List Organization Watchlist

List organization watchlist

curl --request GET \
  --url https://app.chainpatrol.io/api/v2/organization/watchlist \
  --header 'X-API-KEY: <api-key>'

const options = {method: 'GET', headers: {'X-API-KEY': '<api-key>'}};

fetch('https://app.chainpatrol.io/api/v2/organization/watchlist', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.chainpatrol.io/api/v2/organization/watchlist",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-API-KEY: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://app.chainpatrol.io/api/v2/organization/watchlist"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-API-KEY", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://app.chainpatrol.io/api/v2/organization/watchlist")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-API-KEY"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "watchlist": [
    {
      "id": 123,
      "content": "<string>",
      "type": "URL",
      "status": "UNKNOWN",
      "pendingStatus": "UNKNOWN",
      "livenessStatus": "UNKNOWN",
      "watchlistedAt": "<string>",
      "reason": "DEAD",
      "firstReportedAt": "<string>",
      "lastScanAt": "<string>"
    }
  ],
  "next_page": "<string>",
  "total": 123
}

{
  "code": "BAD_REQUEST",
  "message": "Invalid input data",
  "issues": []
}

{
  "code": "UNAUTHORIZED",
  "message": "Authorization not provided",
  "issues": []
}

{
  "code": "FORBIDDEN",
  "message": "Insufficient access",
  "issues": []
}

{
  "code": "NOT_FOUND",
  "message": "Not found",
  "issues": []
}

{
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal server error",
  "issues": []
}

GET

organization

watchlist

List organization watchlist

curl --request GET \
  --url https://app.chainpatrol.io/api/v2/organization/watchlist \
  --header 'X-API-KEY: <api-key>'

const options = {method: 'GET', headers: {'X-API-KEY': '<api-key>'}};

fetch('https://app.chainpatrol.io/api/v2/organization/watchlist', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.chainpatrol.io/api/v2/organization/watchlist",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-API-KEY: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://app.chainpatrol.io/api/v2/organization/watchlist"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-API-KEY", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://app.chainpatrol.io/api/v2/organization/watchlist")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-API-KEY"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "watchlist": [
    {
      "id": 123,
      "content": "<string>",
      "type": "URL",
      "status": "UNKNOWN",
      "pendingStatus": "UNKNOWN",
      "livenessStatus": "UNKNOWN",
      "watchlistedAt": "<string>",
      "reason": "DEAD",
      "firstReportedAt": "<string>",
      "lastScanAt": "<string>"
    }
  ],
  "next_page": "<string>",
  "total": 123
}

{
  "code": "BAD_REQUEST",
  "message": "Invalid input data",
  "issues": []
}

{
  "code": "UNAUTHORIZED",
  "message": "Authorization not provided",
  "issues": []
}

{
  "code": "FORBIDDEN",
  "message": "Insufficient access",
  "issues": []
}

{
  "code": "NOT_FOUND",
  "message": "Not found",
  "issues": []
}

{
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal server error",
  "issues": []
}

Overview

List the assets ChainPatrol is watching for your organization. These are assets you reported that were not blocked — typically because they were dead, parked, a template, or lacked enough evidence — and that ChainPatrol keeps re-scanning so they can be blocked if they turn malicious. See Watchlist for how assets get there. An asset is included when its watch is enabled and your organization has filed a report against it. That is the same set threatsWatchlisted counts in /metrics/summary, so total here matches the dashboard number.

Quick Start

Authentication

Include your API key in the X-API-KEY header. Organization API keys resolve the organization from the key, so slug is optional for them.

X-API-KEY: <api-key>

Example Request

curl -X GET 'https://app.chainpatrol.io/api/v2/organization/watchlist?assetType=URL&includeTotal=true&per_page=100' \
  -H 'X-API-KEY: <api-key>'

const params = new URLSearchParams({
  assetType: "URL",
  includeTotal: "true",
  per_page: "100",
});

const response = await fetch(
  `https://app.chainpatrol.io/api/v2/organization/watchlist?${params}`,
  { headers: { "X-API-KEY": "<api-key>" } },
);

const { watchlist, total, next_page } = await response.json();

import requests

response = requests.get(
    "https://app.chainpatrol.io/api/v2/organization/watchlist",
    headers={"X-API-KEY": "<api-key>"},
    params={"assetType": "URL", "includeTotal": "true", "per_page": 100},
)
data = response.json()

Query Parameters

Parameter	Type	Required	Default	Description
`slug`	`string`	No	-	Organization slug. Required only when your credentials can reach more than one organization.
`assetType`	`string`	No	-	Filter by asset type, for example `URL` or `TWITTER`.
`query`	`string`	No	-	Only assets whose content contains this text (case-insensitive).
`reportedSince`	`string`	No	-	ISO 8601. Only assets your organization reported at or after this time.
`reportedUntil`	`string`	No	-	ISO 8601. Only assets your organization reported at or before this time.
`includeTotal`	`boolean`	No	`false`	Also return `total`: how many watchlisted assets match across all pages. Ask on the first page only.
`per_page`	`number`	No	`100`	Page size, 1–1000.
`next_page`	`string`	No	-	Cursor from the previous response.

reportedSince and reportedUntil filter on when your organization reported the asset — the same window /metrics/summary uses for threatsWatchlisted. They do not filter on when the asset was watchlisted. Leave both out for the whole watchlist.

