---
title: "Find machine credentials in stealer logs"
method: POST
path: "/v1/metered/nhi-exposure"
tags: ["Secrets and non-human identity"]
---

# Find machine credentials in stealer logs

`POST /v1/metered/nhi-exposure`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/nhi-exposure`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Scans the stealer-log corpus for non-human identity credentials tied to your domains: AWS IAM keys, GitHub PATs, Stripe secrets, private keys and Slack tokens. This is not a repo scan -- it is the criminal side, where leaked keys are already circulating.

**Billing.** $0.40 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

## Request body

- object: At least one of: `domain`, `vendor_domains`.
  - `domain` string: Your own domain.
  - `vendor_domains` string[]: Additional supply-chain domains.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `domains_checked` integer: Domains scanned. Capped at 10 after deduplication.
    - `found` boolean: True when at least one credential was found.
    - `findings` object[]: Findings, sorted most severe first.
      - `domain` string: Domain the finding was matched against.
      - `type` string: Credential type, e.g. aws_access_key, github_pat, stripe_secret_key, private_key.
      - `description` string: What the credential grants and why it matters.
      - `severity` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW': Severity of this credential type.
      - `preview` string: Redacted context. Never the full secret value.
      - `source` string: Channel or archive the record came from.
      - `ingested_at` string: When RelayShield ingested the record.
    - `highest_severity` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'null', nullable: Highest severity found. null when none.
    - `recommendation` string: Remediation text.
    - `checked_at` string, date-time: ISO 8601 UTC timestamp of when this check ran.

## Other responses

- `400`: Neither `domain` nor `vendor_domains` supplied.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)