0.10 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Vendor and organisation risk"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"vendor_domains": {"type": "array", "description": "Vendor domains to assess.", "items": {"type": "string", "description": "Domain."}}, "vendor_emails": {"type": "array", "description": "Vendor email addresses. The domain part is extracted and assessed, so you can pass a contact list directly.", "items": {"type": "string", "description": "Email address.", "format": "email"}}}, "description": "At least one of: `vendor_domains`, `vendor_emails`."}, "example": {"vendor_domains": ["vendor-one.com", "vendor-two.com"], "vendor_emails": ["ops@vendor-three.com"]}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"domains_checked": {"type": "integer", "description": "Distinct domains assessed after deduplication."}, "highest_risk": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW", "CLEAN"], "description": "Worst risk_level across all vendors."}, "critical_vendors": {"type": "array", "description": "Domains rated CRITICAL.", "items": {"type": "string", "description": "Domain."}}, "high_risk_vendors": {"type": "array", "description": "Domains rated HIGH.", "items": {"type": "string", "description": "Domain."}}, "results": {"type": "array", "description": "Per-vendor detail, sorted by dark_web_score descending.", "items": {"type": "object", "description": "Per-vendor risk assessment.", "properties": {"domain": {"type": "string", "description": "The vendor domain assessed."}, "breach_count": {"type": "integer", "description": "Number of known breach events affecting this domain."}, "breached_accounts": {"type": "integer", "description": "Accounts from this domain found across those breaches."}, "breach_names": {"type": "array", "description": "Breach names, capped at 10.", "items": {"type": "string", "description": "Breach name."}}, "infostealer_found": {"type": "boolean", "description": "True if credentials for this domain appear in infostealer logs."}, "infostealer_count": {"type": "integer", "description": "Infostealer log entries for this domain."}, "infostealer_dates": {"type": "array", "description": "Compromise dates, present only when infostealer_found is true.", "items": {"type": "string", "description": "Date the device was compromised."}}, "risk_level": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW", "CLEAN"], "description": "Overall vendor risk rating."}, "risk_factors": {"type": "array", "description": "Plain-English reasons behind risk_level.", "items": {"type": "string", "description": "One contributing factor."}}, "recommendation": {"type": "string", "description": "Recommended action for this vendor."}, "dark_web_score": {"type": "integer", "description": "Composite exposure score 0-100. Results are sorted by this, descending.", "minimum": 0, "maximum": 100}}}}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"domains_checked": 2, "highest_risk": "HIGH", "critical_vendors": [], "high_risk_vendors": ["vendor-one.com"], "results": [{"domain": "vendor-one.com", "breach_count": 3, "breached_accounts": 41, "breach_names": ["LinkedIn", "Dropbox", "Adobe"], "infostealer_found": true, "infostealer_count": 2, "risk_level": "HIGH", "risk_factors": ["2 devices with credentials for this domain found in infostealer logs"], "recommendation": "High risk. This vendor has significant breach and/or infostealer exposure. Audit their access to your systems, enforce MFA on any shared portals, and consider reducing their permission scope.", "dark_web_score": 72}], "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "Neither `vendor_domains` nor `vendor_emails` yielded a domain, or more than 10 distinct domains were supplied.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Neither `vendor_domains` nor `vendor_emails` yielded a domain, or more than 10 distinct domains were supplied."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.1, "x-billing-unit": "call"}}, "/v1/metered/identity-risk-score": {"post": {"operationId": "metered_identity_risk_score", "summary": "Score a domain 0-100 across six identity dimensions", "description": "A security credit score for any domain: breach exposure, infostealer density, IOC corpus presence, ransomware victim listing, active session exposure and CVE exposure. Returns the per-dimension breakdown as well as the total, so the score is auditable rather than a black box. MSPs embed this in QBRs, insurance renewals and onboarding assessments.\n\n**Billing.** $0.35 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Vendor and organisation risk"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Domain to score.", "examples": ["acme.com"]}}, "required": ["domain"]}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"domain": {"type": "string", "description": "The normalised domain."}, "risk_score": {"type": "integer", "description": "Total 0-100. Higher is worse.", "minimum": 0, "maximum": 100}, "risk_level": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "CRITICAL at 70+, HIGH at 45+, MEDIUM at 22+, otherwise LOW."}, "grade": {"type": "string", "enum": ["A", "B", "C", "D", "F"], "description": "F at 70+, D at 45+, C at 25+, B at 10+, otherwise A."}, "dimension_scores": {"type": "object", "description": "Per-dimension contribution to the total.", "properties": {"breach_exposure": {"type": "integer", "description": "0-25, scaled by accounts affected."}, "infostealer_density": {"type": "integer", "description": "0-25, scaled by stealer-log hit volume."}, "ioc_presence": {"type": "integer", "description": "0-15, attributed IOCs referencing the brand."}, "ransomware_victim": {"type": "integer", "description": "0 or 20."}, "session_exposure": {"type": "integer", "description": "0-10, stolen session records."}, "cve_exposure": {"type": "integer", "description": "0-25, weighted toward ransomware-linked KEV entries."}}}, "max_score": {"type": "integer", "description": "Always 100."}, "risk_factors": {"type": "array", "description": "Plain-English reasons, one per contributing dimension.", "items": {"type": "string", "description": "One factor."}}, "summary": {"type": "string", "description": "One-line summary of score, grade and dimensions triggered."}, "recommendation": {"type": "string", "description": "Recommended action."}}}}}, "example": {"ok": true, "data": {"domain": "acme.com", "risk_score": 48, "risk_level": "HIGH", "grade": "D", "dimension_scores": {"breach_exposure": 15, "infostealer_density": 10, "ioc_presence": 0, "ransomware_victim": 0, "session_exposure": 5, "cve_exposure": 18}, "max_score": 100, "risk_factors": ["Breach exposure: 3 known breach event(s), 2,410,000 accounts affected"], "summary": "Domain acme.com scores 48/100 (D - HIGH) across 4 of 6 monitored identity signal dimensions.", "recommendation": "MEDIUM: Elevated risk signals across multiple surfaces. Review breach history, enforce MFA, and monitor for escalation."}}}}}, "400": {"description": "`domain` is missing or contains no '.'.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`domain` is missing or contains no '.'."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.35, "x-billing-unit": "call"}}, "/v1/metered/bulk-identity-risk": {"post": {"operationId": "metered_bulk_identity_risk", "summary": "Score up to 10 organisations and their agent identities", "description": "Hierarchical scoring built for MSP weekly client sweeps and AI agent governance. Each domain is scored across the same six dimensions as identity-risk-score, and up to 5 agent or service-account identities per domain are scored across breach, infostealer and stolen-session signals. A CRITICAL agent automatically elevates its organisation to at least HIGH.\n\n**Billing.** $2.00 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** A target whose domain is unparseable does not fail the call: it comes back as an entry carrying `error`, and the remaining targets are still scored.", "tags": ["Vendor and organisation risk"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"targets": {"type": "array", "description": "Up to 10 target objects.", "items": {"type": "object", "description": "One organisation and its agent identities.", "properties": {"domain": {"type": "string", "description": "Organisation domain."}, "agents": {"type": "array", "description": "Up to 5 agent or service-account emails.", "items": {"type": "string", "description": "Email address.", "format": "email"}}}, "required": ["domain"]}}}, "required": ["targets"]}, "example": {"targets": [{"domain": "client-one.com", "agents": ["ci-bot@client-one.com"]}, {"domain": "client-two.com"}]}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"queried": {"type": "integer", "description": "Targets processed."}, "critical_count": {"type": "integer", "description": "Targets with a CRITICAL domain or agent."}, "high_count": {"type": "integer", "description": "Targets with a HIGH domain or agent."}, "results": {"type": "array", "description": "One entry per target, in the order supplied.", "items": {"type": "object", "description": "Scored target.", "properties": {"domain": {"type": "string", "description": "Organisation domain. `invalid` when the target could not be parsed."}, "error": {"type": "string", "description": "Present only when the domain was rejected."}, "domain_score": {"type": "integer", "description": "0-100."}, "domain_grade": {"type": "string", "enum": ["A", "B", "C", "D", "F"], "description": "Letter grade."}, "domain_risk": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "Domain risk level."}, "dimension_scores": {"type": "object", "description": "Per-dimension breakdown, same keys as identity-risk-score.", "properties": {}}, "domain_factors": {"type": "array", "description": "Reasons behind the domain score.", "items": {"type": "string", "description": "One factor."}}, "agents": {"type": "array", "description": "Scored agent identities.", "items": {"type": "object", "description": "One agent identity.", "properties": {"identity": {"type": "string", "description": "The agent email."}, "risk_score": {"type": "integer", "description": "0-100."}, "grade": {"type": "string", "enum": ["A", "B", "C", "D", "F"], "description": "Letter grade."}, "risk_level": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "Agent risk level."}, "risk_factors": {"type": "array", "description": "Reasons behind the agent score.", "items": {"type": "string", "description": "One factor."}}}}}, "agent_count": {"type": "integer", "description": "Agents scored for this domain."}, "highest_agent_risk": {"type": ["string", "null"], "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW", null], "description": "Worst agent risk level. null when no agents were supplied."}}}}, "summary": {"type": "string", "description": "One-line roll-up across all targets."}}}}}, "example": {"ok": true, "data": {"queried": 2, "critical_count": 0, "high_count": 1, "results": [{"domain": "client-one.com", "domain_score": 52, "domain_grade": "D", "domain_risk": "HIGH", "dimension_scores": {"breach_exposure": 20, "infostealer_density": 10, "ioc_presence": 0, "ransomware_victim": 0, "session_exposure": 5, "cve_exposure": 17}, "domain_factors": ["3 actively exploited CVEs affecting Client-one products (1 ransomware-linked)"], "agents": [{"identity": "ci-bot@client-one.com", "risk_score": 30, "grade": "C", "risk_level": "MEDIUM", "risk_factors": ["1 stolen session record(s) in criminal corpus"]}], "agent_count": 1, "highest_agent_risk": "MEDIUM"}], "summary": "0 CRITICAL, 1 HIGH risk identities across 2 domains."}}}}}, "400": {"description": "`targets` is missing, not a list, empty, or holds more than 10 entries.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`targets` is missing, not a list, empty, or holds more than 10 entries."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 2.0, "x-billing-unit": "call"}}, "/v1/metered/target-risk": {"post": {"operationId": "metered_target_risk", "summary": "Score how likely a domain is to be targeted", "description": "Correlates six signals -- ransomware victim listing, stealer-log hits, breach exposure, criminal channel mentions, high-EPSS CVEs and pre-ransomware credentials -- into a 0-100 score with a four-tier rating. Every contributing signal is returned with its weight, so the score can be explained to whoever has to act on it.\n\n**Billing.** $0.50 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** Each of the six signal lookups is independently fault-tolerant: one failing source lowers the score rather than failing the request, so treat a LOW score as 'no signals fired', not as a guarantee.", "tags": ["Vendor and organisation risk"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Domain to score. A leading `www.` is stripped.", "examples": ["acme.com"]}}, "required": ["domain"]}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"record_type": {"type": "string", "description": "Always `threat_prediction`."}, "domain": {"type": "string", "description": "The normalised domain."}, "target_risk_score": {"type": "integer", "description": "0-100. Higher is worse.", "minimum": 0, "maximum": 100}, "probability_tier": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "CRITICAL at 60+, HIGH at 35+, MEDIUM at 15+, otherwise LOW."