---
title: "api_key_exposure.created"
method: POST
path: "api_key_exposure.created"
tags: ["API keys"]
---

# api_key_exposure.created

`POST api_key_exposure.created` (webhook)

Occurs when an API key has been detected as exposed.

## Headers

- `paddle_signature` string, required

## Payload

- object
  - `event_id` string, required: Unique Paddle ID for this event, prefixed with `evt_`.
  - `event_type` 'address.created' | 'address.imported' | 'address.updated' | 'adjustment.created' | 'adjustment.updated' | 'api_key.created' | 'api_key.expired' | 'api_key.expiring' | 'api_key.revoked' | 'api_key.updated' | 'api_key_exposure.created' | 'business.created' | 'business.imported' | 'business.updated' | 'client_token.created' | 'client_token.revoked' | 'client_token.updated' | 'customer.created' | 'customer.imported' | 'customer.updated' | 'discount.created' | 'discount.imported' | 'discount.updated' | 'discount_group.created' | 'discount_group.updated' | 'payment_method.saved' | 'payment_method.deleted' | 'payout.created' | 'payout.paid' | 'price.created' | 'price.imported' | 'price.updated' | 'product.created' | 'product.imported' | 'product.updated' | 'report.created' | 'report.updated' | 'subscription.activated' | 'subscription.canceled' | 'subscription.created' | 'subscription.imported' | 'subscription.past_due' | 'subscription.paused' | 'subscription.resumed' | 'subscription.trialing' | 'subscription.updated' | 'transaction.billed' | 'transaction.canceled' | 'transaction.completed' | 'transaction.created' | 'transaction.paid' | 'transaction.past_due' | 'transaction.payment_failed' | 'transaction.ready' | 'transaction.revised' | 'transaction.updated', required: Type of event sent by Paddle, in the format `entity.event_type`.
  - `occurred_at` string, date-time, required: RFC 3339 datetime string of when this event occurred.
  - `notification_id` string, required: Unique Paddle ID for this notification, prefixed with `ntf_`.
  - `data` object, required: New or changed entity.
    - `id` string, required: Unique Paddle ID for this API key exposure entity, prefixed with `apkexp_`.
    - `api_key_id` string, required: Unique Paddle ID for this API key entity, prefixed with `apikey_`.
    - `risk_level` 'high' | 'low', required: Risk level of this exposure.
    - `action_taken` 'revoked' | 'none', required: Action performed by Paddle as a result of this exposure.
    - `source` 'github', required: Source of this exposure.
    - `reference` string, required: A unique URL or reference pointing to the source of the exposure. When `source` is `github`, a URL to the location of the exposure is returned.
    - `description` string, nullable, required: Additional details about this exposure.
    - `created_at` string, date-time, required: RFC 3339 datetime string of when this API key exposure was found. Set automatically by Paddle.

## Acknowledgement `200`

Respond with an HTTP 200 status code within 5 seconds to let Paddle know that you successfully received the message.

If your server sends another kind of status code or doesn't respond, Paddle automatically retries using an exponential backoff schedule.

---

[API](https://skmtc.dev/paddlehq/apis/paddle-api.md) - [All operations](https://skmtc.dev/paddlehq/apis/paddle-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paddlehq/apis/paddle-api/revisions/bbc0c72039c8?raw)