> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# How to Access the Credential Intelligence Flag

## Overview

This guide demonstrates a couple of ways to access the Credential Intelligence flag and to identify requests containing compromised credentials.\
The first is through [a request header](/applications/how-to-access-the-breached-flag#option-1-compromised-credentials-header), and the second is through [the additional activity handler custom function](/applications/how-to-access-the-breached-flag#option-2-additional-activity-handler-and-pxde-object) in the enforcer itself.

## Accessing the Credential Intelligence Flag

### Option 1 - Compromised Credentials Header

If credentials are flagged as compromised, a header will be added to the request. This way, inline flow operation in your app can implement the desired business logic. This will be done by checking this header and performing operations based on the result of the flag - compromised or not.\
Please note that if the Bot Defender product is enabled and on block mode, if this request is determined as a request coming from a bot, it will be blocked by the enforcer.

The name of the header is determined by the `px_compromised_credentials_header`. By default, the header name is `px-compromised-credentials`. If the credentials are compromised, the value of this header will be `1`; otherwise, the header will not be present on the request.

> **Note**
>
> The header name can be modified in all enforcers with the exception of the Fastly VCL Enforcer.

See the pseudocode example below. The HUMAN middleware is added before the request to `/login`. The `handleLogin` function checks the `px-compromised-credentials` header to decide which business logic to apply to the request.

```javascript
router.addMiddleware(px.middleware);
router.post('/login', handleLogin);

function handleLogin(req, res) {
    const areCredentialsCompromised = req.headers['px-compromised-credentials'] == '1';
    if (areCredentialsCompromised) {
        // some logic
    } else {
        // some other logic
    }
}
```

### Option 2 - Additional Activity Handler and PXDE Object

It's possible to identify compromised credentials from within the HUMAN Enforcer as well. This can be done using the Additional Activity Handler, a customizable function that executes additional logic within the enforcer. This is useful if you need to perform additional operations during enforcement, or if headers are not a viable option for your backend architecture.

See the pseudocode example below. The `pxCtx` may contain the property `pxde`, a HUMAN data enrichment object. If this PXDE object exists and the `breached_account` property on it also exists, then the credentials have been flagged as compromised.

```javascript
px.init({
    px_app_id: "PX_APP_ID",
    // ...
    px_additional_activity_handler: additionalActivityHandler
});

function additionalActivityHandler(pxCtx, pxConfig) {
    const areCredentialsCompromised = pxCtx.pxde && pxCtx.pxde['breached_account'];
    if (areCredentialsCompromised) {
        // some logic
    } else {
        // some other logic
    }
}
```

> **Note**
>
> The Additional Activity Handler is called for every request, not only those that trigger the Credentials Intelligence flow.