{"uid":"cap_0i9TY5-My95_r9HdCA4rq","slug":"account-takeover-risk-score-ato-assessment-6cdb382b","name":"Account Takeover Risk Score (ATO Assessment)","description":"Composite account-takeover risk score (0-100) fusing a privacy-preserving password exposure check with a domain's known breach history. The password is hashed locally (k-anonymity, never transmitted). Returns ato_risk_score, a category, per-signal reasons and the raw signals so the agent can re-rank. Risk indicators, not a guarantee.","url":"https://api.agentstools.dev/breach/assess","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"ntlm":{"type":"string","description":"Alternative to password: a full 32-hex NTLM hash"},"sha1":{"type":"string","description":"Alternative to password: a full 40-hex SHA-1 hash"},"domain":{"type":"string","description":"Optional domain to fold in its known breach history"},"password":{"type":"string","description":"Plaintext password — hashed locally with SHA-1; never stored, logged or transmitted"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_GVmmdDYaV3-xHpeKm7Mdj","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fuses a k-anonymity password breach check with domain breach history into a single account-takeover risk score (0–100) with category, per-signal reasons, and raw signals.","exampleAgentPrompt":"Can you check the account takeover risk for the password 'SunnyDay2023!' combined with the domain gmail.com — I need the risk score, category, and any breach signals so I know if this credential is exposed?","exampleUseCases":[{"title":"Login security check at signup","prompt":"Before creating this new account, can you assess the ATO risk for the password 'BlueSky#99' against the domain mycompany.com and tell me the risk score and reasons so I can warn the user if it's compromised?"},{"title":"Flagging high-risk credentials in support queue","prompt":"A user just reported a suspicious login on their account at acme.io — can you run an ATO risk assessment using the SHA-1 hash 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 and the domain acme.io to see how exposed their credential is?"},{"title":"Periodic credential hygiene audit","prompt":"I want to check if the password 'P@ssword1' is flagged in any breach datasets and whether the domain example.com has a known breach history — give me the full risk score and per-signal breakdown."}],"resultDescription":"Returns a numeric ato_risk_score (0–100), a risk category label (e.g. low/medium/high/critical), human-readable per-signal reasons explaining which factors drove the score, and raw signals including password exposure count and domain breach records — enabling downstream re-ranking or threshold-based gating.","failureModes":["Missing required body fields (password, sha1, or ntlm) returns a 400 validation error","Invalid SHA-1 or NTLM hash format (wrong length or non-hex characters) causes a parsing error","Domain lookup may return no breach data if the domain is not in known breach databases","Network timeout contacting upstream breach data sources may delay or fail the response","Ambiguous domain input (e.g. bare IP addresses) may yield no domain-level signals"],"whenToPreferThis":"Choose this endpoint when you need a privacy-preserving, fused ATO risk signal that combines password breach exposure (via k-anonymity, no plaintext transmission) with domain-level breach history in a single scored output. Prefer it over raw HIBP lookups when you want a composite score with actionable categories and reasons rather than a raw count, and when the domain context matters for risk assessment.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T19:06:36.012Z","isFirstParty":false}