# Account Takeover Risk Score (ATO Assessment)

> Account Takeover Risk Score (ATO Assessment) is a paid API for AI agents from api.agentstools.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Fuses a k-anonymity password breach check with domain breach history into a single account-takeover risk score (0–100) with category, per-signal reasons, and raw signals.

## Facts

- Endpoint: POST https://api.agentstools.dev/breach/assess
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/account-takeover-risk-score-ato-assessment-6cdb382b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_0i9TY5-My95_r9HdCA4rq

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability account-takeover-risk-score-ato-assessment-6cdb382b -d '<json body>'
```

Example prompt: Can you check the account takeover risk for the password 'SunnyDay2023!' combined with the domain gmail.com — I need the risk score, category, and any breach signals so I know if this credential is exposed?

## When to prefer this

Choose this endpoint when you need a privacy-preserving, fused ATO risk signal that combines password breach exposure (via k-anonymity, no plaintext transmission) with domain-level breach history in a single scored output. Prefer it over raw HIBP lookups when you want a composite score with actionable categories and reasons rather than a raw count, and when the domain context matters for risk assessment.

## Known failure modes

- Missing required body fields (password, sha1, or ntlm) returns a 400 validation error
- Invalid SHA-1 or NTLM hash format (wrong length or non-hex characters) causes a parsing error
- Domain lookup may return no breach data if the domain is not in known breach databases
- Network timeout contacting upstream breach data sources may delay or fail the response
- Ambiguous domain input (e.g. bare IP addresses) may yield no domain-level signals

## How this service works

Composite account-takeover risk score (0-100) fusing a privacy-preserving password exposure check with a domain's known breach history. The password is hashed locally (k-anonymity, never transmitted). Returns ato_risk_score, a category, per-signal reasons and the raw signals so the agent can re-rank. Risk indicators, not a guarantee.

## Output

Returns a numeric ato_risk_score (0–100), a risk category label (e.g. low/medium/high/critical), human-readable per-signal reasons explaining which factors drove the score, and raw signals including password exposure count and domain breach records — enabling downstream re-ranking or threshold-based gating.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ntlm": {
   "type": "string",
   "description": "Alternative to password: a full 32-hex NTLM hash"
  },
  "sha1": {
   "type": "string",
   "description": "Alternative to password: a full 40-hex SHA-1 hash"
  },
  "domain": {
   "type": "string",
   "description": "Optional domain to fold in its known breach history"
  },
  "password": {
   "type": "string",
   "description": "Plaintext password — hashed locally with SHA-1; never stored, logged or transmitted"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/account-takeover-risk-score-ato-assessment-6cdb382b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.agentstools.dev](https://www.zero.xyz/host/api.agentstools.dev/llms.txt)