Skip to main content

​
1. Get an API key

Generate a key from your API Access dashboard. Keys look like: 
vp_live_3f9a1c2d.8b2e4f6a1d9c0e3f7b5a2d8c4e6f1a9b3d7c5e2f0a8b6d4c
  • vp_live_... — production key, billed against your plan
  • vp_test_... — test key, same shape and validation, scoped to a sandbox dataset
Treat your key like a password — see Authentication for storage and rotation guidance.

​
2. Make your first request

Every request needs your key in the api-key header. Here’s the simplest possible call — checking the API’s health (no key required): 
curl https://api.vantaprism.me/v1/health
Response
{ "status": "ok", "timestamp": "2026-06-15T10:00:00.000Z" }
Now check whether acme-corp.com has any exposed credentials. This is the most common starting query and requires the search:domain scope (present on every tier). 
curl -X POST https://api.vantaprism.me/v1/domain/search \
  -H "api-key: vp_live_XXXXXXXX.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["acme-corp.com"],
    "type": "employees",
    "limit": 25
  }'
Response
{
  "data": [
    {
      "victim_id": "a3f1c9e8b2d4567890abcdef1234567890abcdef1234567890abcdef123456",
      "log_victim_id": "RL-2026-AC91F3",
      "login": "jo***@acme-corp.com",
      "url": "https://login.microsoftonline.com/***",
      "stealer_family": "RedLine",
      "country": "US",
      "log_date": "2026-05-02T14:22:31Z"
    }
  ],
  "nextCursor": null,
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 38.2,
    "tier": "free",
    "masked_fields": ["login", "url"]
  }
}
Notice login and url are partially masked — this is the free-tier masking policy. Upgrading to pro or ultra returns these fields unmasked.

​
4. Handle pagination, errors, and rate limits

Most list endpoints are cursor-paginated — see Pagination. Every response uses the same envelope — see Response Envelope. Errors share one shape across the whole API — see Errors.

​
Next steps