> For the complete documentation index, see [llms.txt](https://developer.paddle.com/llms.txt).

# api_key_exposure.created

Occurs when an API key has been exposed.

---

Occurs when Paddle detects that an API key has been publicly exposed, for example in a public code repository. Paddle automatically revokes the exposed key. [`api_key.revoked`](https://developer.paddle.com/webhooks/api-keys/api-key-revoked.md) occurs immediately after.
## Schema

```json
{
  "type": "object",
  "required": [
    "event_id",
    "event_type",
    "occurred_at",
    "notification_id",
    "data"
  ],
  "properties": {
    "event_id": {
      "type": "string",
      "pattern": "^evt_[a-z\\d]{26}$",
      "description": "Unique Paddle ID for this event, prefixed with `evt_`.",
      "title": "Event ID",
      "examples": [
        "evt_01gks14ge726w50ch2tmaw2a1x"
      ]
    },
    "event_type": {
      "type": "string",
      "enum": [
        "address.created",
        "address.imported",
        "address.updated",
        "adjustment.created",
        "adjustment.updated",
        "api_key.created",
        "api_key.expired",
        "api_key.expiring",
        "api_key.revoked",
        "api_key.updated",
        "api_key_exposure.created",
        "business.created",
        "business.imported",
        "business.updated",
        "client_token.created",
        "client_token.revoked",
        "client_token.updated",
        "customer.created",
        "customer.imported",
        "customer.updated",
        "discount.created",
        "discount.imported",
        "discount.updated",
        "discount_group.created",
        "discount_group.updated",
        "payment_method.saved",
        "payment_method.deleted",
        "payout.created",
        "payout.paid",
        "price.created",
        "price.imported",
        "price.updated",
        "product.created",
        "product.imported",
        "product.updated",
        "report.created",
        "report.updated",
        "subscription.activated",
        "subscription.canceled",
        "subscription.created",
        "subscription.imported",
        "subscription.past_due",
        "subscription.paused",
        "subscription.resumed",
        "subscription.trialing",
        "subscription.updated",
        "transaction.billed",
        "transaction.canceled",
        "transaction.completed",
        "transaction.created",
        "transaction.paid",
        "transaction.past_due",
        "transaction.payment_failed",
        "transaction.ready",
        "transaction.revised",
        "transaction.updated"
      ],
      "description": "Type of event sent by Paddle, in the format `entity.event_type`.",
      "title": "Event type name",
      "x-enum-descriptions": {
        "address.created": {
          "description": "An [`address.created`](https://developer.paddle.com/webhooks/addresses/address-created) event."
        },
        "address.imported": {
          "description": "An [`address.imported`](https://developer.paddle.com/webhooks/addresses/address-imported) event."
        },
        "address.updated": {
          "description": "An [`address.updated`](https://developer.paddle.com/webhooks/addresses/address-updated) event."
        },
        "adjustment.created": {
          "description": "An [`adjustment.created`](https://developer.paddle.com/webhooks/adjustments/adjustment-created) event."
        },
        "adjustment.updated": {
          "description": "An [`adjustment.updated`](https://developer.paddle.com/webhooks/adjustments/adjustment-updated) event."
        },
        "api_key.created": {
          "description": "An [`api_key.created`](https://developer.paddle.com/webhooks/api-keys/api-key-created) event."
        },
        "api_key.expired": {
          "description": "An [`api_key.expired`](https://developer.paddle.com/webhooks/api-keys/api-key-expired) event."
        },
        "api_key.expiring": {
          "description": "An [`api_key.expiring`](https://developer.paddle.com/webhooks/api-keys/api-key-expiring) event."
        },
        "api_key.revoked": {
          "description": "An [`api_key.revoked`](https://developer.paddle.com/webhooks/api-keys/api-key-revoked) event."
        },
        "api_key.updated": {
          "description": "An [`api_key.updated`](https://developer.paddle.com/webhooks/api-keys/api-key-updated) event."
        },
        "api_key_exposure.created": {
          "description": "An [`api_key_exposure.created`](https://developer.paddle.com/webhooks/api-key-exposures/api-key-exposure-created) event."
        },
        "business.created": {
          "description": "A [`business.created`](https://developer.paddle.com/webhooks/businesses/business-created) event."
        },
        "business.imported": {
          "description": "A [`business.imported`](https://developer.paddle.com/webhooks/businesses/business-imported) event."
        },
        "business.updated": {
          "description": "A [`business.updated`](https://developer.paddle.com/webhooks/businesses/business-updated) event."
        },
        "client_token.created": {
          "description": "A [`client_token.created`](https://developer.paddle.com/webhooks/client-tokens/client-token-created) event."
        },
        "client_token.revoked": {
          "description": "A [`client_token.revoked`](https://developer.paddle.com/webhooks/client-tokens/client-token-revoked) event."
        },
        "client_token.updated": {
          "description": "A [`client_token.updated`](https://developer.paddle.com/webhooks/client-tokens/client-token-updated) event."
