# Session Risk / Stolen Session Cookie Check by Email

> Session Risk / Stolen Session Cookie Check by Email is a paid API for AI agents from atq6wtkp6k.execute-api.us-east-1.amazonaws.com, paid per call via x402, $0.3/call, status unknown (last checked 2026-09-15).

Checks whether an email address has an active stolen session cookie circulating in a criminal archive, signaling an account takeover via AiTM/session-hijacking attack.

## Facts

- Endpoint: POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/session-risk
- Price: $0.3/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/session-risk-stolen-session-cookie-check-by-email-4a53cd6d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_pW4oeGaTy4ja0eGvirqaB

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability session-risk-stolen-session-cookie-check-by-email-4a53cd6d -d '<json body>'
```

Example prompt: Before I let this user proceed, check if the email address jsmith@acmecorp.com has any active stolen session cookies or AiTM-hijacked sessions showing up in criminal archives — I need to know the session count and highest severity.

## When to prefer this

Use this endpoint when you need to detect active session cookie theft or AiTM (adversary-in-the-middle) attacks specifically — situations where password resets and 2FA are insufficient because the attacker holds a live authenticated session token. Prefer this over standard breach or credential checks when the threat model involves post-authentication session hijacking rather than password compromise. Ideal as a pre-trust gate for AI agent sessions, enterprise SSO flows, or high-value account actions.

## Known failure modes

- Email address not provided or malformed — returns validation error
- Email not found in any criminal archive — returns found: false with empty sessions array
- Criminal archive lookup timeout — may return error or incomplete results
- Rate limit exceeded for pay-per-call endpoint
- Network/API gateway error from AWS execute-api infrastructure

## How this service works

Check whether an email address has an active stolen session cookie circulating in a criminal archive — a signal of account takeover that bypasses password resets and 2FA entirely. Call to detect AiTM/session-hijack attacks before an authenticated agent session is trusted.

## Output

Returns a JSON object with: 'found' (boolean indicating whether active stolen sessions were found), 'sessions' (array of matching session records from criminal archives), 'session_count' (integer count of active stolen sessions), and 'highest_severity' (severity signal for the worst discovered session). Also echoes back the queried email address.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "email": {
   "type": "string",
   "description": "Email address to check for active session/AiTM exposure"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/session-risk-stolen-session-cookie-check-by-email-4a53cd6d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com](https://www.zero.xyz/host/atq6wtkp6k.execute-api.us-east-1.amazonaws.com/llms.txt)