# Identity Graph - Email-to-Breach Correlation

> Identity Graph - Email-to-Breach Correlation is a paid API for AI agents from atq6wtkp6k.execute-api.us-east-1.amazonaws.com, paid per call via x402, $0.35/call, status unknown (last checked 2026-09-14).

Correlates an email address against criminal breach and infostealer corpora to surface linked phone numbers, domains, and other identifiers tied to the same compromised identity.

## Facts

- Endpoint: POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/identity-graph
- Price: $0.35/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/identity-graph-email-to-breach-correlation-c11d8a11
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_IO_1cuO0FC6oT1Hqyd4k2

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability identity-graph-email-to-breach-correlation-c11d8a11 -d '<json body>'
```

Example prompt: Can you check what phone numbers, domains, and other identifiers are linked to jane.doe@acmecorp.com in criminal breach and infostealer databases — I need to understand the full blast radius of her compromised identity.

## When to prefer this

Use this endpoint when you need to understand the full identity footprint of a known compromised email — specifically to surface linked phone numbers, domains, and cross-account identifiers from criminal breach and infostealer data. Prefer this over simple breach-check endpoints when you need lateral identity mapping rather than just a yes/no compromise confirmation. Ideal for incident response blast-radius assessments, supply chain vetting, and insider threat investigations.

## Known failure modes

- Email not found in corpus (found: false, empty arrays returned)
- Invalid or malformed email address causes 400 validation error
- API timeout or 5xx error if corpus query is slow
- Empty arrays returned when email is found but no correlated identifiers exist in the dataset
- Rate limiting or payment failure causes 402/429 response

## How this service works

Correlate an email address against the criminal breach/stealer corpus to surface linked phone numbers, secondary domains, and other identifiers tied to the same compromised identity. Call to map the blast radius of a known compromise across an organization.

## Output

Returns a JSON object with a found boolean indicating whether the email appears in the criminal corpus, an array of breach/stealer sources, arrays of correlated phone numbers and secondary domains linked to the same compromised identity, and a count of total correlated identifiers.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "email": {
   "type": "string",
   "description": "Email address to correlate against the criminal dump corpus"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/identity-graph-email-to-breach-correlation-c11d8a11/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com](https://www.zero.xyz/host/atq6wtkp6k.execute-api.us-east-1.amazonaws.com/llms.txt)