> ## Documentation Index > Fetch the complete documentation index at: https://chainpatrol.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get Time to Detection > How long threats were already live before the earliest automated detection of the asset, for any organization. Broken down by asset type, for distinct assets this organization blocked in the date range that are still blocked today. The clock runs from when the asset was first seen live to its earliest automated detection; a human report does not stop it. Each median is a minimum. ## Overview Get how long threats were already live before ChainPatrol's automation first detected them, per asset type. It covers the distinct assets your organization blocked in a date range that are still blocked today. > [!NOTE] > > This endpoint is gated behind the `time-to-detection-chart` feature flag on a > per-organization basis. If the flag is not enabled for your organization, the API > returns a 403 Forbidden error. Contact ChainPatrol to enable access. ```bash theme={null} curl --request POST \ --url https://app.chainpatrol.io/api/v2/metrics/time-to-detection \ --header 'Content-Type: application/json' \ --header 'X-API-KEY: ' \ --data '{ "slug": "your-org", "startDate": "2026-08-01", "endDate": "2026-10-31" }' ``` ## Request Body | Field | Type | Required | Description | | - | - | - | - | | `slug` | `string` | ✅ Yes | Organization slug. | | `startDate` | `string` | ❌ No | Only assets blocked on or after this date. A date-only value (`YYYY-MM-DD`) starts at midnight UTC. | | `endDate` | `string` | ❌ No | Only assets blocked on or before this date. A date-only value covers the whole day in UTC. | | `brandIds` | `number[]` | ❌ No | Only assets belonging to these brands. | | `countryCodes` | `string[]` | ❌ No | Only assets scanned from these ISO 3166-1 alpha-2 countries. | ## How it is measured The clock runs from the first time anyone saw the asset live to its earliest automated detection, for any organization. A human report does not stop the clock, including your own. `byAssetType` has one entry per asset type, most blocks first: | Field | Description | | - | - | | `blocked` | Distinct assets of this type blocked in the range and still blocked today. | | `withEvidence` | Of those, how many enter the median: they have an accepted live date and an automated detection after it. | | `medianDaysAtLeast` | Median days the asset was live before it was detected. `null` when `withEvidence` is 0. | The median is always a minimum: the live date is the first time anyone saw the asset, and it may have been live before that. For URLs and pages only a date the site was seen serving counts, so a domain registration date never enters the number. ## OpenAPI ````yaml POST /metrics/time-to-detection openapi: 3.0.3 info: title: ChainPatrol External API - OpenAPI 3.0 description: ChainPatrol External API documentation version: 2.0.0 servers: - url: https://app.chainpatrol.io/api/v2 security: [] tags: - name: asset - name: report - name: dark-web externalDocs: url: https://chainpatrol.com/docs paths: /metrics/time-to-detection: post: tags: - metrics summary: Get organization time to detection by asset type description: >- How long threats were already live before the earliest automated detection of the asset, for any organization. Broken down by asset type, for distinct assets this organization blocked in the date range that are still blocked today. The clock runs from when the asset was first seen live to its earliest automated detection; a human report does not stop it. Each median is a minimum. operationId: metricsTimeToDetection requestBody: required: true content: application/json: schema: type: object properties: slug: type: string minLength: 1 description: Organization slug startDate: type: string description: >- Only include assets blocked on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC endDate: type: string description: >- Only include assets blocked on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off brandIds: type: array items: type: integer minimum: 0 exclusiveMinimum: true description: Only include assets belonging to these brands countryCodes: type: array items: type: string minLength: 2 maxLength: 2 description: >- Only include assets scanned from these ISO 3166-1 alpha-2 countries required: - slug responses: '200': description: Successful response content: application/json: schema: type: object properties: byAssetType: type: array items: type: object properties: assetType: type: string enum: - URL - PAGE - ADDRESS - DISCORD - LINKEDIN - TWITTER - FACEBOOK - YOUTUBE - REDDIT - TELEGRAM - GOOGLE_APP_STORE - APPLE_APP_STORE - AMAZON_APP_STORE - MICROSOFT_APP_STORE - TIKTOK - INSTAGRAM - THREADS - MEDIUM - CHROME_WEB_STORE - MOZILLA_ADDONS - OPERA_ADDONS - EMAIL - PATREON - OPENSEA - FARCASTER - IPFS - GOOGLE_FORM - WHATSAPP - DISCORD_USER - QUORA - GITHUB - TEACHABLE - SUBSTACK - DEBANK - TAWK_TO - JOTFORM - PRIMAL - BLUESKY - SNAPCHAT - DESO - PINTEREST - FLICKR - GALXE - VELOG - NPM - PYPI - HEX - DOCKER_HUB - VOCAL_MEDIA - TECKFINE - TENDERLY - HACKMD - ETSY - ZAZZLE - BASENAME - BILIBILI_TV - VIMEO - DAILYMOTION - PHONE_NUMBER - SLACK - CALENDLY - NGROK - RARIBLE - RUST_PACKAGE - FLATHUB - VIDLII - VEVIOZ - ISSUU - SOUNDCLOUD - ZAPPER - REDNOTE - SAMSUNG_APP_STORE - HUAWEI_APP_STORE - XIAOMI_APP_STORE - TENCENT_APP_STORE - OPPO_APP_STORE - VIVO_APP_STORE - F_DROID - GOOGLE_AD - BING_AD - TWITCH - BEHANCE - ZORA - META_AD - SIGNAL - DEVIANTART - BANDCAMP - ARCHIVE_ORG - FIVE_HUNDRED_PX - LUMA - SMARTMONEYMATCH - APK_GOLD - GLASSDOOR - PUMP_FUN - TUMBLR - MASTODON description: Asset type that was blocked blocked: type: number description: >- Distinct assets of this type the organization blocked within the date range that are still blocked today withEvidence: type: number description: >- Of those, how many enter the median: an accepted live date and an automated detection after it. A live date with no detection result does not count, and a human report is not a detection medianDaysAtLeast: type: number nullable: true description: >- Median days the asset was already live before the earliest automated detection of that asset, for any organization. Always a minimum, because the live date is the first time anyone saw the asset. Null when withEvidence is 0 required: - assetType - blocked - withEvidence - medianDaysAtLeast description: >- Time to Detection, one entry per asset type this organization blocked in the range, descending by number blocked. The clock stops at the earliest automated detection of the asset for any organization, not at this organization's report. Assets that do not enter withEvidence are left out of the median. For URL and page assets only an observed-serving date counts, so a domain registration date never enters the number required: - byAssetType '400': description: Invalid input data content: application/json: schema: $ref: '#/components/schemas/error.BAD_REQUEST' '401': description: Authorization not provided content: application/json: schema: $ref: '#/components/schemas/error.UNAUTHORIZED' '403': description: Insufficient access content: application/json: schema: $ref: '#/components/schemas/error.FORBIDDEN' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/error.INTERNAL_SERVER_ERROR' security: - ApiKey: [] components: schemas: error.BAD_REQUEST: type: object properties: message: type: string description: The error message example: Invalid input data code: type: string description: The error code example: BAD_REQUEST issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Invalid input data error (400) description: The error information example: code: BAD_REQUEST message: Invalid input data issues: [] error.UNAUTHORIZED: type: object properties: message: type: string description: The error message example: Authorization not provided code: type: string description: The error code example: UNAUTHORIZED issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Authorization not provided error (401) description: The error information example: code: UNAUTHORIZED message: Authorization not provided issues: [] error.FORBIDDEN: type: object properties: message: type: string description: The error message example: Insufficient access code: type: string description: The error code example: FORBIDDEN issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Insufficient access error (403) description: The error information example: code: FORBIDDEN message: Insufficient access issues: [] error.INTERNAL_SERVER_ERROR: type: object properties: message: type: string description: The error message example: Internal server error code: type: string description: The error code example: INTERNAL_SERVER_ERROR issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Internal server error error (500) description: The error information example: code: INTERNAL_SERVER_ERROR message: Internal server error issues: [] securitySchemes: ApiKey: type: apiKey in: header name: X-API-KEY description: >- Your API key. This is required by most endpoints to access our API programatically. Reach out to us at [support@chainpatrol.io](mailto:support@chainpatrol.io?subject=Re:%20API%20Key%20for%20SDK&body=Company:%20%0AName:%20%0APurpose:%20) to get an API key for your use. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.