---
title: "Correlate an email to phones and domains seen alongside it"
method: POST
path: "/v1/metered/identity-graph"
tags: ["Identity exposure"]
---

# Correlate an email to phones and domains seen alongside it

`POST /v1/metered/identity-graph`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/identity-graph`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Pivot from one compromised identifier to every other identifier that appeared next to it in criminal channel dumps. Correlated values are stored encrypted and decrypted per request.

**Billing.** $0.35 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

## Request body

- object
  - `email` string, email, required: Anchor email address.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `email` string: The anchor address.
    - `found` boolean: True when at least one correlated identifier exists.
    - `correlated_identifiers` integer: Total correlated phones plus domains.
    - `correlated_phones` string[]: Phone numbers seen alongside this address.
    - `correlated_domains` string[]: Domains seen alongside this address.
    - `sources` string[]: Dumps or channels the correlations came from.
    - `recommendation` string: Remediation text. Present only when found is true.
    - `checked_at` string, date-time: ISO 8601 UTC timestamp of when this check ran.

## Other responses

- `400`: `email` is missing or contains no '@'.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.
- `500`: Identity graph query failed.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)