---
title: "Check a card against the stolen-card corpus"
method: POST
path: "/v1/metered/card-exposure"
tags: ["Identity exposure"]
---

# Check a card against the stolen-card corpus

`POST /v1/metered/card-exposure`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/card-exposure`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Pass a client-computed SHA-256 of the digit-only card number, a 6-8 digit BIN, or both. RelayShield never accepts or stores a raw card number, and a rejected value is never logged.

**Billing.** $0.30 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

## Request body

- object: At least one of: `pan_hash`, `bin`.
  - `pan_hash` string: 64-character lowercase SHA-256 hex digest of the digit-only card number (no spaces, no dashes). Computed client-side.
  - `bin` string: 6 to 8 digit Bank Identification Number.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `card_exposed` boolean: True when the exact card hash is in the corpus. Present only when pan_hash was supplied.
    - `last4` string: Last 4 digits of the exposed card. Present only on a pan_hash hit.
    - `first_seen` string: When the card was first seen. Present only on a pan_hash hit.
    - `bin_exposed_card_count` integer: Exposed cards sharing this BIN. Present only when bin was supplied.
    - `bin_last_seen` string, nullable: Most recent sighting for this BIN. null when none.

## Other responses

- `400`: Neither `pan_hash` nor `bin` supplied, `pan_hash` is not a 64-char SHA-256 hex digest, or `bin` is not 6-8 digits.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.
- `500`: Stolen-card corpus lookup failed.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)