> ## Documentation Index > Fetch the complete documentation index at: https://chainpatrol.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get Time to Takedown by Provider > Get the median time from takedown start to completion, broken down by the provider a takedown was filed against, for a date range. Each takedown is counted once per provider role it carries (hosting provider, domain registrar, TLD registrar). Crypto address (ADDRESS) takedowns are left out, as in the other time-to-takedown metrics; `excludedAssetTypes` in the response lists them. ## Overview Get the median time from a takedown starting to its completion, per provider the takedown was filed against, for takedowns completed in a date range. Use it to see which hosts and registrars act quickly and which are slow. ```bash theme={null} curl --request POST \ --url https://app.chainpatrol.io/api/v2/metrics/takedown-time/by-provider \ --header 'Content-Type: application/json' \ --header 'X-API-KEY: ' \ --data '{ "slug": "your-org", "startDate": "2026-08-01", "endDate": "2026-10-31", "roles": ["HOSTING_PROVIDER", "DOMAIN_REGISTRAR"] }' ``` ## Request Body | Field | Type | Required | Description | | - | - | - | - | | `slug` | `string` | ✅ Yes | Organization slug. | | `startDate` | `string` | ❌ No | Only takedowns completed on or after this date. A date-only value (`YYYY-MM-DD`) starts at midnight UTC. | | `endDate` | `string` | ❌ No | Only takedowns completed on or before this date. A date-only value covers the whole day in UTC. | | `roles` | `string[]` | ❌ No | Only these provider roles: `HOSTING_PROVIDER`, `DOMAIN_REGISTRAR`, `TLD_REGISTRAR`. Omit for every role. | | `brandIds` | `number[]` | ❌ No | Only assets belonging to these brands. | | `brandType` | `string` | ❌ No | Only brands of this type: `INDIVIDUAL`, `ORGANIZATION` or `PRODUCT`. | | `blockLabel` | `string` | ❌ No | Only assets blocked with this review label, such as `Brand Impersonation`. | | `countryCodes` | `string[]` | ❌ No | Only assets scanned from these ISO 3166-1 alpha-2 countries. | ## Reading the response * `byProvider` has one entry per provider and role, fastest median first. A takedown filed against both a host and a registrar counts once under each. * `count` is the number of completed takedowns behind each median. * Crypto address (`ADDRESS`) takedowns are always left out, and `excludedAssetTypes` says so. See [Time to Takedown](https://chainpatrol.com/docs/external-api/metrics-takedown-time.md) for why. ## OpenAPI ````yaml POST /metrics/takedown-time/by-provider openapi: 3.0.3 info: title: ChainPatrol External API - OpenAPI 3.0 description: ChainPatrol External API documentation version: 2.0.0 servers: - url: https://app.chainpatrol.io/api/v2 security: [] tags: - name: asset - name: report - name: dark-web externalDocs: url: https://chainpatrol.com/docs paths: /metrics/takedown-time/by-provider: post: tags: - metrics summary: Get organization time-to-takedown metrics by provider description: >- Get the median time from takedown start to completion, broken down by the provider a takedown was filed against, for a date range. Each takedown is counted once per provider role it carries (hosting provider, domain registrar, TLD registrar). Crypto address (ADDRESS) takedowns are left out, as in the other time-to-takedown metrics; `excludedAssetTypes` in the response lists them. operationId: metricsTakedownTimeByProvider requestBody: required: true content: application/json: schema: type: object properties: slug: type: string minLength: 1 description: Organization slug startDate: type: string description: >- Only include takedowns completed on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC endDate: type: string description: >- Only include takedowns completed on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off roles: type: array items: type: string enum: - HOSTING_PROVIDER - DOMAIN_REGISTRAR - TLD_REGISTRAR description: >- Only break down these provider roles. Omit for every role. A takedown filed against both a host and a registrar is counted once under each blockLabel: type: string description: >- Only include assets blocked with this review label, e.g. "Brand Impersonation", "Employee Impersonation" or "Targeting Org Users" brandType: type: string enum: - INDIVIDUAL - ORGANIZATION - PRODUCT description: Only include assets belonging to brands of this type countryCodes: type: array items: type: string minLength: 2 maxLength: 2 description: >- Only include assets scanned from these ISO 3166-1 alpha-2 countries brandIds: type: array items: type: integer minimum: 0 exclusiveMinimum: true description: Only include assets belonging to these brands required: - slug