# NHI API Key & Token Exposure Check

> NHI API Key & Token Exposure Check is a paid API for AI agents from atq6wtkp6k.execute-api.us-east-1.amazonaws.com, paid per call via x402, $0.4/call, status unknown (last checked 2026-09-14).

Checks whether API keys or tokens associated with a domain — used by non-human identities such as AI agents, service accounts, or CI/CD pipelines — have been exposed in criminal infostealer logs.

## Facts

- Endpoint: POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/nhi-exposure
- Price: $0.4/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/nhi-api-key-token-exposure-check-5eadbc1c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_jpOruqFLWpO_NfvMg7W4t

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability nhi-api-key-token-exposure-check-5eadbc1c -d '<json body>'
```

Example prompt: Check whether any API keys or tokens tied to acmecorp.com have shown up in criminal infostealer logs — I want to know if the credentials our AI agents and CI/CD pipelines use have been compromised.

## When to prefer this

Choose this endpoint when you specifically need to audit non-human identity credentials (API keys, tokens, service account secrets) for a domain against infostealer and criminal log databases — as opposed to checking human user passwords or email credentials. Ideal for pre-deployment security reviews of AI agent credentials, CI/CD pipeline audits, and third-party vendor NHI risk assessments.

## Known failure modes

- Domain not found or unrecognized — returns no results
- Invalid or missing domain input — returns 400 error
- No stealer log data available for queried domain — empty result set
- Rate limit exceeded — returns 429 error
- Payment not processed — returns 402 error
- Internal server error if upstream threat intelligence is unavailable — returns 500

## How this service works

Check whether API keys or tokens tied to a domain — used by non-human identities like AI agents, service accounts, or CI/CD — appear exposed in criminal stealer logs. Call to audit whether the credentials an autonomous agent relies on have already been compromised upstream.

## Output

Returns whether API keys or tokens associated with the queried domain have been found in criminal infostealer logs, including details about the nature of the exposure, affected credential types, and risk indicators relevant to non-human identities like AI agents, service accounts, and CI/CD credentials.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "Your own domain"
  },
  "vendor_domains": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Optional: vendor/supply-chain domains, up to 10"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/nhi-api-key-token-exposure-check-5eadbc1c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com](https://www.zero.xyz/host/atq6wtkp6k.execute-api.us-east-1.amazonaws.com/llms.txt)