---
title: "Find published secrets across six public artifact sources"
method: POST
path: "/v1/payg/secret-scan"
tags: ["x402 pay-per-call"]
---

# Find published secrets across six public artifact sources

`POST /v1/payg/secret-scan`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/payg/secret-scan`
- Auth: none required

Scan public GitHub repositories, npm and PyPI packages, Docker Hub images, Hugging Face models and Spaces, and Postman public workspaces and collections for API keys, tokens and credentials already published against a domain. Repo-only scanners miss credentials shipped inside released packages and images. Every hit is verified against the credential pattern before it is reported.

**Billing.** $0.35 in USDC per call over x402, on Base or Solana. No API key, no signup and no
subscription. Send the request with no payment header, take the `402` challenge that comes back,
pay it, and repeat the request. Only successful calls are charged.

## Request body

- object
  - `domain` string: Your own domain
  - `vendor_domains` string[]: Optional: vendor domains, up to 5

## Response `200`

Payment settled and the check ran. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required

## Other responses

- `400`: A required field is missing or malformed. Never billed.
- `402`: Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)