---
title: "Register assets and sweep them against the IOC corpus"
method: POST
path: "/v1/metered/asset-intel"
tags: ["Threat intelligence"]
---

# Register assets and sweep them against the IOC corpus

`POST /v1/metered/asset-intel`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/asset-intel`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

A watchlist scoped to your API key. `register` adds domains and IPs, `sweep` checks them against the IOC corpus (8.3M+ citations, from 123 monitored criminal Telegram marketplaces and authoritative feeds), `list` returns what is registered, `remove` deletes entries. Once a webhook is configured, new matches against registered assets are pushed to you automatically.

**Billing.** $0.15 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

**Note.** The watchlist is keyed on your API key, so a rotated key starts with an empty watchlist. Configure delivery with /v1/webhook/configure before registering assets if you want push alerts.

## Request body

- object
  - `action` 'sweep' | 'register' | 'list' | 'remove': Operation to perform. Defaults to `sweep`.
  - `assets` string[]: Domains or IPs. Required for `register`. Optional for `sweep` -- when omitted, your registered watchlist is swept instead. `register` caps at 50 per call.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `matches` object[]: sweep only. One entry per asset found in the corpus.
      - `asset` string: The registered asset that matched.
      - `ioc_type` string: Indicator type.
      - `source` string: Feed or channel.
      - `malware` string: Malware family. Empty when unattributed.
      - `confidence` number: 0.0 to 1.0.
      - `first_seen` string: Earliest sighting.
      - `threat_actor` string: Attributed actor. Empty when unattributed.
    - `assets_checked` integer: sweep only. Assets swept.
    - `match_count` integer: sweep only. Assets that matched.
    - `clean_count` integer: sweep only. Assets that did not match.
    - `registered` string[]: register only. Assets successfully added.
    - `count` integer: register and list. Number of assets.
    - `assets` string[]: list only. Registered assets.
    - `removed` string[]: remove only. Assets requested for removal.
    - `note` string: Present on register, and on a sweep with an empty watchlist.

## Other responses

- `400`: action is `register` and `assets` is empty.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.
- `500`: Watchlist read or write failed.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)