List Organization Threats

List organization threats

curl --request GET \
  --url https://app.chainpatrol.io/api/v2/organization/threats \
  --header 'X-API-KEY: <api-key>'

const options = {method: 'GET', headers: {'X-API-KEY': '<api-key>'}};

fetch('https://app.chainpatrol.io/api/v2/organization/threats', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.chainpatrol.io/api/v2/organization/threats",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-API-KEY: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://app.chainpatrol.io/api/v2/organization/threats"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-API-KEY", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://app.chainpatrol.io/api/v2/organization/threats")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-API-KEY"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "threats": [
    {
      "id": 123,
      "content": "<string>",
      "type": "URL",
      "status": "UNKNOWN",
      "pendingStatus": "UNKNOWN",
      "state": "investigating",
      "livenessStatus": "UNKNOWN",
      "brands": [
        {
          "slug": "<string>",
          "name": "<string>"
        }
      ],
      "firstReportedAt": "<string>",
      "escalatedAt": "<string>",
      "blockedAt": "<string>",
      "takedown": {
        "status": "TODO",
        "submittedAt": "<string>",
        "completedAt": "<string>"
      },
      "detailsUrl": "<string>",
      "updatedAt": "<string>"
    }
  ],
  "next_page": "<string>"
}

{
  "code": "BAD_REQUEST",
  "message": "Invalid input data",
  "issues": []
}

{
  "code": "UNAUTHORIZED",
  "message": "Authorization not provided",
  "issues": []
}

{
  "code": "FORBIDDEN",
  "message": "Insufficient access",
  "issues": []
}

{
  "code": "NOT_FOUND",
  "message": "Not found",
  "issues": []
}

{
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal server error",
  "issues": []
}

GET

organization

threats

List organization threats

curl --request GET \
  --url https://app.chainpatrol.io/api/v2/organization/threats \
  --header 'X-API-KEY: <api-key>'

const options = {method: 'GET', headers: {'X-API-KEY': '<api-key>'}};

fetch('https://app.chainpatrol.io/api/v2/organization/threats', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.chainpatrol.io/api/v2/organization/threats",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-API-KEY: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://app.chainpatrol.io/api/v2/organization/threats"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-API-KEY", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://app.chainpatrol.io/api/v2/organization/threats")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-API-KEY"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "threats": [
    {
      "id": 123,
      "content": "<string>",
      "type": "URL",
      "status": "UNKNOWN",
      "pendingStatus": "UNKNOWN",
      "state": "investigating",
      "livenessStatus": "UNKNOWN",
      "brands": [
        {
          "slug": "<string>",
          "name": "<string>"
        }
      ],
      "firstReportedAt": "<string>",
      "escalatedAt": "<string>",
      "blockedAt": "<string>",
      "takedown": {
        "status": "TODO",
        "submittedAt": "<string>",
        "completedAt": "<string>"
      },
      "detailsUrl": "<string>",
      "updatedAt": "<string>"
    }
  ],
  "next_page": "<string>"
}

{
  "code": "BAD_REQUEST",
  "message": "Invalid input data",
  "issues": []
}

{
  "code": "UNAUTHORIZED",
  "message": "Authorization not provided",
  "issues": []
}

{
  "code": "FORBIDDEN",
  "message": "Insufficient access",
  "issues": []
}

{
  "code": "NOT_FOUND",
  "message": "Not found",
  "issues": []
}

{
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal server error",
  "issues": []
}

Overview

List every asset reported for your organization, by your team or by ChainPatrol, with where each one stands: still under investigation, escalated to you, blocked or allowed, and how far its takedown has got. Use it to keep a threat-intel platform, SIEM or ticketing system in step with ChainPatrol. Page through it once for a backfill, then poll with updatedSince and upsert each row on id. To list only confirmed threats blocked in a date range, use /threats/list. To list unconfirmed detections, use /detection/list.

Quick Start

Authentication

Include your API key in the X-API-KEY header. Organization API keys resolve the organization from the key, so slug is optional for them.

X-API-KEY: <api-key>

Example Request

curl --request GET \
  --url 'https://app.chainpatrol.io/api/v2/organization/threats?updatedSince=2026-11-01T00:00:00Z&per_page=500' \
  --header 'X-API-KEY: <api-key>'

Query Parameters

Parameter	Type	Required	Default	Description
`slug`	`string`	❌ No	-	Organization slug. Needed only when your credentials can reach more than one organization.
`updatedSince`	`string`	❌ No	-	ISO 8601 timestamp. Only threats whose asset, reports or takedown changed at or after this time. Omit to backfill.
`assetType`	`AssetType`	❌ No	-	Only threats of this asset type.
`per_page`	`number`	❌ No	`100`	Threats per page, 1 to 1000.
`next_page`	`string`	❌ No	-	The `next_page` value from the previous response.

Lifecycle states

state sums up each asset’s reports and the decision on it:

`state`	Meaning
`investigating`	A report is open and ChainPatrol is reviewing it.
`escalated`	A report is open and waiting on a decision from your organization.
`blocked`	The asset is on the blocklist.
`allowed`	The asset is on the allowlist.
`closed`	Every report was reviewed and nothing was blocked.