}, "signals": {"type": "array", "description": "Only the signals that fired, each with the points it contributed.", "items": {"type": "object", "description": "One contributing signal.", "properties": {"signal": {"type": "string", "enum": ["ransomware_victim", "stealer_log_hits", "breach_exposure", "criminal_channel_mention", "high_epss_cves_active"], "description": "Signal identifier."}, "weight": {"type": "integer", "description": "Points this signal added to the total."}, "detail": {"type": "string", "description": "Plain-English explanation."}}}}, "recommendation": {"type": "string", "description": "Recommended action for the tier."}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"record_type": "threat_prediction", "domain": "acme.com", "target_risk_score": 45, "probability_tier": "HIGH", "signals": [{"signal": "breach_exposure", "weight": 10, "detail": "6 breaches, 214 accounts exposed"}, {"signal": "criminal_channel_mention", "weight": 15, "detail": "Domain observed in criminal Telegram channels"}, {"signal": "high_epss_cves_active", "weight": 20, "detail": "5 CVE(s) with >=50% exploitation probability active globally - CVE-2026-21042 (Remote code execution)"}], "recommendation": "HIGH risk: acme.com shows significant exposure signals. Rotate credentials, audit vendor access, and increase monitoring frequency.", "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "`domain` is missing or contains no '.'.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`domain` is missing or contains no '.'."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.5, "x-billing-unit": "call"}}, "/v1/metered/ransomware-risk": {"post": {"operationId": "metered_ransomware_risk", "summary": "Check a domain against ransomware leak sites", "description": "Queries 100+ active ransomware group leak sites for a victim listing, and counts credentials for the domain that appeared in stealer logs before the incident -- the pre-attack reconnaissance signal.\n\n**Billing.** $0.40 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Vendor and organisation risk"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Domain to check. A leading `www.` is stripped.", "examples": ["acme.com"]}}, "required": ["domain"]}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"domain": {"type": "string", "description": "The normalised domain."}, "on_victim_list": {"type": "boolean", "description": "True when claimed by at least one ransomware group."}, "victim_groups": {"type": "array", "description": "Groups claiming the victim.", "items": {"type": "string", "description": "Group name."}}, "first_seen": {"type": "string", "description": "Earliest listing date. Empty when not listed."}, "pre_ransomware_ioc_count": {"type": "integer", "description": "Credentials for this domain seen in stealer logs before the incident."}, "risk_level": {"type": "string", "enum": ["CRITICAL", "HIGH", "CLEAN"], "description": "CRITICAL when listed, HIGH when only pre-ransomware credentials exist, otherwise CLEAN."}, "recommendation": {"type": "string", "description": "Recommended action."}, "checked_at": {"type": "string", "format": "date-time", "description": "ISO 8601 UTC timestamp of when this check ran."}}}}}, "example": {"ok": true, "data": {"domain": "acme.com", "on_victim_list": false, "victim_groups": [], "first_seen": "", "pre_ransomware_ioc_count": 4, "risk_level": "HIGH", "recommendation": "4 credential(s) for acme.com appeared in criminal stealer logs before a ransomware incident was associated with this domain. These credentials may indicate pre-attack reconnaissance. Rotate any shared credentials with this organisation.", "checked_at": "2026-08-04T11:02:07.481923+00:00"}}}}}, "400": {"description": "`domain` is missing or contains no '.'.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`domain` is missing or contains no '.'."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "500": {"description": "Ransomware victim query failed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Ransomware victim query failed."}}}}}, "x-price-usd": 0.4, "x-billing-unit": "call"}}, "/v1/metered/brand-monitor": {"post": {"operationId": "metered_brand_monitor", "summary": "Find brand abuse across the IOC corpus", "description": "Scans the full IOC corpus for your brand name and classifies what it finds into phishing domains, malware C2 infrastructure, dark web mentions, and logo or image mentions extracted by OCR from infostealer-archive screenshots.\n\n**Billing.** $0.35 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Vendor and organisation risk"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"brand": {"type": "string", "description": "Brand name to search for. Minimum 3 characters, matched case-insensitively.", "minLength": 3}}, "required": ["brand"]}, "example": {"brand": "acme"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"brand": {"type": "string", "description": "The lowercased brand searched."}, "matched": {"type": "boolean", "description": "True when any mention was found."}, "total_mentions": {"type": "integer", "description": "Total corpus hits, capped at 500."}, "phishing_domains": {"type": "integer", "description": "Hits classified as phishing domains or URLs."}, "malware_c2": {"type": "integer", "description": "Hits carrying a malware family attribution."}, "dark_web_mentions": {"type": "integer", "description": "Hits from criminal channels or credential dumps."}, "image_logo_mentions": {"type": "integer", "description": "Hits from OCR of screenshots in infostealer archives."}, "hits": {"type": "object", "description": "Up to 20 sample hits per category.", "properties": {"phishing": {"type": "array", "description": "Phishing samples.", "items": {"type": "object", "description": "One indicator of compromise.", "properties": {"ioc_value": {"type": "string", "description": "The indicator itself."}, "ioc_type": {"type": "string", "description": "Indicator type: ip, domain, url, hash, email, wallet, image_text."}, "source": {"type": "string", "description": "Feed or criminal channel it was observed in."}, "malware": {"type": "string", "description": "Malware family it was observed alongside, lowercase. Empty when unattributed."}, "last_seen": {"type": "string", "description": "Most recent sighting timestamp."}}}}, "malware_c2": {"type": "array", "description": "Malware C2 samples.", "items": {"type": "object", "description": "One indicator of compromise.", "properties": {"ioc_value": {"type": "string", "description": "The indicator itself."}, "ioc_type": {"type": "string", "description": "Indicator type: ip, domain, url, hash, email, wallet, image_text."}, "source": {"type": "string", "description": "Feed or criminal channel it was observed in."}, "malware": {"type": "string", "description": "Malware family it was observed alongside, lowercase. Empty when unattributed."}, "last_seen": {"type": "string", "description": "Most recent sighting timestamp."}}}}, "dark_web": {"type": "array", "description": "Dark web samples.", "items": {"type": "object", "description": "One indicator of compromise.", "properties": {"ioc_value": {"type": "string", "description": "The indicator itself."}, "ioc_type": {"type": "string", "description": "Indicator type: ip, domain, url, hash, email, wallet, image_text."}, "source": {"type": "string", "description": "Feed or criminal channel it was observed in."}, "malware": {"type": "string", "description": "Malware family it was observed alongside, lowercase. Empty when unattributed."}, "last_seen": {"type": "string", "description": "Most recent sighting timestamp."}}}}, "image_logo": {"type": "array", "description": "Logo/image samples.", "items": {"type": "object", "description": "One indicator of compromise.", "properties": {"ioc_value": {"type": "string", "description": "The indicator itself."}, "ioc_type": {"type": "string", "description": "Indicator type: ip, domain, url, hash, email, wallet, image_text."}, "source": {"type": "string", "description": "Feed or criminal channel it was observed in."}, "malware": {"type": "string", "description": "Malware family it was observed alongside, lowercase. Empty when unattributed."}, "last_seen": {"type": "string", "description": "Most recent sighting timestamp."}}}}}}, "recommendation": {"type": "string", "description": "Recommended action."}}}}}, "example": {"ok": true, "data": {"brand": "acme", "matched": true, "total_mentions": 27, "phishing_domains": 14, "malware_c2": 6, "dark_web_mentions": 5, "image_logo_mentions": 2, "hits": {"phishing": [{"ioc_value": "acme-login-secure.com", "ioc_type": "domain", "source": "phishtank", "malware": "", "last_seen": "2026-08-02T14:31:00Z"}], "malware_c2": [], "dark_web": [], "image_logo": []}, "recommendation": "CRITICAL: active brand abuse detected in criminal infrastructure"}}}}}, "400": {"description": "`brand` is missing or shorter than 3 characters.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`brand` is missing or shorter than 3 characters."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.35, "x-billing-unit": "call"}}, "/v1/metered/bulk-ioc": {"post": {"operationId": "metered_bulk_ioc", "summary": "Enrich up to 100 indicators in one call", "description": "Built for SIEM log-enrichment pipelines. Submit up to 100 indicators of any type and get malware family, threat actor, confidence and first/last seen for each. Priced per batch, not per indicator.\n\n**Billing.** $0.50 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** A single indicator whose lookup fails is returned with `matched: false` and `error: query_failed` rather than failing the batch.", "tags": ["Threat intelligence"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"iocs": {"type": "array", "description": "1 to 100 indicators. Values are lowercased and trimmed; empty entries are dropped.", "items": {"type": "string", "description": "An IP, domain, URL, hash, email or wallet address."}}}, "required": ["iocs"]}, "example": {"iocs": ["185.220.101.44", "evil-c2.example", "d41d8cd98f00b204e9800998ecf8427e"]}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"queried": {"type": "integer", "description": "Indicators actually processed after dropping empties."}, "matched": {"type": "integer", "description": "Indicators found in the corpus."}, "results": {"type": "array", "description": "One entry per indicator, in the order supplied.", "items": {"type": "object", "description": "Enrichment for one indicator.", "properties": {"ioc_value": {"type": "string", "description": "The normalised indicator."}, "matched": {"type": "boolean", "description": "True when found in the corpus."}, "ioc_type": {"type": "string", "description": "Indicator type. Present only on a match."}, "source": {"type": "string", "description": "Feed or channel it was seen in. Present only on a match."}, "malware": {"type": "string", "description": "Malware family. Present only on a match."}, "threat_actor": {"type": "string", "description": "Attributed actor. Present only on a match."}, "confidence_score": {"type": "number", "description": "0.0 to 1.0. Present only on a match."}, "first_seen": {"type": "string", "description": "Earliest sighting. Present only on a match."}, "last_seen": {"type": "string", "description": "Most recent sighting. Present only on a match."}, "hit_count": {"type": "integer", "description": "Distinct sightings, capped at 5. Present only on a match."}, "error": {"type": "string", "description": "`query_failed` when this one indicator's lookup errored. Present only on failure."}}}}}}}}, "example": {"ok": true, "data": {"queried": 3, "matched": 1, "results": [{"ioc_value": "185.220.101.44", "matched": true, "ioc_type": "ip", "source": "@botnet_c2_feed", "malware": "mirai", "threat_actor": "", "confidence_score": 0.85, "first_seen": "2026-07-11T02:00:00Z", "last_seen": "2026-08-03T19:44:12Z", "hit_count": 4}, {"ioc_value": "evil-c2.example", "matched": false}, {"ioc_value": "d41d8cd98f00b204e9800998ecf8427e", "matched": false}]}}}}}, "400": {"description": "`iocs` is missing, not a list, empty, or holds more than 100 entries.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`iocs` is missing, not a list, empty, or holds more than 100 entries."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.5, "x-billing-unit": "call"}}, "/v1/metered/ioc-pivot": {"post": {"operationId": "metered_ioc_pivot", "summary": "Discover infrastructure related to one indicator", "description": "Given one known-malicious indicator, returns every related indicator sharing the same malware family -- surfacing a full C2 network from a single starting point.\n\n**Billing.** $0.20 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Threat intelligence"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"ioc": {"type": "string", "description": "The indicator to pivot from."}, "ioc_value": {"type": "string", "description": "Accepted as an alias for `ioc`. Use `ioc` for new integrations."}}, "description": "At least one of: `ioc`, `ioc_value`."