# RelayShield OAuth Watchlist Checker

> RelayShield OAuth Watchlist Checker is a paid API for AI agents from api.relayshield.net, paid per call via x402, $0.3/call, status unknown (last checked 2026-10-11).

Checks whether an email address is associated with apps that have appeared in OAuth-related breaches, returning matched apps with revocation URLs and breach metadata.

## Facts

- Endpoint: POST https://api.relayshield.net/v1/payg/oauth-watchlist?utm_source=zero.xyz
- Price: $0.3/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/relayshield-oauth-watchlist-checker-0c72e830
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_4b2KB498ZZi5ZGcO6HQeb

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability relayshield-oauth-watchlist-checker-0c72e830 -d '<json body>'
```

Example prompt: Can you check if my email address john.doe@gmail.com has shown up in any OAuth app breaches and tell me which apps I should revoke access for?

## When to prefer this

Use this endpoint when you need to check a specific email address against OAuth-specific breach watchlists and want actionable revocation links per matched app. Prefer this over generic breach-check services when the goal is OAuth token hygiene — identifying exactly which third-party app authorizations to revoke — rather than just knowing whether a password was leaked.

## Known failure modes

- Email not found in any breach database — returns ok:true with empty matched_apps array and matched_count of 0
- Invalid or malformed email input — likely returns an error or validation failure
- Network timeout or upstream breach data source unavailability — may return a service error
- Rate limiting if the endpoint is called too frequently in short succession
- Payment failure via x402 protocol preventing the call from executing

## How this service works

RelayShield Landing Site

## Output

A JSON object containing the checked email, timestamp, a list of matched OAuth apps with their names, breach dates, exposed data classes, and direct revocation URLs, plus a total matched count and a plain-language security recommendation (e.g. 'Revoke OAuth access for matched apps immediately.').

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "email": {
   "type": "string",
   "description": "Email address to check for OAuth exposure"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "data": {
   "email": "user@example.com",
   "checked_at": "2026-05-19T10:00:00+00:00",
   "matched_apps": [
    {
     "app": "GitHub",
     "revoke_url": "https://github.com/settings/applications",
     "breach_date": "2023-01-15",
     "data_classes": [
      "Usernames",
      "Email addresses"
     ]
    }
   ],
   "matched_count": 1,
   "recommendation": "Revoke OAuth access for matched apps immediately."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/relayshield-oauth-watchlist-checker-0c72e830/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.relayshield.net](https://www.zero.xyz/host/api.relayshield.net/llms.txt)