> ## Documentation Index > Fetch the complete documentation index at: https://chainpatrol.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # List Organization Watchlist > List the assets ChainPatrol is watching for your organization: reported assets that were not blocked — typically dead, parked or lacking evidence — and are re-scanned so they can be blocked if they turn malicious. Matches the `threatsWatchlisted` count in `/metrics/summary`. Set `includeTotal` for the count; supports pagination. ## Overview List the assets ChainPatrol is watching for your organization. These are assets you reported that were not blocked — typically because they were dead, parked, a template, or lacked enough evidence — and that ChainPatrol keeps re-scanning so they can be blocked if they turn malicious. See [Watchlist](/docs/concepts/watchlist) for how assets get there. An asset is included when its watch is enabled and your organization has filed a report against it. That is the same set `threatsWatchlisted` counts in [`/metrics/summary`](/docs/external-api/metrics-summary), so `total` here matches the dashboard number. ## Quick Start ### Authentication Include your API key in the `X-API-KEY` header. Organization API keys resolve the organization from the key, so `slug` is optional for them. ```bash theme={null} X-API-KEY: ``` ### Example Request ```bash cURL theme={null} curl -X GET 'https://app.chainpatrol.io/api/v2/organization/watchlist?assetType=URL&includeTotal=true&per_page=100' \ -H 'X-API-KEY: ' ``` ```typescript TypeScript theme={null} const params = new URLSearchParams({ assetType: "URL", includeTotal: "true", per_page: "100", }); const response = await fetch( `https://app.chainpatrol.io/api/v2/organization/watchlist?${params}`, { headers: { "X-API-KEY": "" } }, ); const { watchlist, total, next_page } = await response.json(); ``` ```python Python theme={null} import requests response = requests.get( "https://app.chainpatrol.io/api/v2/organization/watchlist", headers={"X-API-KEY": ""}, params={"assetType": "URL", "includeTotal": "true", "per_page": 100}, ) data = response.json() ``` ## Query Parameters | Parameter | Type | Required | Default | Description | | - | - | - | - | - | | `slug` | `string` | No | - | Organization slug. Required only when your credentials can reach more than one organization. | | `assetType` | `string` | No | - | Filter by asset type, for example `URL` or `TWITTER`. | | `query` | `string` | No | - | Only assets whose content contains this text (case-insensitive). | | `reportedSince` | `string` | No | - | ISO 8601. Only assets your organization reported at or after this time. | | `reportedUntil` | `string` | No | - | ISO 8601. Only assets your organization reported at or before this time. | | `includeTotal` | `boolean` | No | `false` | Also return `total`: how many watchlisted assets match across all pages. Ask on the first page only. | | `per_page` | `number` | No | `100` | Page size, 1–1000. | | `next_page` | `string` | No | - | Cursor from the previous response. | `reportedSince` and `reportedUntil` filter on when **your organization reported** the asset — the same window `/metrics/summary` uses for `threatsWatchlisted`. They do not filter on when the asset was watchlisted. Leave both out for the whole watchlist. ## Response ```json theme={null} { "watchlist": [ { "id": 4175269, "content": "your-brand-login.example", "type": "URL", "status": "UNKNOWN", "pendingStatus": null, "livenessStatus": "DEAD", "watchlistedAt": "2026-09-18T09:12:44.000Z", "reason": "DEAD", "firstReportedAt": "2026-09-18T09:10:02.000Z", "lastScanAt": "2026-09-30T06:00:11.000Z" } ], "next_page": "4175269", "total": 