---
title: "Detect stolen session cookies before they are used"
method: POST
path: "/v1/metered/session-risk"
tags: ["Identity exposure"]
---

# Detect stolen session cookies before they are used

`POST /v1/metered/session-risk`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/session-risk`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Searches criminal stealer-log archives for live session cookies belonging to the address. This is the AiTM case that password rotation does not fix: a stolen cookie bypasses 2FA and stays valid until the session is explicitly invalidated.

**Billing.** $0.30 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

## Request body

- object
  - `email` string, email, required: Email address to check.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `email` string: The normalised address that was checked.
    - `record_type` string: `credential_exposure`. Present on the not-found response.
    - `found` boolean: True when at least one stolen session exists.
    - `session_count` integer: Number of stolen session records.
    - `highest_severity` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'null', nullable: Highest severity across all sessions. null when none found.
    - `sessions` object[]: Sessions, sorted most severe first.
      - `domain` string: Service the stolen session belongs to.
      - `session_type` string: `cookie` for a session cookie, `credential` for a username/password or token pair.
      - `cookie_name` string: Cookie or credential name. Never the value.
      - `severity` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW': Severity derived from the service category.
      - `service_category` string: Category of the affected service, e.g. cloud_console, identity_provider, productivity.
      - `channel_source` string: Criminal channel or archive the record was collected from.
      - `ingested_at` string: When RelayShield ingested the record.
    - `action_required` string: Remediation text. Present only when found is true.

## Other responses

- `400`: `email` is missing or contains no '@'.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.
- `500`: Session corpus query failed.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)