}, "example": {"ioc": "185.220.101.44"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"ioc_value": {"type": "string", "description": "The normalised pivot indicator."}, "matched": {"type": "boolean", "description": "False when the pivot indicator is not in the corpus. `related` is then empty."}, "pivot_on": {"type": "string", "enum": ["malware_family", "source_feed"], "description": "What the pivot was performed on. Falls back to source feed when the seed carries no malware family."}, "pivot_value": {"type": "string", "description": "The family or feed name pivoted on."}, "seed_ioc_type": {"type": "string", "description": "Indicator type of the seed."}, "seed_source": {"type": "string", "description": "Feed or channel the seed came from."}, "seed_malware": {"type": "string", "description": "Malware family of the seed. Empty when unattributed."}, "related_count": {"type": "integer", "description": "Total related indicators found."}, "related": {"type": "array", "description": "Up to 50 related indicators.", "items": {"type": "object", "description": "One indicator of compromise.", "properties": {"ioc_value": {"type": "string", "description": "The indicator itself."}, "ioc_type": {"type": "string", "description": "Indicator type: ip, domain, url, hash, email, wallet, image_text."}, "source": {"type": "string", "description": "Feed or criminal channel it was observed in."}, "malware": {"type": "string", "description": "Malware family it was observed alongside, lowercase. Empty when unattributed."}, "last_seen": {"type": "string", "description": "Most recent sighting timestamp."}}}}}}}}, "example": {"ok": true, "data": {"ioc_value": "185.220.101.44", "matched": true, "pivot_on": "malware_family", "pivot_value": "mirai", "seed_ioc_type": "ip", "seed_source": "@botnet_c2_feed", "seed_malware": "mirai", "related_count": 38, "related": [{"ioc_value": "185.220.101.71", "ioc_type": "ip", "source": "@botnet_c2_feed", "malware": "mirai", "last_seen": "2026-08-03T20:02:55Z"}]}}}}}, "400": {"description": "`ioc` (or `ioc_value`) is missing or empty, or the corpus lookup failed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`ioc` (or `ioc_value`) is missing or empty, or the corpus lookup failed."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.2, "x-billing-unit": "call"}}, "/v1/metered/threat-actor": {"post": {"operationId": "metered_threat_actor", "summary": "Exploit chatter and threat actor lookup", "description": "Two actions on one endpoint, selected with `action`.\n\n`exploit-chatter` detects pre-publication CVE proof-of-concept discussion in criminal channels, with EPSS score and CISA KEV status.\n\n`actor-lookup` (the default) resolves a threat actor or malware campaign to its MITRE ATT&CK group, associated malware, and live indicators from RelayShield's corpus.\n\n**Billing.** $0.30 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Threat intelligence"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"action": {"type": "string", "enum": ["actor-lookup", "exploit-chatter"], "default": "actor-lookup", "description": "Which lookup to run."}, "cve_id": {"type": "string", "description": "Required when action is `exploit-chatter`. Format CVE-YYYY-NNNNN, case-insensitive.", "pattern": "^[Cc][Vv][Ee]-[0-9]{4}-[0-9]+$"}, "actor": {"type": "string", "description": "Actor or campaign name. Used when action is `actor-lookup`."}, "actors": {"type": "array", "description": "Up to 5 actor names, used when `actor` is not supplied.", "items": {"type": "string", "description": "Actor name."}}}, "description": "At least one of: `cve_id`, `actor`, `actors`."}, "example": {"action": "actor-lookup", "actor": "APT29"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"results": {"type": "array", "description": "actor-lookup only. One entry per search term.", "items": {"type": "object", "description": "Lookup result for one term.", "properties": {"term": {"type": "string", "description": "The term searched."}, "found": {"type": "boolean", "description": "True when indicators or a MITRE group were resolved."}, "ioc_count": {"type": "integer", "description": "Indicators found across the actor's associated malware."}, "ioc_breakdown": {"type": "object", "description": "Counts keyed by indicator type.", "properties": {}}, "sources": {"type": "array", "description": "Channels the indicators came from.", "items": {"type": "string", "description": "Channel."}}, "latest_ioc": {"type": "string", "description": "Most recent sighting timestamp."}, "mitre": {"type": "object", "description": "MITRE ATT&CK group detail.", "properties": {"group_name": {"type": "string", "description": "Canonical group name."}, "aliases": {"type": "array", "description": "Known aliases.", "items": {"type": "string", "description": "Alias."}}, "techniques": {"type": "array", "description": "Up to 10 technique IDs.", "items": {"type": "string", "description": "Technique ID, e.g. T1078."}}, "description": {"type": "string", "description": "Group description, truncated to 300 characters."}}}, "associated_malware": {"type": "array", "description": "Malware and tool names resolved via MITRE.", "items": {"type": "string", "description": "Malware name."}}, "sample_iocs": {"type": "array", "description": "Up to 5 example indicators.", "items": {"type": "object", "description": "Sample indicator.", "properties": {"value": {"type": "string", "description": "Indicator value."}, "type": {"type": "string", "description": "Indicator type."}, "malware": {"type": "string", "description": "Malware family."}, "seen_ts": {"type": "string", "description": "Sighting timestamp."}}}}}}}, "terms_searched": {"type": "integer", "description": "actor-lookup only. Number of terms processed."}, "cve_id": {"type": "string", "description": "exploit-chatter only. The uppercased CVE ID."}, "found": {"type": "boolean", "description": "exploit-chatter only. True when chatter or linked indicators exist."}, "risk_level": {"type": "string", "enum": ["HIGH", "MEDIUM", "LOW"], "description": "exploit-chatter only. HIGH with chatter, MEDIUM with only linked indicators, otherwise LOW."}, "chatter_count": {"type": "integer", "description": "exploit-chatter only. Distinct chatter records."}, "chatter_sources": {"type": "array", "description": "exploit-chatter only. Up to 5 source names.", "items": {"type": "string", "description": "Source."}}, "first_seen": {"type": "string", "description": "exploit-chatter only. Earliest chatter timestamp."}, "ioc_hits": {"type": "integer", "description": "exploit-chatter only. Indicators referencing the CVE."}, "in_kev": {"type": "boolean", "description": "exploit-chatter only. True when the CVE is in CISA KEV."}, "epss_score": {"type": "number", "description": "exploit-chatter only. EPSS exploitation probability, 0.0 to 1.0."}, "kev_date_added": {"type": "string", "description": "exploit-chatter only. Date added to KEV."}, "note": {"type": "string", "description": "exploit-chatter only. Interpretation of the result."}}}}}, "example": {"ok": true, "data": {"results": [{"term": "APT29", "found": true, "ioc_count": 46, "ioc_breakdown": {"domain": 28, "ip": 18}, "sources": ["@apt_tracking"], "latest_ioc": "2026-08-02T11:19:00Z", "mitre": {"group_name": "APT29", "aliases": ["Cozy Bear", "Midnight Blizzard"], "techniques": ["T1078", "T1566.002"], "description": "APT29 is a threat group attributed to Russia's Foreign Intelligence Service."}, "associated_malware": ["cobaltstrike", "wellmess"], "sample_iocs": [{"value": "cdn-update.example", "type": "domain", "malware": "wellmess", "seen_ts": "2026-08-02T11:19:00Z"}]}], "terms_searched": 1}}}}}, "400": {"description": "action is `exploit-chatter` and `cve_id` is missing or malformed, or action is `actor-lookup` and neither `actor` nor `actors` was supplied.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "action is `exploit-chatter` and `cve_id` is missing or malformed, or action is `actor-lookup` and neither `actor` nor `actors` was supplied."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.3, "x-billing-unit": "call"}}, "/v1/metered/cve-identity-risk": {"post": {"operationId": "metered_cve_identity_risk", "summary": "Correlate a CVE with a specific organisation's exposure", "description": "Closes the loop from vulnerability to live identity exposure. Combines CISA KEV status, EPSS, infostealer corpus hits for the exploiting malware families, ransomware victim listing and exploit chatter into one 0-100 score for a specific domain.\n\n**Billing.** $0.40 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Threat intelligence"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"cve_id": {"type": "string", "description": "CVE identifier. Format CVE-YYYY-NNNNN, case-insensitive.", "pattern": "^[Cc][Vv][Ee]-[0-9]{4}-[0-9]+$"}, "domain": {"type": "string", "description": "Domain to correlate against."}}, "required": ["cve_id", "domain"]}, "example": {"cve_id": "CVE-2026-21042", "domain": "acme.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"cve_id": {"type": "string", "description": "The uppercased CVE ID."}, "domain": {"type": "string", "description": "The lowercased domain."}, "risk_score": {"type": "integer", "description": "0-100. Higher is worse.", "minimum": 0, "maximum": 100}, "risk_level": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "CRITICAL at 75+, HIGH at 50+, MEDIUM at 25+, otherwise LOW."}, "in_kev": {"type": "boolean", "description": "True when the CVE is in CISA KEV."}, "epss_score": {"type": "number", "description": "EPSS exploitation probability, 0.0 to 1.0."}, "ransomware_linked": {"type": "boolean", "description": "True when the CVE is linked to known ransomware campaigns."}, "affected_product": {"type": "string", "description": "Product named on the KEV record."}, "exploiting_families": {"type": "array", "description": "Malware families known to exploit this CVE.", "items": {"type": "string", "description": "Family name."}}, "stealer_corpus_hits": {"type": "array", "description": "Where an exploiting family and the domain co-occur in the corpus.", "items": {"type": "object", "description": "One family correlation.", "properties": {"family": {"type": "string", "description": "Malware family."}, "ioc_count": {"type": "integer", "description": "Indicators matched."}, "latest": {"type": "string", "description": "Most recent sighting."}}}}, "on_ransomware_victim_list": {"type": "boolean", "description": "True when the domain appears on a ransomware leak site."}, "victim_groups": {"type": "array", "description": "Groups claiming the domain.", "items": {"type": "string", "description": "Group name."}}, "exploit_chatter_count": {"type": "integer", "description": "Pre-publication chatter signals for this CVE."}, "risk_factors": {"type": "array", "description": "One line per signal that contributed, with its reasoning.", "items": {"type": "string", "description": "One factor."}}, "recommendation": {"type": "string", "description": "Recommended action for the score band."}}}}}, "example": {"ok": true, "data": {"cve_id": "CVE-2026-21042", "domain": "acme.com", "risk_score": 55, "risk_level": "HIGH", "in_kev": true, "epss_score": 0.62, "ransomware_linked": true, "affected_product": "Acme Gateway", "exploiting_families": ["lockbit"], "stealer_corpus_hits": [], "on_ransomware_victim_list": false, "victim_groups": [], "exploit_chatter_count": 0, "risk_factors": ["CVE is in CISA KEV - confirmed active exploitation", "EPSS score 0.62 - top exploitation probability tier", "CVE is linked to known ransomware campaigns"], "recommendation": "HIGH PRIORITY: Multiple correlated signals indicate elevated exploitation risk for this domain. Verify patch status and review infostealer exposure."}}}}}, "400": {"description": "`cve_id` is missing or malformed, or `domain` is missing.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`cve_id` is missing or malformed, or `domain` is missing."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.4, "x-billing-unit": "call"}}, "/v1/metered/tech-stack-cve": {"post": {"operationId": "metered_tech_stack_cve", "summary": "Find CVEs actively targeting your declared stack", "description": "Pass the products you run, or a domain whose stored stack RelayShield already holds, and get back the KEV and high-EPSS CVEs that match. Covers AI agent orchestration frameworks (Langflow, LangChain, AutoGPT, CrewAI, Flowise, self-hosted n8n) and their common companion infrastructure, which is the exact vector used in the first documented autonomous-AI-agent ransomware operation.\n\n**Billing.** $0.20 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** The proof-of-concept lookup is deliberately bounded to the top 3 non-KEV matches. A CVE already in KEV is being exploited in the wild, which is a strictly stronger signal than a public PoC existing.", "tags": ["Threat intelligence"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"tech_stack": {"type": "array", "description": "Product names. Entries shorter than 3 characters are ignored.", "items": {"type": "string", "description": "Product name, e.g. `langflow`."}}, "domain": {"type": "string", "description": "Domain whose stored tech stack should be used. Only consulted when `tech_stack` is absent."}}, "description": "At least one of: `tech_stack`, `domain`."