Quickstart

Make your first authenticated request to the VantaPrism API.

1. Get an API key

Generate a key from your API Access dashboard. Keys look like:

vp_live_3f9a1c2d.8b2e4f6a1d9c0e3f7b5a2d8c4e6f1a9b3d7c5e2f0a8b6d4c

• vp_live_... — production key, billed against your plan
• vp_test_... — test key, same shape and validation, scoped to a sandbox dataset

Treat your key like a password — see Authentication for storage and rotation guidance.

2. Make your first request

Every request needs your key in the api-key header. Here’s the simplest possible call — checking the API’s health (no key required):

cURL

curl https://api.vantaprism.me/v1/health

Response

{ "status": "ok", "timestamp": "2026-06-15T10:00:00.000Z" }

3. Run your first authenticated search

Now check whether acme-corp.com has any exposed credentials. This is the most common starting query and requires the search:domain scope (present on every tier).

cURL

curl -X POST https://api.vantaprism.me/v1/domain/search \
  -H "api-key: vp_live_XXXXXXXX.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["acme-corp.com"],
    "type": "employees",
    "limit": 25
  }'

Response

{
  "data": [
    {
      "victim_id": "a3f1c9e8b2d4567890abcdef1234567890abcdef1234567890abcdef123456",
      "log_victim_id": "RL-2026-AC91F3",
      "login": "jo***@acme-corp.com",
      "url": "https://login.microsoftonline.com/***",
      "stealer_family": "RedLine",
      "country": "US",
      "log_date": "2026-05-02T14:22:31Z"
    }
  ],
  "nextCursor": null,
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 38.2,
    "tier": "free",
    "masked_fields": ["login", "url"]
  }
}

Notice login and url are partially masked — this is the free-tier masking policy. Upgrading to pro or ultra returns these fields unmasked.

4. Handle pagination, errors, and rate limits

Most list endpoints are cursor-paginated — see Pagination. Every response uses the same envelope — see Response Envelope. Errors share one shape across the whole API — see Errors.

Next steps

• Authentication — key formats, header styles, rotation
• Rate Limits & Tiers — what each tier allows
• Domain Intelligence — your first capability area