# Secrets Scanner API

> Secrets Scanner API is a paid API for AI agents from api.iamjuliand.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-14).

Scans text or code snippets for exposed secrets, API keys, and credentials, returning categorized findings with severity levels and remediation recommendations.

## Facts

- Endpoint: POST https://api.iamjuliand.com/v1/secrets/scan
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/secrets-scanner-api-f0de8cff
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_hwT6cLajwk3JK6P-lSM8S

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability secrets-scanner-api-f0de8cff -d '<json body>'
```

Example prompt: Can you scan this code snippet for any exposed secrets or API keys? Here's the content: `API_TOKEN=abc123xyz` — I want to know the severity, what line it's on, and how to fix it.

## When to prefer this

Choose this endpoint when you need a fast, deterministic, pay-per-scan secrets detection service with structured JSON output including line-level findings, severity tiers, and remediation advice. Ideal for agent workflows that need to validate code snippets or config blobs before deployment, git commits, or sharing. Prefer this over static analysis tools when you need a lightweight, API-accessible scanner without standing up local tooling.

## Known failure modes

- Empty or missing input body — returns error with no findings
- Input too large — may return a timeout or payload error
- Malformed JSON body — returns parse error
- Network timeout at $0.005 USDC per call with no result
- False negatives for highly obfuscated or encoded secrets
- Payment failure via x402 protocol blocks the request

## How this service works

A public journal about ideas, systems, experiments, projects, and learning.

## Output

Returns a JSON object with a summary of findings broken down by severity (low, medium, high, critical) plus an array of detailed findings, each including the line and column number, secret type (e.g. generic-assignment), a redacted version of the exposed value, a SHA-256 fingerprint, severity level, and a remediation recommendation. Also includes a deterministic flag and product version.

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "summary": {
   "low": 0,
   "high": 1,
   "medium": 0,
   "critical": 0,
   "findings": 1
  },
  "findings": [
   {
    "line": 1,
    "type": "generic-assignment",
    "column": 1,
    "redacted": "API_TOKEN=[REDACTED]",
    "severity": "high",
    "fingerprint": "sha256:0123456789ab",
    "recommendation": "Revoke the exposed credential and load its replacement from a secret store."
   }
  ],
  "deterministic": true,
  "productVersion": "1.0.0"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/secrets-scanner-api-f0de8cff/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.iamjuliand.com](https://www.zero.xyz/host/api.iamjuliand.com/llms.txt)