}, "example": {"tech_stack": ["langflow", "minio", "nacos"]}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"tech_stack_queried": {"type": "array", "description": "The stack actually used, whether supplied or loaded from the domain.", "items": {"type": "string", "description": "Product name."}}, "total_matches": {"type": "integer", "description": "CVEs matching the stack."}, "critical_count": {"type": "integer", "description": "Matches that are in KEV or ransomware-linked."}, "summary": {"type": "string", "description": "One-line roll-up."}, "critical_cves": {"type": "array", "description": "Up to 10 KEV or ransomware-linked matches.", "items": {"type": "object", "description": "A matched CVE.", "properties": {"cve_id": {"type": "string", "description": "CVE identifier."}, "matched_product": {"type": "string", "description": "Which stack entry matched."}, "epss_score": {"type": "number", "description": "EPSS exploitation probability."}, "in_kev": {"type": "boolean", "description": "True when in CISA KEV."}, "ransomware_campaign": {"type": "boolean", "description": "True when linked to a ransomware campaign."}, "cvss_score": {"type": ["number", "null"], "description": "CVSS base score. null when unscored."}, "description": {"type": "string", "description": "Description, truncated to 200 characters."}, "published": {"type": "string", "description": "Publication or KEV-addition date."}, "poc_available": {"type": "boolean", "description": "Present on up to 3 non-KEV matches: whether a public proof-of-concept exists."}}}}, "all_matches": {"type": "array", "description": "Up to 25 matches, sorted KEV first, then ransomware-linked, then by EPSS.", "items": {"type": "object", "description": "A matched CVE.", "properties": {}}}}}}}, "example": {"ok": true, "data": {"tech_stack_queried": ["langflow", "minio", "nacos"], "total_matches": 6, "critical_count": 2, "summary": "2 CRITICAL CVEs actively targeting your stack (KEV/ransomware-linked)", "critical_cves": [{"cve_id": "CVE-2025-3248", "matched_product": "langflow", "epss_score": 0.94, "in_kev": true, "ransomware_campaign": false, "cvss_score": 9.8, "description": "Langflow code validation endpoint permits unauthenticated remote code execution.", "published": "2025-04-09"}], "all_matches": []}}}}}, "400": {"description": "`tech_stack` is missing or not a list and no stored stack was found for `domain`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`tech_stack` is missing or not a list and no stored stack was found for `domain`."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.2, "x-billing-unit": "call"}}, "/v1/metered/asset-intel": {"post": {"operationId": "metered_asset_intel", "summary": "Register assets and sweep them against the IOC corpus", "description": "A watchlist scoped to your API key. `register` adds domains and IPs, `sweep` checks them against the 4.6M+ indicator corpus, `list` returns what is registered, `remove` deletes entries. Once a webhook is configured, new matches against registered assets are pushed to you automatically.\n\n**Billing.** $0.15 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** The watchlist is keyed on your API key, so a rotated key starts with an empty watchlist. Configure delivery with /v1/webhook/configure before registering assets if you want push alerts.", "tags": ["Threat intelligence"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"action": {"type": "string", "enum": ["sweep", "register", "list", "remove"], "default": "sweep", "description": "Operation to perform. Defaults to `sweep`."}, "assets": {"type": "array", "description": "Domains or IPs. Required for `register`. Optional for `sweep` -- when omitted, your registered watchlist is swept instead. `register` caps at 50 per call.", "items": {"type": "string", "description": "Domain or IP address."}}}}, "example": {"action": "register", "assets": ["acme.com", "203.0.113.15"]}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"matches": {"type": "array", "description": "sweep only. One entry per asset found in the corpus.", "items": {"type": "object", "description": "A matched asset.", "properties": {"asset": {"type": "string", "description": "The registered asset that matched."}, "ioc_type": {"type": "string", "description": "Indicator type."}, "source": {"type": "string", "description": "Feed or channel."}, "malware": {"type": "string", "description": "Malware family. Empty when unattributed."}, "confidence": {"type": "number", "description": "0.0 to 1.0."}, "first_seen": {"type": "string", "description": "Earliest sighting."}, "threat_actor": {"type": "string", "description": "Attributed actor. Empty when unattributed."}}}}, "assets_checked": {"type": "integer", "description": "sweep only. Assets swept."}, "match_count": {"type": "integer", "description": "sweep only. Assets that matched."}, "clean_count": {"type": "integer", "description": "sweep only. Assets that did not match."}, "registered": {"type": "array", "description": "register only. Assets successfully added.", "items": {"type": "string", "description": "Asset."}}, "count": {"type": "integer", "description": "register and list. Number of assets."}, "assets": {"type": "array", "description": "list only. Registered assets.", "items": {"type": "string", "description": "Asset."}}, "removed": {"type": "array", "description": "remove only. Assets requested for removal.", "items": {"type": "string", "description": "Asset."}}, "note": {"type": "string", "description": "Present on register, and on a sweep with an empty watchlist."}}}}}, "example": {"ok": true, "data": {"registered": ["acme.com", "203.0.113.15"], "count": 2, "note": "Push alerts will fire via your registered webhook when new IOCs match these assets."}}}}}, "400": {"description": "action is `register` and `assets` is empty.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "action is `register` and `assets` is empty."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "500": {"description": "Watchlist read or write failed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Watchlist read or write failed."}}}}}, "x-price-usd": 0.15, "x-billing-unit": "call"}}, "/v1/metered/wallet-risk": {"post": {"operationId": "metered_wallet_risk", "summary": "Screen a counterparty wallet address before transacting with it", "description": "Screens a wallet address across EVM, Solana, TON and Bitcoin for known scam, drainer, phishing, dark web and sanctions associations, and returns a risk level with the specific flags behind it. The chain is detected from the address format, so no chain parameter is needed.\n\nThis is the key-authenticated twin of `/v1/payg/wallet-risk`, added for callers who hold an API key rather than paying per call over x402. Same handler, same price, same response.\n\nRead `degraded` before you read `risk_flags`. When `degraded` is true an upstream source did not answer, so an empty flag list means the check did not complete rather than that the address is clean. Treat that as no verdict, never as a pass.\n\n**Billing.** $0.05 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.", "tags": ["Crypto"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"address": {"type": "string", "description": "Wallet address to screen. EVM (0x...), Solana, TON (EQ.../UQ...) or Bitcoin. The chain is inferred from the format.", "examples": ["0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045"]}}, "required": ["address"]}, "example": {"address": "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"observed_at": {"type": "string", "format": "date-time", "description": "When this verdict was observed. Cache keyed on this, not on receipt time."}, "valid_for_seconds": {"type": "integer", "description": "How long this verdict can be cached before it should be re-checked. Flagged results live 24 hours; clean results live 1 hour, because a hit stays a hit while a clean answer is the one that flips without telling whoever cached it. A degraded result lives 5 minutes. This is a caching hint and a policy default, not a measurement and not a safety guarantee: how fast a verdict really goes stale is bounded by upstream detection latency, which we do not control."}, "expires_at": {"type": "string", "format": "date-time", "description": "observed_at plus valid_for_seconds, precomputed."}, "degraded": {"type": "boolean", "description": "True when this answer was assembled from incomplete or failed upstream data. Treat it as NO VERDICT, never as clean. An outage that returns an empty finding list is otherwise indistinguishable from a real all-clear, and it fails in the permissive direction."}, "address": {"type": "string", "description": "The address that was screened, lowercased for EVM."}, "chain": {"type": "string", "description": "Detected chain: `evm`, `solana`, `ton` or `bitcoin`."}, "risk_level": {"type": "string", "description": "`HIGH`, `MEDIUM` or `LOW`. LOW with an empty `risk_flags` means nothing known, not a guarantee of safety."}, "risk_flags": {"type": "array", "description": "Specific findings. Empty when nothing is known about the address.", "items": {"type": "string", "description": "e.g. `linked to phishing`, `security blacklisted`, `dark web activity`."}}, "metadata": {"type": "object", "description": "Chain-specific detail. Bitcoin returns balance and transaction counts; TON returns contract type and account status. Any key ending in `_error` means that source failed, which is also what sets `degraded`.", "properties": {}}}}}}, "example": {"ok": true, "data": {"address": "0xd8da6bf26964af9d7eed9e03e53415d37aa96045", "chain": "evm", "risk_level": "LOW", "risk_flags": [], "metadata": {}}}}}}, "400": {"description": "`address` is missing, or the format matches no supported chain.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`address` is missing, or the format matches no supported chain."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credit balance and no active subscription.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.05, "x-billing-unit": "call"}}, "/v1/metered/crypto-intel": {"post": {"operationId": "metered_crypto_intel", "summary": "Screen an EVM address and optionally a token contract", "description": "Screens an EVM address for phishing, sanctions and cybercrime associations, and optionally screens a token contract for honeypot, mintable-supply, hidden-owner and sell-tax risk. Returns a composite rating plus cross-surface advisories pointing at the identity checks that pair with the finding.\n\n**Billing.** $0.30 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.\n\n**Note.** If the upstream screening provider is unreachable, the call still succeeds with empty flags rather than erroring. Treat an empty `address_flags` as 'no signal', not as a verified clean address.", "tags": ["Crypto"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"address": {"type": "string", "description": "EVM address: `0x` followed by 40 hex characters.", "pattern": "^0x[0-9a-fA-F]{40}$"}, "chain_id": {"type": "string", "description": "EVM chain ID as a string. Defaults to `1` (Ethereum mainnet).", "default": "1"}, "token_address": {"type": "string", "description": "Optional token contract to screen alongside the address. Same format as `address`."}}, "required": ["address"]}, "example": {"address": "0x0000000000000000000000000000000000000000", "chain_id": "1"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"observed_at": {"type": "string", "format": "date-time", "description": "When this verdict was observed. Cache keyed on this, not on receipt time."}, "valid_for_seconds": {"type": "integer", "description": "How long this verdict can be cached before it should be re-checked. Flagged results live 24 hours; clean results live 1 hour, because a hit stays a hit while a clean answer is the one that flips without telling whoever cached it. A degraded result lives 5 minutes. This is a caching hint and a policy default, not a measurement and not a safety guarantee: how fast a verdict really goes stale is bounded by upstream detection latency, which we do not control."}, "expires_at": {"type": "string", "format": "date-time", "description": "observed_at plus valid_for_seconds, precomputed."}, "degraded": {"type": "boolean", "description": "True when this answer was assembled from incomplete or failed upstream data. Treat it as NO VERDICT, never as clean. An outage that returns an empty finding list is otherwise indistinguishable from a real all-clear, and it fails in the permissive direction."}, "address": {"type": "string", "description": "The lowercased address."}, "chain_id": {"type": "string", "description": "The chain ID used."}, "composite_risk": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "CRITICAL on a critical address or token flag, HIGH on any address flag or token warning, MEDIUM on a warning-tier address flag, otherwise LOW."}, "address_flags": {"type": "array", "description": "Raw risk flags returned for the address.", "items": {"type": "string", "description": "Flag name, e.g. `phishing_activities`, `sanctioned`."