# ShieldAPI Password Range Check

> ShieldAPI Password Range Check is a paid API for AI agents from shield.vainplex.dev, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-15).

Checks whether a password has been compromised using k-anonymity (first 5 chars of SHA-1 hash prefix lookup) against breach databases

## Facts

- Endpoint: GET https://shield.vainplex.dev/api/cdp/check/password/range
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/shield-vainplex-dev-63de1ffd
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3o5RzEsXe3FKbkdgqFne-

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability shield-vainplex-dev-63de1ffd
```

Example prompt: Check if the password 'hunter2' has ever appeared in a known data breach — use the anonymized SHA-1 prefix method so the actual password is never sent, and tell me how many times it's been compromised.

## When to prefer this

Use this endpoint when you need to check whether a password has been exposed in known data breaches while preserving user privacy via k-anonymity (only the first 5 chars of the SHA-1 hash are transmitted). Prefer this over full-hash or plaintext password checks. Ideal for password validation flows, security audits, or agent-driven credential hygiene checks.

## Known failure modes

- Missing or malformed prefix parameter — returns 400 bad request
- Prefix not exactly 5 hex characters — validation error
- Rate limiting or payment failure — returns 402 or 429
- Service unavailable — returns 503
- No matches found — returns empty result set (password not found in breaches)

## How this service works

ShieldAPI - x402 security preflight before agents accept or store credential material

## Output

A list of SHA-1 hash suffixes matching the provided 5-character prefix, each accompanied by a count indicating how many times that password hash has appeared in known breach datasets. The agent can then compare locally to determine if the full password hash appears in the results and how exposed it is.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "prefix": "5BAA61"
  }
 },
 "output": {
  "type": "object"
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "prefix"
     ],
     "properties": {
      "prefix": {
       "type": "string",
       "description": "First 5 characters of SHA-1 hash"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/shield-vainplex-dev-63de1ffd/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from shield.vainplex.dev](https://www.zero.xyz/host/shield.vainplex.dev/llms.txt)