# OAuth Watchlist - Email OAuth App Exposure Checker

> OAuth Watchlist - Email OAuth App Exposure Checker is a paid API for AI agents from atq6wtkp6k.execute-api.us-east-1.amazonaws.com, paid per call via x402, $0.3/call, status unknown (last checked 2026-09-14).

Checks whether an email address has OAuth-connected app credentials exposed in known SaaS breaches across GitHub, Slack, Notion, Zapier, and 30+ other high-risk OAuth-capable apps, returning matched apps and direct revoke-access links.

## Facts

- Endpoint: POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/oauth-watchlist
- Price: $0.3/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/oauth-watchlist-email-oauth-app-exposure-checker-eea7ebe2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_L5mnN6wmwwdLPNP2GHh-w

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability oauth-watchlist-email-oauth-app-exposure-checker-eea7ebe2 -d '<json body>'
```

Example prompt: Check if john.doe@acme.com has any OAuth-connected app credentials — like GitHub, Slack, or Zapier — exposed in known SaaS breaches, and give me the revoke-access links for anything that's compromised.

## When to prefer this

Choose this endpoint when you specifically need to identify OAuth-connected app credential exposure (not just password or PII breaches) for an email address, especially when you need actionable revoke-access URLs. It covers 30+ high-risk OAuth-capable SaaS apps like GitHub, Slack, Notion, and Zapier — making it ideal for supply-chain risk assessment, incident response, or employee security audits where connected app access is the attack surface.

## Known failure modes

- Invalid or malformed email address returns a validation error
- Email not found in any known OAuth breach returns empty matched_apps array with matched_count of 0
- API timeout or upstream data source unavailability returns a server error
- Missing required email field in request body returns a 400 bad request
- Rate limiting or quota exceeded returns a payment or rate-limit error

## How this service works

Check whether an email address has OAuth-connected app credentials exposed in a known SaaS breach (GitHub, Slack, Notion, Zapier, and 30+ other high-risk OAuth-capable apps). Returns matched apps and direct revoke-access links. Call to detect supply-chain credential exposure via connected apps.

## Output

Returns a JSON object with the queried email, timestamp of the check, an array of matched apps each containing the app name, a direct revoke-access URL, the breach date, and data classes exposed, plus a total matched count and a security recommendation string.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "email": {
   "type": "string",
   "description": "Email address to check for OAuth exposure"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/oauth-watchlist-email-oauth-app-exposure-checker-eea7ebe2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com](https://www.zero.xyz/host/atq6wtkp6k.execute-api.us-east-1.amazonaws.com/llms.txt)