}}, "correlation_advisories": {"type": "array", "description": "Cross-surface guidance naming the identity endpoints to call next.", "items": {"type": "string", "description": "One advisory."}}, "token_risk": {"type": "object", "description": "Present only when `token_address` was supplied and screening succeeded.", "properties": {"contract_address": {"type": "string", "description": "The token contract screened."}, "token_name": {"type": "string", "description": "Token name."}, "token_symbol": {"type": "string", "description": "Token symbol."}, "critical_flags": {"type": "array", "description": "Deal-breaker flags: honeypot, airdrop scam, fake token, sell tax at or above 50%.", "items": {"type": "string", "description": "Flag label."}}, "warning_flags": {"type": "array", "description": "Caution flags: pausable transfers, mintable supply, hidden owner, sell tax 10-49%.", "items": {"type": "string", "description": "Flag label."}}}}}}}}, "example": {"ok": true, "data": {"address": "0x0000000000000000000000000000000000000000", "chain_id": "1", "composite_risk": "LOW", "address_flags": [], "correlation_advisories": ["No risk signals detected on this address. For complete protection, monitor the associated email via /v1/metered/breach and phone via /v1/metered/sim-swap."]}}}}}, "400": {"description": "`address` is missing or is not a valid EVM address.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`address` is missing or is not a valid EVM address."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "402": {"description": "No credits and no active subscription. The response carries `topup_url`.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Insufficient credits and no active subscription.", "topup_url": "https://api.relayshield.net/developer/topup"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-price-usd": 0.3, "x-billing-unit": "call"}}, "/v1/metered/mcp-registry-risk": {"post": {"operationId": "metered_mcp_registry_risk", "summary": "Check an MCP server or package for registry risk", "description": "Reputation for the MCP ecosystem, where dedicated security tooling is still minimal industry-wide. Checks an MCP server URL or package name against RelayShield's criminal IOC corpus, runs typosquat and near-miss detection against well-known MCP domains (edit distance 2 or less), and checks domain registration age via RDAP.\n\n**A LOW verdict means no red flags, not verified safe.** Each check can only find what it looks for, and a brand-new malicious server that has not yet been reported will return LOW. When `findings` is empty the response carries a `note` saying exactly this.\n\n**Billing.** $0.35 per successful call, metered to your card. Failed calls are never billed. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge. Unlike the other metered endpoints this one does not check a prepaid credit balance before running, so it never returns `402`.\n\n**Note.** Each of the three checks is independently fault-tolerant: an unreachable RDAP or IOC lookup is skipped rather than failing the call, so it lowers the verdict instead of raising an error. Combined with the point above, treat `LOW` as 'nothing found by the checks that ran'. Also billed as an AWS Marketplace Bundle D dimension for bundle customers.", "tags": ["Agent and MCP security"], "security": [{"ApiKeyAuth": []}, {"ApiKeyAuthAlt": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"server_url": {"type": "string", "description": "Full MCP server URL. The hostname is extracted and a leading `www.` stripped. Supplying this enables all three checks.", "format": "uri", "examples": ["https://mcp.example-tools.io/sse"]}, "package_name": {"type": "string", "description": "Package name, used when there is no server URL. Package-name-only checks are limited to the IOC corpus, which has no dedicated MCP package coverage yet, so a name-only call always returns at least a `package_name_only` finding recording that reduced coverage."}}, "description": "At least one of: `server_url`, `package_name`."}, "example": {"server_url": "https://mcp.example-tools.io/sse"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"queried": {"type": "string", "description": "The `server_url` you supplied, or `package_name` when no URL was given."}, "domain": {"type": "string", "description": "Hostname extracted from `server_url`. Empty on a package-name-only call."}, "verdict": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "Highest finding severity, or `LOW` when there are none. `LOW` means nothing was found, not that the server is safe."}, "findings": {"type": "array", "description": "Every check that fired. Empty when nothing was found.", "items": {"type": "object", "description": "One finding.", "properties": {"type": {"type": "string", "enum": ["known_malicious_ioc", "typosquat_suspected", "newly_registered_domain", "package_name_only"], "description": "`known_malicious_ioc` (CRITICAL) the domain is in RelayShield's criminal IOC corpus. `typosquat_suspected` (HIGH) within edit distance 2 of a well-known MCP domain. `newly_registered_domain` (MEDIUM) registered under 30 days ago. `package_name_only` (LOW) not a risk signal, a coverage warning that no URL was supplied."}, "severity": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "Severity of this finding."}, "detail": {"type": "string", "description": "Plain-English explanation, including the matched domain or edit distance."}}}}, "note": {"type": ["string", "null"], "description": "Present and non-null only when `findings` is empty, stating that absence of findings means unknown rather than verified safe. null when there are findings."}}}}}, "example": {"ok": true, "data": {"queried": "https://mcp.example-tools.io/sse", "domain": "mcp.example-tools.io", "verdict": "MEDIUM", "findings": [{"type": "newly_registered_domain", "severity": "MEDIUM", "detail": "mcp.example-tools.io was registered 12 days ago"}], "note": null}}}}}, "400": {"description": "Neither `server_url` nor `package_name` supplied.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Neither `server_url` nor `package_name` supplied."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "429": {"description": "A shared demo key's daily quota is exhausted. Does not apply to your own key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "A shared demo key's daily quota is exhausted. Does not apply to your own key."}}}}}, "x-price-usd": 0.35, "x-billing-unit": "call"}}, "/v1/metered/prompt-injection-breach": {"post": {"operationId": "metered_prompt_injection_breach", "summary": "Find exposure from breaches that look AI-agent-sourced", "description": "Returns stolen session and credential records for an address where the source dump's own announcement text suggests an AI agent, rather than a traditional phishing or malware campaign, was involved in obtaining it.\n\n**This is a heuristic, not an attribution.** It is a keyword classifier over dump-announcement text, with no labelled ground truth. A match is a reason to look closer, and no match does not rule out an AI-agent-involved breach. For unfiltered stolen-session exposure on the same address, use `/v1/metered/session-risk`.\n\n**Billing.** $0.35 per successful call, metered to your card. Failed calls are never billed. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge. Unlike the other metered endpoints this one does not check a prepaid credit balance before running, so it never returns `402`.\n\n**Note.** Reads the same corpus as `/v1/metered/session-risk`, filtered to records the ingestion pipeline flagged as suspected-agentic-source. Also billed as an AWS Marketplace Bundle D dimension for bundle customers.", "tags": ["Agent and MCP security"], "security": [{"ApiKeyAuth": []}, {"ApiKeyAuthAlt": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"email": {"type": "string", "description": "Email address to check.", "format": "email"}}, "required": ["email"]}, "example": {"email": "user@example.com"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"email": {"type": "string", "description": "The normalised address that was checked."}, "found": {"type": "boolean", "description": "True when at least one record carries the suspected-agentic-source marker."}, "session_count": {"type": "integer", "description": "Number of matching records."}, "sessions": {"type": "array", "description": "Matching records. Unordered.", "items": {"type": "object", "description": "One record.", "properties": {"domain": {"type": "string", "description": "Service the stolen session or credential belongs to."}, "severity": {"type": "string", "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"], "description": "Severity derived from the service category."}, "service_category": {"type": "string", "description": "Category of the affected service, e.g. cloud_console, identity_provider, productivity."}, "channel_source": {"type": "string", "description": "Criminal channel or archive the record was collected from."}, "ingested_at": {"type": "string", "description": "When RelayShield ingested the record."}}}}, "note": {"type": "string", "description": "Present only when `found` is false. States that a non-match does not rule out an AI-agent-involved breach."}, "action_required": {"type": "string", "description": "Present only when `found` is true. Remediation guidance."}}}}}, "example": {"ok": true, "data": {"email": "user@example.com", "found": true, "session_count": 1, "sessions": [{"domain": "app.example-saas.com", "severity": "HIGH", "service_category": "productivity", "channel_source": "@agent_dumps", "ingested_at": "2026-07-27T15:03:22Z"}], "action_required": "This exposure surfaced from a dump whose own announcement text suggests an AI agent (rather than a traditional phishing/malware campaign) was involved in obtaining it. Treat with the same urgency as an active session hijack - revoke sessions and rotate credentials for the listed services."}}}}}, "400": {"description": "`email` is missing or contains no '@'.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`email` is missing or contains no '@'."}}}}, "401": {"description": "Missing or invalid API key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Missing or invalid API key."}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "429": {"description": "A shared demo key's daily quota is exhausted. Does not apply to your own key.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "A shared demo key's daily quota is exhausted. Does not apply to your own key."}}}}, "500": {"description": "Stolen-session corpus query failed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Stolen-session corpus query failed."}}}}}, "x-price-usd": 0.35, "x-billing-unit": "call"}}, "/v1/account/info": {"post": {"operationId": "account_info", "summary": "Return the account behind an API key", "description": "Free and unmetered. Used to confirm a key is live and to label a connected account. This is the endpoint RelayShield's own Zapier, n8n and Make integrations call to test a connection.\n\n**Billing.** Free. This endpoint is not metered.", "tags": ["Account"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {}, "description": "Send an empty JSON object."}, "example": {}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"plan": {"type": "string", "description": "Plan name on the key, e.g. `personal`."}, "intel_access": {"type": "boolean", "description": "True when the key carries a Threat Intelligence subscription."}, "calls_this_month": {"type": "integer", "description": "Metered calls made in the current month."}, "customer_id": {"type": "string", "description": "Billing customer ID. Empty for AWS Marketplace keys."}, "email": {"type": "string", "description": "Account email."}, "active": {"type": "boolean", "description": "False when the key has been deactivated."}}}}}, "example": {"ok": true, "data": {"plan": "personal", "intel_access": false, "calls_this_month": 148, "customer_id": "cus_QexampleID", "email": "dev@acme.com", "active": true}}}}}, "401": {"description": "The API key is missing, invalid or inactive.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "The API key is missing, invalid or inactive."}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}}}, "/v1/siem/configure": {"post": {"operationId": "siem_configure", "summary": "Register a SIEM or SOAR push destination", "description": "Free and unmetered. Configure one destination and real-time findings from breach, domain, infostealer, SIM swap, OAuth and dark-web-channel monitoring dispatch to it automatically, with no polling. Send a body with neither `format` nor `url` to disable delivery.\n\n**Billing.** Free. This endpoint is not metered.\n\n**Note.** The destination is keyed on the account email behind your API key, so one destination is held per account, not per key.", "tags": ["Account"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"format": {"type": "string", "enum": ["splunk_hec", "cef", "xsoar_webhook"], "description": "Wire format. `splunk_hec` for Splunk HTTP Event Collector, `cef` for QRadar and other CEF consumers, `xsoar_webhook` for Cortex XSOAR's Generic Webhook incident shape."