# PayAI Account-Takeover Risk Assessor

> PayAI Account-Takeover Risk Assessor is a paid API for AI agents from payai.agentstools.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Returns a composite account-takeover risk score (0-100) by fusing a k-anonymity password exposure check with a domain's known breach history, without ever transmitting the raw password.

## Facts

- Endpoint: POST https://payai.agentstools.dev/breach/assess
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/payai-account-takeover-risk-assessor-ed7d65e9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_33DYIGFQknm9tHJtvVWTf

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability payai-account-takeover-risk-assessor-ed7d65e9 -d '<json body>'
```

Example prompt: Can you check the account-takeover risk score for the password 'Summer2024!' on the domain github.com — I want to know if it's been exposed in a breach and what the overall ATO risk level is?

## When to prefer this

Choose this endpoint when you need a privacy-preserving, fused signal that combines both password breach exposure and domain breach history into a single actionable risk score — without transmitting the raw password. Prefer it over standalone HaveIBeenPwned queries when you want a composite ATO risk score with categorization and per-signal breakdown in a single API call, especially in agent workflows where minimizing data exposure is critical.

## Known failure modes

- Invalid or missing password input returns a 400 error
- Unknown or unresolvable domain returns partial score with domain signal absent
- Rate limiting or payment failure (x402) blocks the call
- Very new domains with no breach history may return low scores that understate real risk
- Edge case: password hash prefix collision could theoretically affect k-anonymity lookup accuracy

## How this service works

Composite account-takeover risk score (0-100) fusing a privacy-preserving password exposure check with a domain's known breach history. The password is hashed locally (k-anonymity, never transmitted). Returns ato_risk_score, a category, per-signal reasons and the raw signals so the agent can re-rank. Risk indicators, not a guarantee.

## Output

A JSON object containing: ato_risk_score (integer 0-100), a risk category label (e.g. low/medium/high/critical), per-signal human-readable reasons explaining the score, and raw signals (password exposure count, domain breach events) so the caller can re-rank or apply custom thresholds. These are risk indicators, not guarantees.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ntlm": {
   "type": "string",
   "description": "Alternative to password: a full 32-hex NTLM hash"
  },
  "sha1": {
   "type": "string",
   "description": "Alternative to password: a full 40-hex SHA-1 hash"
  },
  "domain": {
   "type": "string",
   "description": "Optional domain to fold in its known breach history"
  },
  "password": {
   "type": "string",
   "description": "Plaintext password — hashed locally with SHA-1; never stored, logged or transmitted"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/payai-account-takeover-risk-assessor-ed7d65e9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from payai.agentstools.dev](https://www.zero.xyz/host/payai.agentstools.dev/llms.txt)