        },
        "customer.created": {
          "description": "A [`customer.created`](https://developer.paddle.com/webhooks/customers/customer-created) event."
        },
        "customer.imported": {
          "description": "A [`customer.imported`](https://developer.paddle.com/webhooks/customers/customer-imported) event."
        },
        "customer.updated": {
          "description": "A [`customer.updated`](https://developer.paddle.com/webhooks/customers/customer-updated) event."
        },
        "discount.created": {
          "description": "A [`discount.created`](https://developer.paddle.com/webhooks/discounts/discount-created) event."
        },
        "discount.imported": {
          "description": "A [`discount.imported`](https://developer.paddle.com/webhooks/discounts/discount-imported) event."
        },
        "discount.updated": {
          "description": "A [`discount.updated`](https://developer.paddle.com/webhooks/discounts/discount-updated) event."
        },
        "discount_group.created": {
          "description": "A [`discount_group.created`](https://developer.paddle.com/webhooks/discount-groups/discount-group-created) event."
        },
        "discount_group.updated": {
          "description": "A [`discount_group.updated`](https://developer.paddle.com/webhooks/discount-groups/discount-group-updated) event."
        },
        "payment_method.saved": {
          "description": "A [`payment_method.saved`](https://developer.paddle.com/webhooks/payment-methods/payment-method-saved) event."
        },
        "payment_method.deleted": {
          "description": "A [`payment_method.deleted`](https://developer.paddle.com/webhooks/payment-methods/payment-method-deleted) event."
        },
        "payout.created": {
          "description": "A [`payout.created`](https://developer.paddle.com/webhooks/payouts/payout-created) event."
        },
        "payout.paid": {
          "description": "A [`payout.paid`](https://developer.paddle.com/webhooks/payouts/payout-paid) event."
        },
        "price.created": {
          "description": "A [`price.created`](https://developer.paddle.com/webhooks/prices/price-created) event."
        },
        "price.imported": {
          "description": "A [`price.imported`](https://developer.paddle.com/webhooks/prices/price-imported) event."
        },
        "price.updated": {
          "description": "A [`price.updated`](https://developer.paddle.com/webhooks/prices/price-updated) event."
        },
        "product.created": {
          "description": "A [`product.created`](https://developer.paddle.com/webhooks/products/product-created) event."
        },
        "product.imported": {
          "description": "A [`product.imported`](https://developer.paddle.com/webhooks/products/product-imported) event."
        },
        "product.updated": {
          "description": "A [`product.updated`](https://developer.paddle.com/webhooks/products/product-updated) event."
        },
        "report.created": {
          "description": "A [`report.created`](https://developer.paddle.com/webhooks/reports/report-created) event."
        },
        "report.updated": {
          "description": "A [`report.updated`](https://developer.paddle.com/webhooks/reports/report-updated) event."
        },
        "subscription.activated": {
          "description": "A [`subscription.activated`](https://developer.paddle.com/webhooks/subscriptions/subscription-activated) event."
        },
        "subscription.canceled": {
          "description": "A [`subscription.canceled`](https://developer.paddle.com/webhooks/subscriptions/subscription-canceled) event."
        },
        "subscription.created": {
          "description": "A [`subscription.created`](https://developer.paddle.com/webhooks/subscriptions/subscription-created) event."
        },
        "subscription.imported": {
          "description": "A [`subscription.imported`](https://developer.paddle.com/webhooks/subscriptions/subscription-imported) event."
        },
        "subscription.past_due": {
          "description": "A [`subscription.past_due`](https://developer.paddle.com/webhooks/subscriptions/subscription-past-due) event."
        },
        "subscription.paused": {
          "description": "A [`subscription.paused`](https://developer.paddle.com/webhooks/subscriptions/subscription-paused) event."
        },
        "subscription.resumed": {
          "description": "A [`subscription.resumed`](https://developer.paddle.com/webhooks/subscriptions/subscription-resumed) event."
        },
        "subscription.trialing": {
          "description": "A [`subscription.trialing`](https://developer.paddle.com/webhooks/subscriptions/subscription-trialing) event."
        },
        "subscription.updated": {
          "description": "A [`subscription.updated`](https://developer.paddle.com/webhooks/subscriptions/subscription-updated) event."
        },
        "transaction.billed": {
          "description": "A [`transaction.billed`](https://developer.paddle.com/webhooks/transactions/transaction-billed) event."
        },
        "transaction.canceled": {
          "description": "A [`transaction.canceled`](https://developer.paddle.com/webhooks/transactions/transaction-canceled) event."
        },
        "transaction.completed": {
          "description": "A [`transaction.completed`](https://developer.paddle.com/webhooks/transactions/transaction-completed) event."
        },
        "transaction.created": {
          "description": "A [`transaction.created`](https://developer.paddle.com/webhooks/transactions/transaction-created) event."