responses: '200': description: Successful response content: application/json: schema: type: object properties: byProvider: type: array items: type: object properties: providerId: type: number description: Takedown provider id providerName: type: string description: Takedown provider name role: type: string enum: - HOSTING_PROVIDER - DOMAIN_REGISTRAR - TLD_REGISTRAR description: >- Which provider slot of the takedown this median is computed over medianTakedownMinutes: type: number medianTakedownHours: type: number medianTakedownDays: type: number count: type: number description: Number of completed takedowns behind the median required: - providerId - providerName - role - medianTakedownMinutes - medianTakedownHours - medianTakedownDays - count description: >- Median time from takedown start to completion, one entry per provider and role, ascending by median excludedAssetTypes: type: array items: type: string enum: - URL - PAGE - ADDRESS - DISCORD - LINKEDIN - TWITTER - FACEBOOK - YOUTUBE - REDDIT - TELEGRAM - GOOGLE_APP_STORE - APPLE_APP_STORE - AMAZON_APP_STORE - MICROSOFT_APP_STORE - TIKTOK - INSTAGRAM - THREADS - MEDIUM - CHROME_WEB_STORE - MOZILLA_ADDONS - OPERA_ADDONS - EMAIL - PATREON - OPENSEA - FARCASTER - IPFS - GOOGLE_FORM - WHATSAPP - DISCORD_USER - QUORA - GITHUB - TEACHABLE - SUBSTACK - DEBANK - TAWK_TO - JOTFORM - PRIMAL - BLUESKY - SNAPCHAT - DESO - PINTEREST - FLICKR - GALXE - VELOG - NPM - PYPI - HEX - DOCKER_HUB - VOCAL_MEDIA - TECKFINE - TENDERLY - HACKMD - ETSY - ZAZZLE - BASENAME - BILIBILI_TV - VIMEO - DAILYMOTION - PHONE_NUMBER - SLACK - CALENDLY - NGROK - RARIBLE - RUST_PACKAGE - FLATHUB - VIDLII - VEVIOZ - ISSUU - SOUNDCLOUD - ZAPPER - REDNOTE - SAMSUNG_APP_STORE - HUAWEI_APP_STORE - XIAOMI_APP_STORE - TENCENT_APP_STORE - OPPO_APP_STORE - VIVO_APP_STORE - F_DROID - GOOGLE_AD - BING_AD - TWITCH - BEHANCE - ZORA - META_AD - SIGNAL - DEVIANTART - BANDCAMP - ARCHIVE_ORG - FIVE_HUNDRED_PX - LUMA - SMARTMONEYMATCH - APK_GOLD - GLASSDOOR - PUMP_FUN - TUMBLR - MASTODON description: >- Asset types left out of this result because no asset-type filter was given. Empty when the result covers exactly the asset types requested required: - byProvider - excludedAssetTypes '400': description: Invalid input data content: application/json: schema: $ref: '#/components/schemas/error.BAD_REQUEST' '401': description: Authorization not provided content: application/json: schema: $ref: '#/components/schemas/error.UNAUTHORIZED' '403': description: Insufficient access content: application/json: schema: $ref: '#/components/schemas/error.FORBIDDEN' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/error.INTERNAL_SERVER_ERROR' security: - ApiKey: [] components: schemas: error.BAD_REQUEST: type: object properties: message: type: string description: The error message example: Invalid input data code: type: string description: The error code example: BAD_REQUEST issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Invalid input data error (400) description: The error information example: code: BAD_REQUEST message: Invalid input data issues: [] error.UNAUTHORIZED: type: object properties: message: type: string description: The error message example: Authorization not provided code: type: string description: The error code example: UNAUTHORIZED issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Authorization not provided error (401) description: The error information example: code: UNAUTHORIZED message: Authorization not provided issues: [] error.FORBIDDEN: type: object properties: message: type: string description: The error message example: Insufficient access code: type: string description: The error code example: FORBIDDEN issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Insufficient access error (403) description: The error information example: code: FORBIDDEN message: Insufficient access issues: [] error.INTERNAL_SERVER_ERROR: type: object properties: message: type: string description: The error message example: Internal server error code: type: string description: The error code example: INTERNAL_SERVER_ERROR issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Internal server error error (500) description: The error information example: code: INTERNAL_SERVER_ERROR message: Internal server error issues: [] securitySchemes: ApiKey: type: apiKey in: header name: X-API-KEY description: >- Your API key. This is required by most endpoints to access our API programatically. Reach out to us at [support@chainpatrol.io](mailto:support@chainpatrol.io?subject=Re:%20API%20Key%20for%20SDK&body=Company:%20%0AName:%20%0APurpose:%20) to get an API key for your use. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.