Response

{
  "watchlist": [
    {
      "id": 4175269,
      "content": "your-brand-login.example",
      "type": "URL",
      "status": "UNKNOWN",
      "pendingStatus": null,
      "livenessStatus": "DEAD",
      "watchlistedAt": "2026-09-18T09:12:44.000Z",
      "reason": "DEAD",
      "firstReportedAt": "2026-09-18T09:10:02.000Z",
      "lastScanAt": "2026-09-30T06:00:11.000Z"
    }
  ],
  "next_page": "4175269",
  "total": 212
}

Field	Type	Description
`id`	`number`	Asset ID.
`content`	`string`	Asset content (URL, handle, email, …).
`type`	`string`	Asset type.
`status`	`string`	Raw asset status: `UNKNOWN`, `ALLOWED` or `BLOCKED`.
`pendingStatus`	`string \| null`	`"BLOCKED"` when the asset was confirmed malicious but protection is not active (“Pending Blocked”), otherwise `null`.
`livenessStatus`	`string`	`ALIVE`, `DEAD` or `UNKNOWN`.
`watchlistedAt`	`string \| null`	When the asset was most recently put on the watchlist. `null` for assets watched before watch history was recorded.
`reason`	`string \| null`	Why it was most recently watchlisted: `DEAD`, `PARKING`, `TEMPLATE`, `RE_REGISTERED`, `NOT_ENOUGH_EVIDENCE`, `OTHER`, …, or `null`.
`firstReportedAt`	`string`	When your organization first reported the asset.
`lastScanAt`	`string \| null`	When the asset was last scanned.

next_page is null on the last page. total is present only when you set includeTotal.

Pagination

Results are ordered by asset ID, ascending. Pass next_page back until it is null. New assets land after the cursor, so a sweep never repeats or skips a row.

Authorizations

X-API-KEY

string

header

required

Your API key. This is required by most endpoints to access our API programatically. Reach out to us at support@chainpatrol.io to get an API key for your use.

Query Parameters

slug

string

assetType

enum<string>

Available options:

URL,

PAGE,

ADDRESS,

DISCORD,

LINKEDIN,

TWITTER,

FACEBOOK,

YOUTUBE,

REDDIT,

TELEGRAM,

GOOGLE_APP_STORE,

APPLE_APP_STORE,

AMAZON_APP_STORE,

MICROSOFT_APP_STORE,

TIKTOK,

INSTAGRAM,

THREADS,

MEDIUM,

CHROME_WEB_STORE,

MOZILLA_ADDONS,

OPERA_ADDONS,

EMAIL,

PATREON,

OPENSEA,

FARCASTER,

IPFS,

GOOGLE_FORM,

WHATSAPP,

DISCORD_USER,

QUORA,

GITHUB,

TEACHABLE,

SUBSTACK,

DEBANK,

TAWK_TO,

JOTFORM,

PRIMAL,

BLUESKY,

SNAPCHAT,

DESO,

PINTEREST,

FLICKR,

GALXE,

VELOG,

NPM,

PYPI,

HEX,

DOCKER_HUB,

VOCAL_MEDIA,

TECKFINE,

TENDERLY,

HACKMD,

ETSY,

ZAZZLE,

BASENAME,

BILIBILI_TV,

VIMEO,

DAILYMOTION,

PHONE_NUMBER,

SLACK,

CALENDLY,

NGROK,

RARIBLE,

RUST_PACKAGE,

FLATHUB,

VIDLII,

VEVIOZ,

ISSUU,

SOUNDCLOUD,

ZAPPER,

REDNOTE,

SAMSUNG_APP_STORE,

HUAWEI_APP_STORE,

XIAOMI_APP_STORE,

TENCENT_APP_STORE,

OPPO_APP_STORE,

VIVO_APP_STORE,

F_DROID,

GOOGLE_AD,

BING_AD,

TWITCH,

BEHANCE,

ZORA,

META_AD,

SIGNAL,

DEVIANTART,

BANDCAMP,

ARCHIVE_ORG,

FIVE_HUNDRED_PX,

LUMA,

SMARTMONEYMATCH,

APK_GOLD,

GLASSDOOR,

PUMP_FUN,

TUMBLR

query

string

Only return assets whose content contains this text

reportedSince

string

reportedUntil

string

includeTotal

boolean

default:false

Also return total: how many watchlisted assets match the filters across all pages. Costs an extra count query, so request it on the first page rather than every page.

per_page

integer

default:100

The number of assets to return per page (max 1000)

Required range: 1 <= x <= 1000

next_page

string | null

Cursor for fetching the next page of results

Response

Successful response

Successful operation

watchlist

object[]

required

Show child attributes

next_page

string | null

Cursor for fetching the next page of results, or null on the last page

total

number

How many watchlisted assets match the filters across all pages, regardless of next_page. Present only when includeTotal is true.

Getting Started

Assets

Blocklist Sync

Reports

Disputes

Webhooks

Organization Brands

Organization Assets

Organization Asset Groups

Organization Reports

Detections

Dark Web

Takedowns

Metrics

Account & Access

Operations

Healthchecks

List Organization Watchlist

Overview

Quick Start

Authentication

Example Request

Query Parameters

Response

Authorizations

Query Parameters

Response

​Overview

​Quick Start

​Authentication

​Example Request

​Query Parameters

​Response

​Pagination

​Related

Authorizations

Query Parameters

Response

Overview

Quick Start

Authentication

Example Request

Query Parameters

Response

Pagination

Related