}, "url": {"type": "string", "description": "Destination URL. Must be http:// or https://.", "format": "uri"}, "auth_token": {"type": "string", "description": "Token sent to the destination, e.g. a Splunk HEC token. Optional."}, "enabled": {"type": "boolean", "description": "Whether delivery is active. Defaults to true."}}, "description": "At least one of: `format`, `url`."}, "example": {"format": "splunk_hec", "url": "https://splunk.example.com:8088/services/collector", "auth_token": "your-hec-token", "enabled": true}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"format": {"type": "string", "description": "The registered format. Absent on a clear."}, "url": {"type": "string", "description": "The registered URL. Absent on a clear."}, "enabled": {"type": "boolean", "description": "Whether delivery is active. Absent on a clear."}, "status": {"type": "string", "enum": ["registered", "cleared"], "description": "`cleared` when the body carried neither format nor url."}}}}}, "example": {"ok": true, "data": {"format": "splunk_hec", "url": "https://splunk.example.com:8088/services/collector", "enabled": true, "status": "registered"}}}}}, "400": {"description": "`format` is not one of the three supported values, `url` is not an http:// or https:// URL, or the API key has no account email on file.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`format` is not one of the three supported values, `url` is not an http:// or https:// URL, or the API key has no account email on file."}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "500": {"description": "Storing the destination failed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Storing the destination failed."}}}}}}}, "/v1/webhook/configure": {"post": {"operationId": "webhook_configure", "summary": "Register a webhook for pushed findings", "description": "Free and unmetered. Registers one URL to receive findings (breach, infostealer, session hijack, ransomware victim listing, asset-intel matches) as they are detected, instead of polling. Post an empty `webhook_url` to clear the registration.\n\n**Billing.** Free. This endpoint is not metered.\n\n**Note.** Delivery is best-effort and fired inline with the originating call under a 6-second budget. A slow or failing endpoint never fails the API call that triggered it, so do not treat the webhook as a guaranteed-delivery channel -- poll for anything you must not miss.", "tags": ["Account"], "security": [{"ApiKeyAuth": []}, {"BearerAuth": []}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"webhook_url": {"type": "string", "description": "An `https://` URL to receive findings. Send an empty string to clear.", "format": "uri"}}, "required": ["webhook_url"]}, "example": {"webhook_url": "https://hooks.example.com/relayshield"}}}}, "responses": {"200": {"description": "Success. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object", "properties": {"webhook_url": {"type": "string", "description": "The registered URL, or an empty string after clearing."}, "status": {"type": "string", "enum": ["registered", "cleared"], "description": "`cleared` when an empty URL was posted."}}}}}, "example": {"ok": true, "data": {"webhook_url": "https://hooks.example.com/relayshield", "status": "registered"}}}}}, "400": {"description": "`webhook_url` is non-empty but is not an http:// or https:// URL.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "`webhook_url` is non-empty but is not an http:// or https:// URL."}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}, "500": {"description": "Storing the registration failed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Storing the registration failed."}}}}}}}, "/v1/payg/breach": {"post": {"operationId": "payg_breach", "summary": "Check an email address against known data breaches", "description": "Check whether an email address appears in known data breaches. Returns breach count, source names, dates, and exposed data types (passwords, emails, etc). Call before trusting a new user identity or granting elevated access.\n\n**Billing.** $0.10 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"email": {"type": "string", "description": "Email address to check"}}, "required": ["email"]}, "example": {"email": "user@example.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"email": "user@example.com", "breach_count": 3, "breaches": [{"name": "ExampleBreach", "domain": "example.com", "breach_date": "2023-06-01", "data_classes": ["Passwords", "Email addresses"], "is_verified": true}]}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.10 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.10", "amount_base_units": 100000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.1, "x-billing-unit": "call"}}, "/v1/payg/bulk-identity-risk": {"post": {"operationId": "payg_bulk_identity_risk", "summary": "Score up to 10 organisations and their agent identities", "description": "Score up to 10 organizational domains, each with up to 5 associated agent/employee emails, for combined breach/infostealer/session/CVE risk in one call. Built for enterprise AI-governance platforms scoring many identities per customer in one pass, the recommended entry point for agent-governance and identity-posture integrations.\n\n**Billing.** $2.00 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"targets": {"type": "array", "description": "Up to 10 domains, each with up to 5 agent emails", "items": {"type": "object", "properties": {"domain": {"type": "string"}, "agents": {"type": "array", "items": {"type": "string"}}}, "required": ["domain"]}}}, "required": ["targets"]}, "example": {"targets": [{"domain": "acme.com", "agents": ["ceo@acme.com"]}]}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"queried": 1, "critical_count": 0, "high_count": 0, "results": [{"domain": "acme.com", "domain_score": 10, "domain_grade": "A", "agent_count": 1}]}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$2.00 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "2.00", "amount_base_units": 2000000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 2.0, "x-billing-unit": "call"}}, "/v1/payg/cert-expiry": {"post": {"operationId": "payg_cert_expiry", "summary": "Check TLS certificate expiry from CT logs", "description": "Check how many days remain before a domain's TLS certificate expires, via Certificate Transparency logs. Call to catch a lapsing certificate before it causes an outage, especially relevant as CA/Browser Forum rules shrink standard certificate lifespans toward 47 days by 2029.\n\n**Billing.** $0.05 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Domain to check TLS certificate expiry for"}}, "required": ["domain"]}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"domain": "acme.com", "cert_found": true, "expires_at": "2026-09-05T00:00:00+00:00", "days_remaining": 46, "risk_level": "MEDIUM", "issued_at": "2026-06-07T00:00:00+00:00", "recommendation": "Certificate renews in 46 days, no action needed yet, but confirm your renewal automation is configured."}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.05 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.05", "amount_base_units": 50000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.05, "x-billing-unit": "call"}}, "/v1/payg/domain": {"post": {"operationId": "payg_domain", "summary": "Scan a domain for active phishing lookalikes", "description": "Scan a domain for phishing lookalikes: typosquats, homoglyphs, and common phishing registration patterns. Returns matched lookalike domains found in the wild. Call to detect brand-impersonation phishing campaigns targeting a company before they're reported elsewhere.\n\n**Billing.** $0.50 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Root domain to scan for lookalikes"}}, "required": ["domain"]}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"domain": "acme.com", "lookalikes_found": 2, "lookalikes": [{"domain": "acrne.com"}, {"domain": "acme-login.com"}], "candidates_checked": 30, "checked_at": "2026-05-19T10:00:00+00:00"}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.50 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.50", "amount_base_units": 500000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.5, "x-billing-unit": "call"}}, "/v1/payg/identity-graph": {"post": {"operationId": "payg_identity_graph", "summary": "Correlate an email to phones and domains seen alongside it", "description": "Correlate an email address against the criminal breach/stealer corpus to surface linked phone numbers, secondary domains, and other identifiers tied to the same compromised identity. Call to map the blast radius of a known compromise across an organization.\n\n**Billing.** $0.35 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"email": {"type": "string", "description": "Email address to correlate against the criminal dump corpus"}}, "required": ["email"]}, "example": {"email": "user@example.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"email": "user@example.com", "found": false, "correlated_identifiers": 0, "correlated_phones": [], "correlated_domains": [], "sources": []}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.35 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.35", "amount_base_units": 350000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.35, "x-billing-unit": "call"}}, "/v1/payg/identity-risk-score": {"post": {"operationId": "payg_identity_risk_score", "summary": "Score a domain 0-100 across six identity dimensions", "description": "Return a 0-100 domain security score across 6 identity-risk dimensions (breach exposure, infostealer density, ransomware exposure, session exposure, CVE exposure, threat-actor targeting) with a letter grade and plain-English risk factors. Call as a single-number identity health check before onboarding, financing, or partnering with a domain.\n\n**Billing.** $0.35 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Root domain to score"}}, "required": ["domain"]}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"domain": "acme.com", "risk_score": 10, "risk_level": "LOW", "grade": "A", "dimension_scores": {"breach_exposure": 5, "infostealer_density": 0, "threat_actor_targeting": 0, "ransomware_exposure": 0, "session_exposure": 0, "cve_exposure": 5}, "max_score": 100, "risk_factors": ["Breach exposure: 1 known breach event(s), 50,000 accounts affected"], "summary": "Domain acme.com scores 10/100 (A, LOW) across 2 of 6 monitored identity signal dimensions."}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.35 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.35", "amount_base_units": 350000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.35, "x-billing-unit": "call"}}, "/v1/payg/infostealer": {"post": {"operationId": "payg_infostealer", "summary": "Check an email address against infostealer malware logs", "description": "Check whether an email address's credentials were harvested by infostealer malware and appear in a criminal stealer-log marketplace, detected 24-72 hours ahead of public breach databases. Call to catch device-level compromise before stolen session cookies or saved passwords are used for account takeover.\n\n**Billing.** $0.15 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"email": {"type": "string", "description": "Email address to check for infostealer compromise"}}, "required": ["email"]}, "example": {"email": "user@example.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"email": "user@example.com", "found": false, "stealer_count": 0, "stealers": []}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.15 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.15", "amount_base_units": 150000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.15, "x-billing-unit": "call"}}, "/v1/payg/ip-intel": {"post": {"operationId": "payg_ip_intel", "summary": "Passive DNS and reputation for a domain or IP", "description": "Look up passive DNS resolution history and reputation for a domain or IP address. For a domain: which IPs it has resolved to over time. For an IP: which hostnames have resolved to it, plus malicious/suspicious vendor detection counts. Call to pivot from an indicator to its infrastructure history during an investigation.\n\n**Billing.** $0.10 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Domain to look up (returns reputation + passive DNS resolution history)"}, "ip": {"type": "string", "description": "Alternative: IP address to look up (returns reputation + reverse passive DNS)"}}}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"queried": "acme.com", "query_type": "domain", "reputation": 0, "malicious_votes": 0, "suspicious_votes": 0, "resolutions": [{"ip_address": "93.184.216.34", "date": "2026-06-01T00:00:00+00:00"}]}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.10 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.10", "amount_base_units": 100000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.1, "x-billing-unit": "call"}}, "/v1/payg/llm-credential-exposure": {"post": {"operationId": "payg_llm_credential_exposure", "summary": "Find exposed LLM and AI provider API keys", "description": "Check whether a domain's LLM/AI provider API keys (OpenAI, Anthropic, Google, Groq, xAI, Replicate) appear exposed in criminal stealer logs. This is LLMjacking, a fast-growing threat where a leaked key becomes a live, uncapped billing liability rather than just a data exposure. Call to catch an exposed key before the drain, not after the invoice.