# RelayShield Supply Chain Domain Risk Check

> RelayShield Supply Chain Domain Risk Check is a paid API for AI agents from api.relayshield.net, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-14).

Checks one or more domains for supply chain security risk, data breaches, and infostealer infections, returning risk levels and breach counts

## Facts

- Endpoint: POST https://api.relayshield.net/v1/payg/supply-chain
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/relayshield-supply-chain-domain-risk-check-21bb76e2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_sxUFMpwVaa_6Kwq6ieaCa

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability relayshield-supply-chain-domain-risk-check-21bb76e2 -d '<json body>'
```

Example prompt: Can you check the supply chain risk for acme.com — I want to know its breach count, whether any infostealers have been found, and what its overall risk level is?

## When to prefer this

Use this endpoint when you need automated, per-domain supply chain security intelligence — specifically breach history, infostealer association, and a categorical risk level — for vendor or third-party domains. It is well-suited for onboarding workflows, compliance checks, or incident triage where a fast programmatic risk signal per domain is needed. Prefer this over manual threat intel lookups when integrating into agentic workflows that require a structured, machine-readable risk verdict.

## Known failure modes

- Invalid or malformed domain names may return errors or empty results
- Unknown domains with no breach history may return LOW risk with zero counts, which could be mistaken for a definitive clean bill of health
- Rate limiting or payment failures may result in 402 or 429 responses
- Domains with very new breaches may not yet be indexed, leading to false LOW results

## How this service works

RelayShield Landing Site

## Output

Returns a JSON object with an array of per-domain results including the domain name, a risk_level (e.g. LOW, MEDIUM, HIGH), a breach_count integer, and an infostealer_found boolean. Also includes a top-level highest_risk field summarizing the worst risk across all checked domains, and a domains_checked count.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "vendor_emails": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Alternative: vendor contact emails, domain extracted automatically"
  },
  "vendor_domains": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Up to 10 vendor domains"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "data": {
   "results": [
    {
     "domain": "acme.com",
     "risk_level": "LOW",
     "breach_count": 0,
     "infostealer_found": false
    }
   ],
   "highest_risk": "LOW",
   "domains_checked": 1
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/relayshield-supply-chain-domain-risk-check-21bb76e2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.relayshield.net](https://www.zero.xyz/host/api.relayshield.net/llms.txt)