212 } ``` | Field | Type | Description | | - | - | - | | `id` | `number` | Asset ID. | | `content` | `string` | Asset content (URL, handle, email, …). | | `type` | `string` | Asset type. | | `status` | `string` | Raw asset status: `UNKNOWN`, `ALLOWED` or `BLOCKED`. | | `pendingStatus` | `string \| null` | `"BLOCKED"` when the asset was confirmed malicious but protection is not active ("Pending Blocked"), otherwise `null`. | | `livenessStatus` | `string` | `ALIVE`, `DEAD` or `UNKNOWN`. | | `watchlistedAt` | `string \| null` | When the asset was most recently put on the watchlist. `null` for assets watched before watch history was recorded. | | `reason` | `string \| null` | Why it was most recently watchlisted: `DEAD`, `PARKING`, `TEMPLATE`, `RE_REGISTERED`, `NOT_ENOUGH_EVIDENCE`, `OTHER`, …, or `null`. | | `firstReportedAt` | `string` | When your organization first reported the asset. | | `lastScanAt` | `string \| null` | When the asset was last scanned. | `next_page` is `null` on the last page. `total` is present only when you set `includeTotal`. ## Pagination Results are ordered by asset ID, ascending. Pass `next_page` back until it is `null`. New assets land after the cursor, so a sweep never repeats or skips a row. ## Related * [Watchlist](/docs/concepts/watchlist) * [`chainpatrol orgs watchlist list`](/docs/cli/commands/orgs#orgs-watchlist-list) * [Evaluating detections](/docs/external-api/evaluating-detections) ## OpenAPI ````yaml GET /organization/watchlist openapi: 3.0.3 info: title: ChainPatrol External API - OpenAPI 3.0 description: ChainPatrol External API documentation version: 2.0.0 servers: - url: https://app.chainpatrol.io/api/v2 security: [] tags: - name: asset - name: report - name: dark-web externalDocs: url: https://chainpatrol.com/docs paths: /organization/watchlist: get: tags: - organization summary: List organization watchlist description: >- List the assets ChainPatrol is watching for your organization: reported assets that were not blocked — typically dead, parked or lacking evidence — and are re-scanned so they can be blocked if they turn malicious. Matches the `threatsWatchlisted` count in `/metrics/summary`. Set `includeTotal` for the count; supports pagination. operationId: organizationWatchlistList parameters: - in: query name: slug schema: type: string - in: query name: assetType schema: type: string enum: - URL - PAGE - ADDRESS - DISCORD - LINKEDIN - TWITTER - FACEBOOK - YOUTUBE - REDDIT - TELEGRAM - GOOGLE_APP_STORE - APPLE_APP_STORE - AMAZON_APP_STORE - MICROSOFT_APP_STORE - TIKTOK - INSTAGRAM - THREADS - MEDIUM - CHROME_WEB_STORE - MOZILLA_ADDONS - OPERA_ADDONS - EMAIL - PATREON - OPENSEA - FARCASTER - IPFS - GOOGLE_FORM - WHATSAPP - DISCORD_USER - QUORA - GITHUB - TEACHABLE - SUBSTACK - DEBANK - TAWK_TO - JOTFORM - PRIMAL - BLUESKY - SNAPCHAT - DESO - PINTEREST - FLICKR - GALXE - VELOG - NPM - PYPI - HEX - DOCKER_HUB - VOCAL_MEDIA - TECKFINE - TENDERLY - HACKMD - ETSY - ZAZZLE - BASENAME - BILIBILI_TV - VIMEO - DAILYMOTION - PHONE_NUMBER - SLACK - CALENDLY - NGROK - RARIBLE - RUST_PACKAGE - FLATHUB - VIDLII - VEVIOZ - ISSUU - SOUNDCLOUD - ZAPPER - REDNOTE - SAMSUNG_APP_STORE - HUAWEI_APP_STORE - XIAOMI_APP_STORE - TENCENT_APP_STORE - OPPO_APP_STORE - VIVO_APP_STORE - F_DROID - GOOGLE_AD - BING_AD - TWITCH - BEHANCE - ZORA - META_AD - SIGNAL - DEVIANTART - BANDCAMP - ARCHIVE_ORG - FIVE_HUNDRED_PX - LUMA - SMARTMONEYMATCH - APK_GOLD - GLASSDOOR - PUMP_FUN - TUMBLR - in: query name: query description: Only return assets whose content contains