List Detections

async function fetchDetections({ slug, startDate, endDate, filters = [] }) {
  const detections = new Map();
  let cursor;

  do {
    const response = await fetch("https://api.chainpatrol.io/detection/list", {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "X-API-KEY": "<api-key>",
      },
      body: JSON.stringify({
        slug,
        limit: 1000,
        filters,
        ...(startDate ? { startDate } : {}),
        ...(endDate ? { endDate } : {}),
        ...(cursor ? { cursor } : {}),
      }),
    });
    if (!response.ok) {
      throw new Error(`detection/list failed: ${response.status}`);
    }
    const data = await response.json();
    for (const detection of data.detections) {
      detections.set(detection.id, detection);
    }
    cursor = data.nextCursor;
  } while (cursor);

  return [...detections.values()];
}

// Incremental run: everything created since the previous run started.
const OVERLAP_MS = 5 * 60 * 1000;
const syncStartedAt = new Date();
const previousSyncStartedAt = new Date("2026-09-24T00:00:00Z"); // load from your store

const newDetections = await fetchDetections({
  slug: "your-org",
  startDate: new Date(previousSyncStartedAt.getTime() - OVERLAP_MS).toISOString(),
  endDate: syncStartedAt.toISOString(),
  filters: [{ property: "assetType", operator: "in", value: ["URL"] }],
});
// Save `syncStartedAt` as the next run's `previousSyncStartedAt`.

from datetime import datetime, timedelta, timezone

import requests

def fetch_detections(slug, start_date=None, end_date=None, filters=None):
    detections = {}
    cursor = None
    while True:
        body = {"slug": slug, "limit": 1000, "filters": filters or []}
        if start_date:
            body["startDate"] = start_date.isoformat()
        if end_date:
            body["endDate"] = end_date.isoformat()
        if cursor:
            body["cursor"] = cursor
        response = requests.post(
            "https://api.chainpatrol.io/detection/list",
            headers={"Content-Type": "application/json", "X-API-KEY": "<api-key>"},
            json=body,
        )
        response.raise_for_status()
        data = response.json()
        for detection in data["detections"]:
            detections[detection["id"]] = detection
        cursor = data.get("nextCursor")
        if not cursor:
            break
    return list(detections.values())

# Incremental run: everything created since the previous run started.
sync_started_at = datetime.now(timezone.utc)
previous_sync_started_at = datetime(2026, 9, 24, tzinfo=timezone.utc)  # load from your store

new_detections = fetch_detections(
    "your-org",
    start_date=previous_sync_started_at - timedelta(minutes=5),
    end_date=sync_started_at,
    filters=[{"property": "assetType", "operator": "in", "value": ["URL"]}],
)
# Save `sync_started_at` as the next run's `previous_sync_started_at`.

async function fetchDetectionResults(params) {
  const response = await fetch("https://api.chainpatrol.io/detection/list", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "X-API-KEY": "<api-key>",
    },
    body: JSON.stringify(params),
  });
  return response.json();
}

// Example usage
fetchDetectionResults({
  slug: "your-org",
  limit: 50,
  query: "phishing",
  filters: [
    {
      property: "assetStatus",
      operator: "in",
      value: ["BLOCKED"],
    },
    {
      property: "assetType",
      operator: "in",
      value: ["URL", "ADDRESS"],
    },
  ],
  startDate: "2024-01-01T00:00:00Z",
  endDate: "2024-03-01T00:00:00Z",
})
  .then((data) => {
    console.log("Detection results:", data.detections);
    console.log("Next cursor:", data.nextCursor);
  })
  .catch((error) => console.error("Error fetching results:", error));

interface DetectionFilter {
  property:
    | "source"
    | "assetStatus"
    | "blockStatus"
    | "deleted"
    | "assetType"
    | "confidence";
  operator: "in" | "notIn";
  value: string[];
}

interface DetectionListParams {
  slug: string;
  cursor?: number;
  limit?: number;
  filters?: DetectionFilter[];
  query?: string;
  startDate?: string;
  endDate?: string;
  minScore?: number;
  maxScore?: number;
  includeTotal?: boolean;
}

interface AssetObject {
  id: number;
  content: string;
  type: string;
  status: string;
  pendingStatus: string | null;
}

interface DetectionResult {
  id: number;
  threatContent: string;
  source: string;
  createdAt: string;
  confidence: "none" | "low" | "medium" | "high";
  score: number;
  reportStatus: "REPORTED" | "NOT_REPORTED";
  asset: AssetObject;
}

interface DetectionListResponse {
  detections: DetectionResult[];
  nextCursor?: number;
  total?: number;
}

async function fetchDetectionResults(
  params: DetectionListParams
): Promise<DetectionListResponse> {
  const response = await fetch("https://api.chainpatrol.io/detection/list", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "X-API-KEY": "<api-key>",
    },
    body: JSON.stringify(params),
  });
  return response.json();
}

// Example usage
fetchDetectionResults({
  slug: "your-org",
  limit: 50,
  filters: [
    {
      property: "source",
      operator: "in",
      value: ["GOOGLE_SEARCH", "EXTERNAL"],
    },
    {
      property: "assetStatus",
      operator: "in",
      value: ["BLOCKED"],
    },
  ],
})
  .then((data) => {
    console.log(`Found ${data.detections.length} detection results`);
    data.detections.forEach((item) => {
      console.log(`Threat: ${item.threatContent}`);
      console.log(`Asset: ${item.asset.content} (${item.asset.type})`);
      console.log(`Status: ${item.asset.status}`);
      console.log(`Confidence: ${item.confidence}`);
      console.log(`Report Status: ${item.reportStatus}`);
      console.log("---");
    });

    if (data.nextCursor) {
      console.log("More results available with cursor:", data.nextCursor);
    }
  })
  .catch((error) => console.error("Error fetching results:", error));