\n\n**Billing.** $0.40 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Your own domain"}, "vendor_domains": {"type": "array", "items": {"type": "string"}, "description": "Optional: vendor/supply-chain domains, up to 10"}}}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"domains_checked": 1, "found": false, "findings": [], "highest_severity": null, "providers_affected": []}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.40 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.40", "amount_base_units": 400000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.4, "x-billing-unit": "call"}}, "/v1/payg/mcp-registry-risk": {"post": {"operationId": "payg_mcp_registry_risk", "summary": "Check an MCP server or package for registry risk", "description": "Assess an MCP server URL for supply-chain and registry risk before your agent connects to it or grants it tool-calling access: flags unverified publishers, known-malicious servers, and other trust signals. Call before an autonomous agent adds a new MCP server to its toolset.\n\n**Billing.** $0.35 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"server_url": {"type": "string", "description": "URL of the MCP server to assess for registry/supply-chain risk"}}, "required": ["server_url"]}, "example": {"server_url": "https://example-mcp-server.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"verdict": "LOW", "findings": []}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.35 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.35", "amount_base_units": 350000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.35, "x-billing-unit": "call"}}, "/v1/payg/nft-security": {"post": {"operationId": "payg_nft_security", "summary": "Screen an NFT contract for known scam, wash-trading, or malicious-approval risk signals before your agent buys, bids on, or approves it", "description": "Screen an NFT contract for known scam, wash-trading, or malicious-approval risk signals before your agent buys, bids on, or approves it. Returns risk level and risk flags plus basic collection metadata. Call before an autonomous agent interacts with an unfamiliar NFT contract.\n\n**Billing.** $0.10 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"contract_address": {"type": "string", "description": "NFT contract address"}, "chain_id": {"type": "string", "description": "EVM chain ID (default: 1 for Ethereum)"}}, "required": ["contract_address"]}, "example": {"contract_address": "0xbc4ca0eda7647a8ab7c2061c2e118a18a936f13d", "chain_id": "1"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"contract_address": "0xbc4ca0eda7647a8ab7c2061c2e118a18a936f13d", "chain_id": "1", "risk_level": "LOW", "risk_flags": [], "nft_name": "Bored Ape Yacht Club", "nft_symbol": "BAYC", "raw": {}}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.10 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.10", "amount_base_units": 100000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.1, "x-billing-unit": "call"}}, "/v1/payg/nhi-exposure": {"post": {"operationId": "payg_nhi_exposure", "summary": "Find machine credentials in stealer logs", "description": "Check whether API keys or tokens tied to a domain, used by non-human identities like AI agents, service accounts, or CI/CD, appear exposed in criminal stealer logs. Call to audit whether the credentials an autonomous agent relies on have already been compromised upstream.\n\n**Billing.** $0.40 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Your own domain"}, "vendor_domains": {"type": "array", "items": {"type": "string"}, "description": "Optional: vendor/supply-chain domains, up to 10"}}}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"domains_checked": 1, "found": false, "findings": [], "highest_severity": null}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.40 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.40", "amount_base_units": 400000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.4, "x-billing-unit": "call"}}, "/v1/payg/oauth-watchlist": {"post": {"operationId": "payg_oauth_watchlist", "summary": "Find exposed OAuth tokens and SaaS credentials", "description": "Check whether an email address has OAuth-connected app credentials exposed in a known SaaS breach (GitHub, Slack, Notion, Zapier, and 30+ other high-risk OAuth-capable apps). Returns matched apps and direct revoke-access links. Call to detect supply-chain credential exposure via connected apps.\n\n**Billing.** $0.30 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"email": {"type": "string", "description": "Email address to check for OAuth exposure"}}, "required": ["email"]}, "example": {"email": "user@example.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"email": "user@example.com", "matched_count": 1, "matched_apps": [{"app": "GitHub", "breach_date": "2023-01-15", "data_classes": ["Usernames", "Email addresses"], "revoke_url": "https://github.com/settings/applications"}], "recommendation": "Revoke OAuth access for matched apps immediately.", "checked_at": "2026-05-19T10:00:00+00:00"}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.30 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.30", "amount_base_units": 300000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.3, "x-billing-unit": "call"}}, "/v1/payg/prompt-injection-breach": {"post": {"operationId": "payg_prompt_injection_breach", "summary": "Find exposure from breaches that look AI-agent-sourced", "description": "Check whether an email address tied to an AI agent session has an active stolen session or credential exposure that could enable a prompt-injection-driven account takeover. Call to audit whether an agent's own session integrity has already been compromised upstream, not just what the agent is being asked to do.\n\n**Billing.** $0.35 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"email": {"type": "string", "description": "Email address to check for agent-session compromise from a prompt-injection-driven breach"}}, "required": ["email"]}, "example": {"email": "user@example.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"found": false, "session_count": 0}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.35 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.35", "amount_base_units": 350000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.35, "x-billing-unit": "call"}}, "/v1/payg/ransomware-risk": {"post": {"operationId": "payg_ransomware_risk", "summary": "Check a domain against ransomware leak sites", "description": "Check whether a domain appears on a known ransomware group's victim/leak-site list, and whether pre-ransomware credential harvesting was detected beforehand. Call to assess active ransomware exposure for a domain, not just historical breach history.\n\n**Billing.** $0.40 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Domain to check against the ransomware victim list"}}, "required": ["domain"]}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"domain": "acme.com", "on_victim_list": false, "pre_ransomware_credential_count": 0}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.40 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.40", "amount_base_units": 400000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.4, "x-billing-unit": "call"}}, "/v1/payg/scan-file": {"post": {"operationId": "payg_scan_file", "summary": "Scan a file (via its public download URL) for malware using VirusTotal's multi-engine analysis", "description": "Scan a file (via its public download URL) for malware using VirusTotal's multi-engine analysis. Returns an async analysis ID to poll. Call before an agent downloads, opens, or executes a file attachment from an untrusted source.\n\n**Billing.** $0.10 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"file_url": {"type": "string", "description": "Publicly accessible download URL"}, "filename": {"type": "string", "description": "Optional filename hint for AV engines"}}, "required": ["file_url"]}, "example": {"file_url": "https://cdn.example.com/invoice.pdf", "filename": "invoice.pdf"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"status": "pending", "target": "https://cdn.example.com/invoice.pdf", "filename": "invoice.pdf", "analysis_id": "f-abc123def456", "poll_endpoint": "/v1/result/f-abc123def456", "note": "Poll /v1/result/{analysis_id} every 5s until status is completed"}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.10 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.10", "amount_base_units": 100000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.1, "x-billing-unit": "call"}}, "/v1/payg/scan-url": {"post": {"operationId": "payg_scan_url", "summary": "Scan a URL for phishing or malware using heuristic signals (Google Safe Browsing, RDAP domain age, known IOC corpus) plus VirusTotal multi-engine analysis", "description": "Scan a URL for phishing or malware using heuristic signals (Google Safe Browsing, RDAP domain age, known IOC corpus) plus VirusTotal multi-engine analysis. Returns an async analysis ID to poll. Call before an agent clicks, fetches, or shares a link from an untrusted source.\n\n**Billing.** $0.05 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"url": {"type": "string", "description": "URL to scan (must start with http:// or https://)"}}, "required": ["url"]}, "example": {"url": "https://suspicious-site.example.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"status": "pending", "target": "https://suspicious-site.example.com", "analysis_id": "u-abc123def456", "poll_endpoint": "/v1/result/u-abc123def456", "note": "Poll /v1/result/{analysis_id} every 5s until status is completed"}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.05 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.05", "amount_base_units": 50000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.05, "x-billing-unit": "call"}}, "/v1/payg/scan-wallet": {"post": {"operationId": "payg_scan_wallet", "summary": "Screen an EVM wallet address for known scam, exploit, or sanctions-list association before your agent transacts with it", "description": "Screen an EVM wallet address for known scam, exploit, or sanctions-list association before your agent transacts with it. Returns a risk level and specific risk flags. Call before an autonomous agent sends funds to or interacts with an unfamiliar wallet.\n\n**Billing.** $0.10 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"address": {"type": "string", "description": "EVM wallet address (0x + 40 hex chars)"}, "chain_id": {"type": "string", "description": "EVM chain ID: 1=ETH, 8453=Base, 137=Polygon"}}, "required": ["address"]}, "example": {"address": "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045", "chain_id": "1"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"address": "0xd8da6bf26964af9d7eed9e03e53415d37aa96045", "chain_id": "1", "risk_level": "LOW", "risk_flags": [], "raw": {}}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.10 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.10", "amount_base_units": 100000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.1, "x-billing-unit": "call"}}, "/v1/payg/secret-scan": {"post": {"operationId": "payg_secret_scan", "summary": "Find published secrets across six public artifact sources", "description": "Scan public GitHub repositories, npm and PyPI packages, Docker Hub images, Hugging Face models and Spaces, and Postman public workspaces and collections for API keys, tokens and credentials already published against a domain. Repo-only scanners miss credentials shipped inside released packages and images. Every hit is verified against the credential pattern before it is reported.\n\n**Billing.** $0.35 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Your own domain"}, "vendor_domains": {"type": "array", "items": {"type": "string"}, "description": "Optional: vendor domains, up to 5"}}}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"domains_checked": 1, "found": false, "findings": [], "highest_severity": null}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.35 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.35", "amount_base_units": 350000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.35, "x-billing-unit": "call"}}, "/v1/payg/secret-scan-text": {"post": {"operationId": "payg_secret_scan_text", "summary": "Scan supplied text or a diff for secrets", "description": "\n\n**Billing.** $0.05 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"content": {"type": "string", "description": "Raw file content to scan. Mutually exclusive with `diff`."}, "diff": {"type": "string", "description": "Unified diff. Only added lines are scanned. Mutually exclusive with `content`."}, "filename": {"type": "string", "description": "Optional filename, echoed on each finding as `file`. Used with `content`."