---
title: "Composite campaign scan across the threat-intel endpoints ($5.50 flat)"
method: POST
path: "/v1/payg/campaign-scan"
tags: ["x402 pay-per-call"]
---

# Composite campaign scan across the threat-intel endpoints ($5.50 flat)

`POST /v1/payg/campaign-scan`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/payg/campaign-scan`
- Auth: none required

One $5.50 flat call that fans an indicator bundle (max 25 indicators: domains, urls, emails, wallets, phones, file URLs, kit/malware fingerprint IDs) across the applicable threat-intel endpoints in-process, then correlates: per-indicator results, kit families, malware families (Malpedia common names plus IOC-corpus attribution for known-malware domains/URLs), shared exfil hosts and shared kit fingerprints across indicators, an aggregate risk score, and corpus citations — packaged for campaign-level takedown intel. Subcalls run under a hard time budget; any truncation is reported via degraded:true, never silently dropped. Individual subcall failures are captured as endpoint-level errors, never crash the composite.

**Billing.** $5.50 in USDC per call over x402, on Base or Solana. No API key, no signup and no
subscription. Send the request with no payment header, take the `402` challenge that comes back,
pay it, and repeat the request. Only successful calls are charged.

## Request body

- object
  - `campaign_name` string: Optional label for the campaign.
  - `domains` string[]
  - `urls` string[]
  - `emails` string[]
  - `wallets` string[]
  - `phones` string[]
  - `file_urls` string[]
  - `fingerprint_ids` string[]: kit_<sha256> or malware_<sha256> fingerprint IDs to re-check.

## Response `200`

Payment settled and the check ran. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required

## Other responses

- `400`: A required field is missing or malformed. Never billed.
- `402`: Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)