        },
        "transaction.paid": {
          "description": "A [`transaction.paid`](https://developer.paddle.com/webhooks/transactions/transaction-paid) event."
        },
        "transaction.past_due": {
          "description": "A [`transaction.past_due`](https://developer.paddle.com/webhooks/transactions/transaction-past-due) event."
        },
        "transaction.payment_failed": {
          "description": "A [`transaction.payment_failed`](https://developer.paddle.com/webhooks/transactions/transaction-payment-failed) event."
        },
        "transaction.ready": {
          "description": "A [`transaction.ready`](https://developer.paddle.com/webhooks/transactions/transaction-ready) event."
        },
        "transaction.revised": {
          "description": "A [`transaction.revised`](https://developer.paddle.com/webhooks/transactions/transaction-revised) event."
        },
        "transaction.updated": {
          "description": "A [`transaction.updated`](https://developer.paddle.com/webhooks/transactions/transaction-updated) event."
        }
      }
    },
    "occurred_at": {
      "type": "string",
      "format": "date-time",
      "description": "RFC 3339 datetime string of when this event occurred.",
      "title": "Timestamp",
      "examples": [
        "2024-10-12T07:20:50.52Z"
      ]
    },
    "notification_id": {
      "type": "string",
      "pattern": "^ntf_[a-z\\d]{26}$",
      "description": "Unique Paddle ID for this notification, prefixed with `ntf_`.",
      "title": "Notification ID",
      "examples": [
        "ntf_01ghbkd0frb9k95cnhwd1bxpvk"
      ]
    },
    "data": {
      "properties": {
        "id": {
          "type": "string",
          "pattern": "^apkexp_[a-z\\d]{26}$",
          "description": "Unique Paddle ID for this API key exposure entity, prefixed with `apkexp_`.",
          "title": "ApiKeyExposureID",
          "examples": [
            "apkexp_01jkas9tppn3bhadwpcyag45zd"
          ]
        },
        "api_key_id": {
          "type": "string",
          "pattern": "^apikey_[a-z\\d]{26}$",
          "description": "Unique Paddle ID for this API key entity, prefixed with `apikey_`.",
          "title": "API Key ID",
          "examples": [
            "apikey_01gm106t81w94gyjgsaqypkjkl"
          ]
        },
        "risk_level": {
          "type": "string",
          "enum": [
            "high",
            "low"
          ],
          "description": "Risk level of this exposure.",
          "title": "ApiKeyExposureLevel",
          "x-enum-descriptions": {
            "high": {
              "description": "API Key Exposure is high risk."
            },
            "low": {
              "description": "API Key Exposure is low risk."
            }
          }
        },
        "action_taken": {
          "type": "string",
          "enum": [
            "revoked",
            "none"
          ],
          "description": "Action performed by Paddle as a result of this exposure.",
          "title": "ApiKeyExposureActionTaken",
          "x-enum-descriptions": {
            "revoked": {
              "description": "API Key Exposure led to a revocation."
            },
            "none": {
              "description": "API Key Exposure resulted in no action."
            }
          }
        },
        "source": {
          "type": "string",
          "enum": [
            "github"
          ],
          "description": "Source of this exposure.",
          "title": "ApiKeyExposureSource",
          "x-enum-descriptions": {
            "github": {
              "description": "API Key was exposed on GitHub."
            }
          }
        },
        "reference": {
          "type": "string",
          "minLength": 1,
          "maxLength": 250,
          "description": "Reference or identifier for this exposure.",
          "title": "ApiKeyExposureReference"
        },
        "description": {
          "anyOf": [
            {
              "type": "string",
              "minLength": 1,
              "maxLength": 250,
              "description": "Short description of this API key exposure.",
              "title": "ApiKeyExposureDescription"
            },
            {
              "type": "null"
            }
          ]
        },
        "created_at": {
          "type": "string",
          "format": "date-time",
          "description": "RFC 3339 datetime string of when this entity was created. Set automatically by Paddle.",
          "title": "Created at",
          "examples": [
            "2024-10-12T07:20:50.52Z"
          ]
        }
      },
      "required": [
        "id",
        "api_key_id",
        "risk_level",
        "action_taken",
        "source",
        "reference",
        "description",
        "created_at"
      ],
      "type": "object",
      "description": "New or changed entity."
    }
  }
}
```

## Example

```json
{
  "event_id": "evt_01jkdr0rc527wcjdg1txsdxhtk",
  "event_type": "api_key_exposure.created",
  "occurred_at": "2025-08-19T12:58:38.746382Z",
  "notification_id": "ntf_01jkdr1mgbe62eqkh3p0fq8b0s",
  "data": {
    "id": "apkexp_01jkas9tppn3bhadwpcyag45zd",
    "api_key_id": "apikey_01jkdpbhazdpn3wpcya45as9tg",
    "risk_level": "high",
    "action_taken": "revoked",
    "source": "github",
    "reference": "https://github.com/octocat/Hello-World/blob/12345600b9cbe38a219f39a9941c9319b600c002/foo/bar.txt",
    "description": "Exposed in Commit 12345600b9cbe38a219f39a9941c9319b600c002",
    "created_at": "2025-08-19T12:58:38.746382Z"
  }
}
```