Sold by: RelayShield
RelayShield Core Identity Exposure delivers metered access to six identity threat detection APIs, billed entirely through AWS Marketplace. It covers breach exposure, SIM swap detection, infostealer log checks, domain lookalike detection, OAuth token exposure, and crypto threat intelligence. The bundle is licensed independently, with no dependency on any other RelayShield product or bundle.
Overview
Core Identity Exposure is built for teams that need to know whether an identity has already been compromised, before it is used against them.
The bundle includes breach exposure checks against an aggregated breach corpus and dark web credential databases, SIM swap detection that surfaces recent swap activity on a phone number (a common account takeover precursor), infostealer log checks that find credentials harvested by stealer malware, domain lookalike detection for typosquatted domains registered against your brand, an OAuth token exposure watchlist covering leaked OAuth and API tokens, and crypto threat intelligence for wallet and domain checks against RelayShield's criminal corpus.
The six endpoints are designed to be used together. An identity appearing in a breach corpus is routine. The same identity showing recent SIM swap activity and credentials in a fresh stealer log is an active incident, and correlating those signals is what this bundle exists to do.
All endpoints are backed by RelayShield's live threat intelligence corpus: 5.1M+ indicators of compromise and 87 monitored criminal Telegram channels. Your API key is issued automatically by email when your AWS Marketplace subscription activates, with full usage instructions included. All access is provisioned and billed through AWS Marketplace.
Highlights
- Six identity exposure APIs licensed as one bundle through AWS Marketplace, with no dependency on any other bundle or platform-wide subscription.
- Correlates breach, SIM swap, infostealer, OAuth token and domain signals against the same identity, separating an active account takeover from a stale breach record.
- Backed by a live threat intelligence corpus of 5.1M+ indicators of compromise and 87 monitored criminal Telegram channels, updated continuously.
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor, and additional usage. You pay upfront or in installments according to your contract terms with the vendor. This entitles you to a specified quantity of use for the contract duration. Usage-based pricing is in effect for overages or additional usage not covered in the contract. These charges are applied on top of the contract price. If you choose not to renew or replace your contract before the contract end date, access to your entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
Core Identity Exposure - Monthly Access | Monthly minimum commitment for Core Identity Exposure API access, six endpoints. | $150.00 |
Dimension | Description | Cost/unit |
|---|---|---|
Breach Exposure Check | Checks an email against an aggregated breach and dark web credential corpus. | $0.10 |
SIM Swap Detection | Detects recent SIM swap activity on a phone number, a common account takeover precursor. | $0.25 |
Infostealer Log Check | Checks whether credentials for an identity appear in infostealer malware logs. | $0.50 |
Domain Lookalike Detection | Finds typosquatted and lookalike domains registered against your brand. | $0.30 |
OAuth Token Exposure Watchlist | Surfaces exposed OAuth and API tokens across leaked credential sources. | $0.30 |
Crypto Intelligence Check | Checks wallets and domains against RelayShield's crypto threat intelligence corpus. | $0.30 |
Dimensions summary
This bundle bills per API call across six independent identity-exposure endpoints, plus a monthly access commitment. You pay separately for each check type: Breach Exposure, SIM Swap Detection, Infostealer Log, Domain Lookalike, OAuth Token Exposure, and Crypto Intelligence. These are usage-based dimensions, not tiers — you are charged only for the calls you make to each one. The Core Identity Exposure - Monthly Access dimension sets a monthly minimum commitment covering the six endpoints. Your total cost scales with call volume per endpoint, so heavier use of any check raises that dimension's charge.
Top-of-mind questions for buyers
One unit equals one API call to that endpoint. A Breach Exposure Check bills per email checked. A SIM Swap Detection bills per phone number checked. Each check type meters its own calls separately, so you are charged once per query you make to each endpoint.
No per-call charge accrues for an endpoint you do not use. Each of the six check types bills only for calls made to it. However, the Core Identity Exposure - Monthly Access dimension sets a monthly minimum that applies regardless of how many calls you make.
The Monthly Access dimension sets a recurring minimum covering the six endpoints. Your per-call charges for each check type add on top based on volume used. Call volume drives most of the variable cost. All charges appear together on the same monthly invoice through AWS.
api.relayshield.net
Helpful?
Vendor refund policy
Email support: support@relayshield.net . Full API documentation, authentication steps, endpoint URLs, and sample requests are included in this product's Usage Instructions. Response within 1 business day for standard issues.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Additional details
Usage instructions
Overview RelayShield Core Identity Exposure (Bundle A) is a REST API. All endpoints are served from a single base URL and authenticated with one header.