A decision on the asset wins over open reports: once it is blocked or allowed, state stays there even if someone reports it again. An asset that was escalated, decided and then reported again goes back to investigating. The timestamps on each threat:

firstReportedAt: the first report for your organization.
escalatedAt: the first time the asset was escalated to your organization, or null if it never was.
blockedAt: when the asset was blocked, or null.
takedown: null until a takedown is opened. submittedAt is the first time it was filed with a provider, and completedAt the first time it was completed. If the site comes back, the takedown reopens: status goes back to IN_PROGRESS while completedAt keeps the first completion. Watch status to catch re-emergence.
updatedAt: the latest change to the asset, its reports or its takedown. This is the value updatedSince compares against.

Polling for changes

Backfill. Call without updatedSince and follow next_page until it is null. Note the time you started.
Poll. Send updatedSince set a few minutes before the start of your last successful sync, and follow next_page until it is null, keeping the same updatedSince on every page. Upsert each threat on id.
Advance. Use the start time of this sync as the watermark for the next one.

Overlap your windows by a few minutes. A change written while a request is running can otherwise fall between two polls. The overlap re-sends a few threats you already have, which an upsert absorbs.

Pages are ordered by asset id, ascending, and the cursor is the last id returned, so assets reported mid-sync land on later pages instead of shifting earlier ones. A page can hold fewer than per_page threats while next_page is still set; keep going until next_page is null.

async function syncThreats(apiKey, updatedSince) {
  const threats = [];
  let nextPage = null;

  do {
    const params = new URLSearchParams({ per_page: "1000" });
    if (updatedSince) params.set("updatedSince", updatedSince);
    if (nextPage) params.set("next_page", nextPage);

    const response = await fetch(
      `https://app.chainpatrol.io/api/v2/organization/threats?${params}`,
      { headers: { "X-API-KEY": apiKey } },
    );
    if (!response.ok) throw new Error(`HTTP ${response.status}`);

    const page = await response.json();
    threats.push(...page.threats);
    nextPage = page.next_page;
  } while (nextPage);

  return threats;
}

Authorizations

X-API-KEY

string

header

required

Your API key. This is required by most endpoints to access our API programatically. Reach out to us at support@chainpatrol.io to get an API key for your use.

Query Parameters

slug

string

updatedSince

string

assetType

enum<string>

Available options:

URL,

PAGE,

ADDRESS,

DISCORD,

LINKEDIN,

TWITTER,

FACEBOOK,

YOUTUBE,

REDDIT,

TELEGRAM,

GOOGLE_APP_STORE,

APPLE_APP_STORE,

AMAZON_APP_STORE,

MICROSOFT_APP_STORE,

TIKTOK,

INSTAGRAM,

THREADS,

MEDIUM,

CHROME_WEB_STORE,

MOZILLA_ADDONS,

OPERA_ADDONS,

EMAIL,

PATREON,

OPENSEA,

FARCASTER,

IPFS,

GOOGLE_FORM,

WHATSAPP,

DISCORD_USER,

QUORA,

GITHUB,

TEACHABLE,

SUBSTACK,

DEBANK,

TAWK_TO,

JOTFORM,

PRIMAL,

BLUESKY,

SNAPCHAT,

DESO,

PINTEREST,

FLICKR,

GALXE,

VELOG,

NPM,

PYPI,

HEX,

DOCKER_HUB,

VOCAL_MEDIA,

TECKFINE,

TENDERLY,

HACKMD,

ETSY,

ZAZZLE,

BASENAME,

BILIBILI_TV,

VIMEO,

DAILYMOTION,

PHONE_NUMBER,

SLACK,

CALENDLY,

NGROK,

RARIBLE,

RUST_PACKAGE,

FLATHUB,

VIDLII,

VEVIOZ,

ISSUU,

SOUNDCLOUD,

ZAPPER,

REDNOTE,

SAMSUNG_APP_STORE,

HUAWEI_APP_STORE,

XIAOMI_APP_STORE,

TENCENT_APP_STORE,

OPPO_APP_STORE,

VIVO_APP_STORE,

F_DROID,

GOOGLE_AD,

BING_AD,

TWITCH,

BEHANCE,

ZORA,

META_AD,

SIGNAL,

DEVIANTART,

BANDCAMP,

ARCHIVE_ORG,

FIVE_HUNDRED_PX,

LUMA,

SMARTMONEYMATCH,

APK_GOLD,

GLASSDOOR,

PUMP_FUN,

TUMBLR,

MASTODON

per_page

integer

default:100

The number of threats to return per page (max 1000)

Required range: 1 <= x <= 1000

next_page

string | null

Cursor for fetching the next page of results

Response

Successful response

Successful operation

threats

object[]

required

Show child attributes

next_page

string | null

Cursor for fetching the next page of results, or null on the last page. Drain it to null before advancing your updatedSince watermark — see updatedAt.

Getting Started

Assets

Reports

Disputes

Webhooks

Organization Brands

Organization Assets

Organization Asset Groups

Organization Reports

Threat Detection

Dark Web

Takedowns

Metrics

Account & Access

Operations

Staff

Healthchecks

List Organization Threats

Overview

Quick Start

Authentication

Example Request

Query Parameters

Lifecycle states

Polling for changes

Authorizations

Query Parameters

Response

​Overview

​Quick Start

​Authentication

​Example Request

​Query Parameters

​Lifecycle states

​Polling for changes

Authorizations

Query Parameters

Response

Overview

Quick Start

Authentication

Example Request

Query Parameters

Lifecycle states

Polling for changes