---
title: "Assess breach and infostealer risk across vendors"
method: POST
path: "/v1/metered/supply-chain"
tags: ["Vendor and organisation risk"]
---

# Assess breach and infostealer risk across vendors

`POST /v1/metered/supply-chain`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/supply-chain`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

One call covers up to 10 vendor domains. Each gets a breach and infostealer assessment plus a 0-100 dark-web composite; results come back sorted worst-first.

**Billing.** $0.10 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

## Request body

- object: At least one of: `vendor_domains`, `vendor_emails`.
  - `vendor_domains` string[]: Vendor domains to assess.
  - `vendor_emails` string[]: Vendor email addresses. The domain part is extracted and assessed, so you can pass a contact list directly.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `domains_checked` integer: Distinct domains assessed after deduplication.
    - `highest_risk` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'CLEAN': Worst risk_level across all vendors.
    - `critical_vendors` string[]: Domains rated CRITICAL.
    - `high_risk_vendors` string[]: Domains rated HIGH.
    - `results` object[]: Per-vendor detail, sorted by dark_web_score descending.
      - `domain` string: The vendor domain assessed.
      - `breach_count` integer: Number of known breach events affecting this domain.
      - `breached_accounts` integer: Accounts from this domain found across those breaches.
      - `breach_names` string[]: Breach names, capped at 10.
      - `infostealer_found` boolean: True if credentials for this domain appear in infostealer logs.
      - `infostealer_count` integer: Infostealer log entries for this domain.
      - `infostealer_dates` string[]: Compromise dates, present only when infostealer_found is true.
      - `risk_level` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'CLEAN': Overall vendor risk rating.
      - `risk_factors` string[]: Plain-English reasons behind risk_level.
      - `recommendation` string: Recommended action for this vendor.
      - `dark_web_score` integer: Composite exposure score 0-100. Results are sorted by this, descending.
    - `checked_at` string, date-time: ISO 8601 UTC timestamp of when this check ran.

## Other responses

- `400`: Neither `vendor_domains` nor `vendor_emails` yielded a domain, or more than 10 distinct domains were supplied.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)