{"uid":"cap_33DYIGFQknm9tHJtvVWTf","slug":"payai-account-takeover-risk-assessor-ed7d65e9","name":"PayAI Account-Takeover Risk Assessor","description":"Composite account-takeover risk score (0-100) fusing a privacy-preserving password exposure check with a domain's known breach history. The password is hashed locally (k-anonymity, never transmitted). Returns ato_risk_score, a category, per-signal reasons and the raw signals so the agent can re-rank. Risk indicators, not a guarantee.","url":"https://payai.agentstools.dev/breach/assess","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"ntlm":{"type":"string","description":"Alternative to password: a full 32-hex NTLM hash"},"sha1":{"type":"string","description":"Alternative to password: a full 40-hex SHA-1 hash"},"domain":{"type":"string","description":"Optional domain to fold in its known breach history"},"password":{"type":"string","description":"Plaintext password — hashed locally with SHA-1; never stored, logged or transmitted"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_22eB1VXvNphsdbt5vUU3K","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns a composite account-takeover risk score (0-100) by fusing a k-anonymity password exposure check with a domain's known breach history, without ever transmitting the raw password.","exampleAgentPrompt":"Can you check the account-takeover risk score for the password 'Summer2024!' on the domain github.com — I want to know if it's been exposed in a breach and what the overall ATO risk level is?","exampleUseCases":[{"title":"Pre-login credential risk gate","prompt":"Before letting this user log in, check the ATO risk score for their password against our domain acmecorp.com — if the score is high, I want to flag the session for step-up authentication."},{"title":"New user password strength audit","prompt":"A new user just set their password as 'P@ssword123' on signup for shopexample.com — can you run an account-takeover risk assessment and tell me if this password has been seen in any breaches?"},{"title":"Security audit for acquired domain","prompt":"We just acquired the domain legacystore.net and I want to understand its breach history — run a risk assessment so I can see what ATO exposure signals exist for that domain before we migrate users over."}],"resultDescription":"A JSON object containing: ato_risk_score (integer 0-100), a risk category label (e.g. low/medium/high/critical), per-signal human-readable reasons explaining the score, and raw signals (password exposure count, domain breach events) so the caller can re-rank or apply custom thresholds. These are risk indicators, not guarantees.","failureModes":["Invalid or missing password input returns a 400 error","Unknown or unresolvable domain returns partial score with domain signal absent","Rate limiting or payment failure (x402) blocks the call","Very new domains with no breach history may return low scores that understate real risk","Edge case: password hash prefix collision could theoretically affect k-anonymity lookup accuracy"],"whenToPreferThis":"Choose this endpoint when you need a privacy-preserving, fused signal that combines both password breach exposure and domain breach history into a single actionable risk score — without transmitting the raw password. Prefer it over standalone HaveIBeenPwned queries when you want a composite ATO risk score with categorization and per-signal breakdown in a single API call, especially in agent workflows where minimizing data exposure is critical.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T18:32:50.210Z","isFirstParty":false}