Skip to main content
POST
Get currently blocked threats by first-report source

Overview

Count the distinct currently blocked assets whose earliest report for your organization falls in a date range, split by who reported them first: your team (customer) or ChainPatrol (chainpatrol). Use this endpoint to see how many blocked threats were discovered proactively by ChainPatrol versus submitted by your own team and community.
This endpoint is gated behind the threat-discovery-source-api feature flag on a per-organization basis. If the flag is not enabled for your organization, the API returns a 403 Forbidden error. Contact ChainPatrol to enable access.

How assets are counted

  • First-report cohort — Each asset is attributed to the source of its earliest non-deleted report for your organization. The date range filters on when that first report was created, not on when the asset was blocked.
  • Blocked only — Only assets whose current status (or pending status) is BLOCKED are counted. Assets that were reported in the range but never blocked, or later unblocked, are excluded.
  • Source buckets:
    • customer — assets first reported by your team, an external reporter, or a customer-role user.
    • chainpatrol — assets first reported by ChainPatrol staff or automation. Staff and automation are collapsed into a single bucket.
    • totalscustomer + chainpatrol.
totals.blocked does not match the counts from POST /metrics/found. This endpoint windows on each asset’s first report date, while /metrics/found counts assets by when they were blocked.

Date handling

  • startDate and endDate are required, and startDate must be on or before endDate.
  • Date-only values (YYYY-MM-DD) are interpreted in UTC. startDate begins at midnight UTC and endDate covers the whole day (through 23:59:59.999 UTC). Pass a full ISO 8601 timestamp for a precise cut-off.
  • Impossible calendar dates (for example 2026-02-31) are rejected with a 400 error instead of being rolled forward to the next month.

Brand filtering

Pass the optional brandIds array to restrict counts to assets belonging to specific brands. Every ID must belong to your organization. If any ID references a brand outside your organization (or a deleted brand), the API returns a 404 error instead of silently ignoring it.

Example request

Example response

Authorizations

X-API-KEY
string
header
required

Your API key. This is required by most endpoints to access our API programatically. Reach out to us at support@chainpatrol.io to get an API key for your use.

Body

application/json
slug
string
required

Organization slug

Minimum string length: 1
startDate
string
required

Only include assets whose earliest report was created on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC

endDate
string
required

Only include assets whose earliest report was created on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off

brandIds
integer[]

Only include assets belonging to these brands

Required range: x > 0

Response

Successful response

range
object
required
customer
object
required

Currently blocked assets first reported by the customer (reportedByCustomer, external reporter, or customer-role user)

chainpatrol
object
required

Currently blocked assets first reported by ChainPatrol staff or automation. Staff and automation are collapsed together.

totals
object
required

customer + chainpatrol. This is a first-report blocked cohort and does not equal metrics/found, which counts assets by blockedAt.