}}}, "example": {"diff": "--- a/config.py\n+++ b/config.py\n@@ -1,2 +1,3 @@\n import os\n+AWS_SECRET = \"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\"\n"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 1 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.05 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.05", "amount_base_units": 50000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 1, "payment_required_status": 402}, "x-price-usd": 0.05, "x-billing-unit": "call"}}, "/v1/payg/session-risk": {"post": {"operationId": "payg_session_risk", "summary": "Detect stolen session cookies before they are used", "description": "Check whether an email address has an active stolen session cookie circulating in a criminal archive, a signal of account takeover that bypasses password resets and 2FA entirely. Call to detect AiTM/session-hijack attacks before an authenticated agent session is trusted.\n\n**Billing.** $0.30 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"email": {"type": "string", "description": "Email address to check for active session/AiTM exposure"}}, "required": ["email"]}, "example": {"email": "user@example.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"email": "user@example.com", "found": false, "session_count": 0, "highest_severity": null, "sessions": []}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.30 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.30", "amount_base_units": 300000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.3, "x-billing-unit": "call"}}, "/v1/payg/sim-swap": {"post": {"operationId": "payg_sim_swap", "summary": "Detect a recent SIM swap or carrier port", "description": "Check whether a phone number has had a SIM swap or carrier port in the last 24 hours via real-time carrier lookup. A recent swap is a strong signal of an active account-takeover attempt targeting SMS-based 2FA. Call before trusting an SMS OTP from this number.\n\n**Billing.** $0.25 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"phone": {"type": "string", "description": "Phone number in E.164 format"}}, "required": ["phone"]}, "example": {"phone": "+14155551234"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"phone": "+14155551234", "swapped": true, "swap_timestamp": "2026-05-18T14:23:00Z", "carrier": "T-Mobile", "checked_at": "2026-05-19T10:00:00+00:00"}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.25 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.25", "amount_base_units": 250000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.25, "x-billing-unit": "call"}}, "/v1/payg/supply-chain": {"post": {"operationId": "payg_supply_chain", "summary": "Assess breach and infostealer risk across vendors", "description": "Check up to 10 vendor domains for combined breach, infostealer, and dark-web risk exposure in one call. Returns a composite risk score per vendor. Call to assess third-party API/vendor risk before an agent integrates with or continues calling an external service.\n\n**Billing.** $0.10 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"vendor_domains": {"type": "array", "items": {"type": "string"}, "description": "Up to 10 vendor domains"}, "vendor_emails": {"type": "array", "items": {"type": "string"}, "description": "Alternative: vendor contact emails, domain extracted automatically"}}}, "example": {"vendor_domains": ["acme.com", "vendor2.com"]}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"domains_checked": 1, "highest_risk": "LOW", "results": [{"domain": "acme.com", "risk_level": "LOW", "breach_count": 0, "infostealer_found": false}]}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.10 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.10", "amount_base_units": 100000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.1, "x-billing-unit": "call"}}, "/v1/payg/target-risk": {"post": {"operationId": "payg_target_risk", "summary": "Score how likely a domain is to be targeted", "description": "Score a domain's probability of being an active or upcoming cyberattack target using a 6-signal correlation model (breach, infostealer, ransomware, session, CVE, and threat-actor targeting history). Call for proactive risk triage, not just after-the-fact breach checking.\n\n**Billing.** $0.50 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"domain": {"type": "string", "description": "Domain to score (e.g. acme.com)"}}, "required": ["domain"]}, "example": {"domain": "acme.com"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"domain": "acme.com", "target_risk_score": 0, "probability_tier": "LOW", "signals": []}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.50 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.50", "amount_base_units": 500000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.5, "x-billing-unit": "call"}}, "/v1/payg/tech-stack-cve": {"post": {"operationId": "payg_tech_stack_cve", "summary": "Find CVEs actively targeting your declared stack", "description": "Check a declared technology stack (e.g. nginx, WordPress, Cisco IOS) against actively-exploited CVEs (CISA KEV) and high-EPSS-score vulnerabilities. Call before deploying or continuing to run a given technology stack in production.\n\n**Billing.** $0.20 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"tech_stack": {"type": "array", "items": {"type": "string"}, "description": "Declared technology product names"}, "domain": {"type": "string", "description": "Alternative: pull tech_stack from a stored user profile by domain"}}}, "example": {"tech_stack": ["nginx", "wordpress", "cisco ios"]}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"tech_stack_queried": ["nginx"], "matched_cves": [], "critical_count": 0}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.20 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.20", "amount_base_units": 200000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.2, "x-billing-unit": "call"}}, "/v1/payg/token-security": {"post": {"operationId": "payg_token_security", "summary": "Screen an ERC-20/BEP-20 token contract for honeypot, mintable-supply, hidden-owner, and other rug-pull risk signals before your agent trades it", "description": "Screen an ERC-20/BEP-20 token contract for honeypot, mintable-supply, hidden-owner, and other rug-pull risk signals before your agent trades it. Returns risk level, specific critical/warning flags, and basic token metadata. Call before an autonomous trading agent buys or approves spending on an unfamiliar token.\n\n**Billing.** $0.05 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"contract_address": {"type": "string", "description": "EVM token contract address"}, "chain_id": {"type": "string", "description": "EVM chain ID (default: 1 for Ethereum)"}}, "required": ["contract_address"]}, "example": {"contract_address": "0x6982508145454ce325ddbe47a25d4ec3d2311933", "chain_id": "1"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"contract_address": "0x6982508145454ce325ddbe47a25d4ec3d2311933", "chain_id": "1", "risk_level": "HIGH", "critical_flags": ["honeypot"], "warning_flags": ["mintable supply"], "token_name": "Example Token", "token_symbol": "EXT", "holder_count": "12345", "raw": {}}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.05 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.05", "amount_base_units": 50000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.05, "x-billing-unit": "call"}}, "/v1/payg/wallet-risk": {"post": {"operationId": "payg_wallet_risk", "summary": "Screen a wallet address across EVM, Solana, TON, or Bitcoin for known scam, exploit, drainer, or sanctions-list association before your agent transacts with it", "description": "Screen a wallet address across EVM, Solana, TON, or Bitcoin for known scam, exploit, drainer, or sanctions-list association before your agent transacts with it. Returns a risk level and specific risk flags. The recommended first call for any autonomous trading or DeFi agent before interacting with a new counterparty wallet. Every verdict carries a freshness contract: `observed_at`, `valid_for_seconds` and `expires_at` tell a caller how long the answer can be cached before it must be paid for again. The TTL is deliberately asymmetric, since a flagged address stays flagged while a clean verdict is the one that flips without warning: flagged 24h, clean 1h, and 5m when `degraded` is true because an upstream source was unavailable.\n\n**Billing.** $0.05 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"address": {"type": "string", "description": "Wallet address: EVM (0x), Solana (base58), TON (EQ.../UQ...), or Bitcoin"}}, "required": ["address"]}, "example": {"address": "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045"}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"address": "0xd8da6bf26964af9d7eed9e03e53415d37aa96045", "chain": "evm", "risk_level": "LOW", "risk_flags": [], "metadata": {}, "observed_at": "2026-08-08T00:31:04.812000+00:00", "valid_for_seconds": 3600, "expires_at": "2026-08-08T01:31:04.812000+00:00", "degraded": false}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.05 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.05", "amount_base_units": 50000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.05, "x-billing-unit": "call"}}, "/v1/payg/wallet-screen-batch": {"post": {"operationId": "payg_wallet_screen_batch", "summary": "Screen up to 10 wallet addresses (any chain: EVM, Solana, TON, Bitcoin) for known scam or exploit association in a single call", "description": "Screen up to 10 wallet addresses (any chain: EVM, Solana, TON, Bitcoin) for known scam or exploit association in a single call. Returns per-address risk level and flags. Use for bulk counterparty screening in trading or portfolio-monitoring agent workflows. Each result carries its own freshness contract (`observed_at`, `valid_for_seconds`, `expires_at`, `degraded`) rather than one TTL for the batch, because a flagged address, a clean one and one whose upstream errored have legitimately different lifetimes.\n\n**Billing.** $0.50 in USDC per call over x402, on Base or Solana. No API key, no signup and no\nsubscription. Send the request with no payment header, take the `402` challenge that comes back,\npay it, and repeat the request. Only successful calls are charged.\n", "tags": ["x402 pay-per-call"], "security": [], "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "properties": {"addresses": {"type": "array", "items": {"type": "string"}, "maxItems": 10, "description": "Up to 10 wallet addresses (any chain: EVM, Solana, TON, Bitcoin)"}}, "required": ["addresses"]}, "example": {"addresses": ["0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045", "9WzDXwBbmkg8ZTbNMqUxvQRAyrZzDsGYdLVL9zYtAWWM"]}}}}, "responses": {"200": {"description": "Payment settled and the check ran. `ok` is true and `data` holds the result.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "data"], "properties": {"ok": {"type": "boolean", "const": true}, "data": {"type": "object"}}}, "example": {"ok": true, "data": {"screened": 2, "high_risk": 0, "results": [{"address": "0xd8da6bf26964af9d7eed9e03e53415d37aa96045", "chain": "evm", "risk_level": "LOW", "risk_flags": [], "observed_at": "2026-08-08T00:31:04.812000+00:00", "valid_for_seconds": 3600, "expires_at": "2026-08-08T01:31:04.812000+00:00", "degraded": false, "error": null}, {"address": "9WzDXwBbmkg8ZTbNMqUxvQRAyrZzDsGYdLVL9zYtAWWM", "chain": "solana", "risk_level": "LOW", "risk_flags": [], "observed_at": "2026-08-08T00:31:04.907000+00:00", "valid_for_seconds": 3600, "expires_at": "2026-08-08T01:31:04.907000+00:00", "degraded": false, "error": null}]}}}}}, "400": {"description": "A required field is missing or malformed. Never billed.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "address is required"}}}}, "402": {"description": "Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.", "content": {"application/json": {"schema": {"type": "object", "required": ["ok", "error", "x402"], "properties": {"ok": {"type": "boolean", "const": false}, "error": {"type": "string", "const": "Payment required"}, "price": {"type": "string", "description": "Human-readable price, e.g. `$0.05 USDC (Base or Solana)`."}, "x402": {"type": "object", "description": "The x402 payment challenge.", "properties": {"x402Version": {"type": "integer", "description": "Protocol version of this challenge."}, "resource": {"type": "object", "description": "What is being paid for.", "properties": {}}, "accepts": {"type": "array", "description": "One entry per accepted network.", "items": {"type": "object"}}, "extensions": {"type": "object", "description": "Discovery metadata, including the Bazaar input and output schemas.", "properties": {}}}}}}, "example": {"ok": false, "error": "Payment required", "price": "$0.50 USDC (Base or Solana)"}}}}, "405": {"description": "Wrong HTTP method. Every endpoint is POST.", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}, "example": {"ok": false, "error": "Wrong HTTP method. Every endpoint is POST."}}}}}, "x-payment-info": {"price": {"mode": "fixed", "currency": "USD", "amount": "0.50", "amount_base_units": 500000, "asset": "USDC", "decimals": 6}, "protocols": [{"x402": {}}], "networks": ["eip155:8453", "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"], "x402_version": 2, "payment_required_status": 402}, "x-price-usd": 0.5, "x-billing-unit": "call"}}}}