Summary
Report a leaked API key. No API key. Body is one object {key, source_url?, reporter?} or an array of at most 20. token is an alias of key. url is an alias of source_url. Unknown fields are ignored. key is required, trimmed, and at most 200 characters. source_url is optional, http or https, at most 2048 characters. reporter is optional plain text of at most 200 characters and is not stored. A string that does not match coop_live_ plus 32 base64url characters (coop_live_[A-Za-z0-9_-]{32}) is accepted and ignored. A live match is revoked immediately: revoked_reason leak_reported, leak_reported_at now, and the verified owners are emailed once per address. Already revoked and unknown keys are unchanged and send no email. The response is HTTP 202 {received} for every valid body and does not say whether a key matched. 30 requests per hour per IP, then HTTP 429 rate_limited with Retry-After. There is no MCP tool for this report. Guide: /docs/leaked-keys.
Request
{
"key": "coop_live_…",
"source_url": "https://example.com/paste"
}Response
HTTP 202. Sample values illustrate the schema.
{
"received": 1
}Errors
- HTTP 429 rate_limited
- HTTP 400 invalid_json
- HTTP 400 invalid_key
- HTTP 400 invalid_source_url
- HTTP 400 source_url
- HTTP 400 invalid_reporter
- HTTP 400 too_many_items
Idempotency
This route does not document Idempotency-Key or client_id.