# Introduction

The Non-Human Identities (NHI) API returns API keys, OAuth tokens, private keys, and other machine credentials that leaked from your employees' devices through infostealer malware, matched to your domain and enriched with device and source context.

## Coverage

Developers and operators keep secrets on their machines - in config files, shell history, browser storage, and editor projects. Infostealer malware takes those files along with everything else. Webz.io scans the leaked logs with detectors for hundreds of secret formats and matches every hit to the domains you monitor.

Each record is one secret: what kind of credential it is, which service issued it, whether it was still valid when checked, and the machine it came from.

## Enrichment

Every record is enriched at collection time:

- **Secret** - the token type (`ApiKey`, `OauthPAT`, `RefreshToken`, `PrivateKey`, ...), the detector that found it, and the matched value.
- **Verification** - whether the secret was confirmed live against its issuer (`verified`, `unverified`, `unknown`).
- **Employee** - the account email(s) found in the same infostealer log, so you know whose machine leaked it.
- **Device** - infection id, IP, location, operating system, malware family, and more.

## How it works

1. Send a `GET` request with the `domain` you want to check - see [Quickstart](nhi-quickstart).
2. Read the matching records from the JSON response.
3. Follow the `next` URL to page through the rest - see [Pagination](nhi-pagination).

## Monitoring status

The first time you query a domain, Webz.io starts monitoring it. Until the initial scan finishes, responses carry `"domainStatus": "pending"` and may be empty or partial. Once it reads `"active"`, the initial scan is complete - new records keep arriving as they are discovered, so query again over time.

> [!NOTE]
> A `verified` secret is a working credential. Rotate it first, then investigate the device it came from.