Base URL https://api.relayshield.net
Getting your API key
- Subscribe to this product in AWS Marketplace.
- On the "Set up your account" page after subscribing, enter the email address where your key should be sent.
- Your API key is emailed automatically when the subscription activates. No separate account or payment method is required; all billing is handled by AWS Marketplace.
- If the email has not arrived within 15 minutes, contact support@relayshield.net with your AWS account ID.
Authentication Every request requires this header: X-RS-API-KEY: YOUR_API_KEY
Verifying your access Run this call to confirm your key is active. A 200 response confirms the endpoint is reachable and your key is valid.
curl -X POST https://api.relayshield.net/v1/metered/breach
-H "X-RS-API-KEY: YOUR_API_KEY"
-H "Content-Type: application/json"
-d '{"email": "user@example.com "}'
Endpoints
-
Breach Exposure Check POST https://api.relayshield.net/v1/metered/breach Checks an email address against an aggregated breach corpus and dark web credential databases. curl -X POST https://api.relayshield.net/v1/metered/breach
-H "X-RS-API-KEY: YOUR_API_KEY" -H "Content-Type: application/json"
-d '{"email": "user@example.com "}' -
SIM Swap Detection POST https://api.relayshield.net/v1/metered/sim-swap Detects a recent SIM swap or carrier port on a phone number, a common account takeover precursor. curl -X POST https://api.relayshield.net/v1/metered/sim-swap
-H "X-RS-API-KEY: YOUR_API_KEY" -H "Content-Type: application/json"
-d '{"phone": "+15551234567"}' -
Infostealer Log Check POST https://api.relayshield.net/v1/metered/infostealer Checks an email address against credentials harvested by infostealer malware. curl -X POST https://api.relayshield.net/v1/metered/infostealer
-H "X-RS-API-KEY: YOUR_API_KEY" -H "Content-Type: application/json"
-d '{"email": "user@example.com "}' -
Domain Lookalike Detection POST https://api.relayshield.net/v1/metered/domain Scans a domain for active phishing lookalikes and typosquats registered against your brand. curl -X POST https://api.relayshield.net/v1/metered/domain
-H "X-RS-API-KEY: YOUR_API_KEY" -H "Content-Type: application/json"
-d '{"domain": "example.com"}' -
OAuth Token Exposure Watchlist POST https://api.relayshield.net/v1/metered/oauth-watchlist Finds exposed OAuth tokens and SaaS credentials tied to an email address. curl -X POST https://api.relayshield.net/v1/metered/oauth-watchlist
-H "X-RS-API-KEY: YOUR_API_KEY" -H "Content-Type: application/json"
-d '{"email": "user@example.com "}' -
Crypto Intelligence Check POST https://api.relayshield.net/v1/metered/crypto-intel Screens an EVM address, and optionally a token contract, against RelayShield's crypto threat intelligence corpus. Optional fields: "chain_id", "token_address". curl -X POST https://api.relayshield.net/v1/metered/crypto-intel
-H "X-RS-API-KEY: YOUR_API_KEY" -H "Content-Type: application/json"
-d '{"address": "0x0000000000000000000000000000000000000000"}'
Billing Your monthly contract covers access to the bundle. Individual calls are metered per endpoint and reported to AWS Marketplace, and they appear on your AWS bill. There is no separate invoice from RelayShield.
Full API reference https://api.relayshield.net/docs
Support support@relayshield.net , response within 1 business day for standard issues.
Support
Vendor support
Email support: support@relayshield.net . Full API documentation, authentication steps, endpoint URLs, and sample requests are included in this product's Usage Instructions. Response within 1 business day for standard issues.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
RelayShield delivers threat intelligence and identity security via REST API - 4.5M+ IOC corpus, breach detection, SIM swap monitoring, infostealer exposure, ransomware victim tracking, and session hijack detection. Built for MSPs, MSSPs, and security-forward development teams.
RelayShield's Consumption Security API Bundles deliver metered access to focused sets of threat intelligence and identity risk detection capabilities, billed entirely through AWS Marketplace. Each bundle is licensed independently, with no dependency on any other bundle. Bundle D, Agentic Attack Surface, covers MCP registry risk, prompt-injection breach correlation, agent-framework CVE targeting, bulk per-agent identity risk scoring, and LLM Credential Exposure Detection.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.