---
title: "Report a leaked API key"
method: POST
path: "/security/report-leaked-key"
tags: ["Gateway"]
---

# Report a leaked API key

`POST /security/report-leaked-key`

## Request

- Base URL: `https://api.phaseo.app/v1`
- URL: `https://api.phaseo.app/v1/security/report-leaked-key`
- Auth: none required

Reports a Phaseo key found in public. No authentication. Always answers 202 with the same body, whether or not the key matched, so the route cannot be used to check keys. Rate limited per address.

## Request body

- LeakedKeyReportRequest
  - `token` string, required: The leaked key as found.
  - `source` string: Where it was found, such as github.
  - `reporter_email` string
  - `evidence_url` string, uri
  - `comment` string

## Response `202`

Report received

- LeakedKeyReportResponse
  - `status` 'received'

## Changes

- **2026-10-28** `72ba9c856a2c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/phaseo/apis/phaseo-gateway-api/changes/security/report-leaked-key/post.md)

---

[API](https://skmtc.dev/phaseo/apis/phaseo-gateway-api.md) - [All operations](https://skmtc.dev/phaseo/apis/phaseo-gateway-api/llms.txt) - [OpenAPI document](https://skmtc.dev/phaseo/apis/phaseo-gateway-api/revisions/5ca9bb220d25?raw)