this text schema: type: string description: Only return assets whose content contains this text - in: query name: reportedSince schema: type: string - in: query name: reportedUntil schema: type: string - in: query name: includeTotal description: >- Also return `total`: how many watchlisted assets match the filters across all pages. Costs an extra count query, so request it on the first page rather than every page. schema: type: boolean default: false description: >- Also return `total`: how many watchlisted assets match the filters across all pages. Costs an extra count query, so request it on the first page rather than every page. - in: query name: per_page description: The number of assets to return per page (max 1000) schema: type: integer minimum: 1 maximum: 1000 default: 100 description: The number of assets to return per page (max 1000) - in: query name: next_page description: Cursor for fetching the next page of results schema: type: string nullable: true description: Cursor for fetching the next page of results responses: '200': description: Successful response content: application/json: schema: type: object properties: watchlist: type: array items: type: object properties: id: type: number description: Asset ID content: type: string description: Asset content (URL, handle, email, etc.) type: type: string enum: - URL - PAGE - ADDRESS - DISCORD - LINKEDIN - TWITTER - FACEBOOK - YOUTUBE - REDDIT - TELEGRAM - GOOGLE_APP_STORE - APPLE_APP_STORE - AMAZON_APP_STORE - MICROSOFT_APP_STORE - TIKTOK - INSTAGRAM - THREADS - MEDIUM - CHROME_WEB_STORE - MOZILLA_ADDONS - OPERA_ADDONS - EMAIL - PATREON - OPENSEA - FARCASTER - IPFS - GOOGLE_FORM - WHATSAPP - DISCORD_USER - QUORA - GITHUB - TEACHABLE - SUBSTACK - DEBANK - TAWK_TO - JOTFORM - PRIMAL - BLUESKY - SNAPCHAT - DESO - PINTEREST - FLICKR - GALXE - VELOG - NPM - PYPI - HEX - DOCKER_HUB - VOCAL_MEDIA - TECKFINE - TENDERLY - HACKMD - ETSY - ZAZZLE - BASENAME - BILIBILI_TV - VIMEO - DAILYMOTION - PHONE_NUMBER - SLACK - CALENDLY - NGROK - RARIBLE - RUST_PACKAGE - FLATHUB - VIDLII - VEVIOZ - ISSUU - SOUNDCLOUD - ZAPPER - REDNOTE - SAMSUNG_APP_STORE - HUAWEI_APP_STORE - XIAOMI_APP_STORE - TENCENT_APP_STORE - OPPO_APP_STORE - VIVO_APP_STORE - F_DROID - GOOGLE_AD - BING_AD - TWITCH - BEHANCE - ZORA - META_AD - SIGNAL - DEVIANTART - BANDCAMP - ARCHIVE_ORG - FIVE_HUNDRED_PX - LUMA - SMARTMONEYMATCH - APK_GOLD - GLASSDOOR - PUMP_FUN - TUMBLR description: Asset type status: type: string enum: - UNKNOWN - ALLOWED - BLOCKED description: Raw asset status pendingStatus: type: string nullable: true enum: - UNKNOWN - ALLOWED - BLOCKED - null description: >- A reviewed status that has not taken effect yet, or null when nothing is pending. `BLOCKED` here means the asset was confirmed malicious but is not enforced on the blocklist because protection is not active for your organization — shown as "Pending Blocked" in the ChainPatrol app. It becomes `status` once protection is activated. livenessStatus: type: string enum: - UNKNOWN - ALIVE - DEAD description: >- Whether the asset is currently reachable (`ALIVE`), gone (`DEAD`), or unchecked (`UNKNOWN`) watchlistedAt: type: string nullable: true description: >- When the asset was most recently put on the watchlist, or null for assets watched before watch history was recorded reason: type: string nullable: true enum: - DEAD - PARKING - TEMPLATE - RE_REGISTERED - CHANGED - DECAYED - ALLOWED - IRRELEVANT - OTHER - NOT_ENOUGH_EVIDENCE - null description: >- Why the asset was most recently put on the watchlist (for example `DEAD`, `PARKING`, `TEMPLATE` or `NOT_ENOUGH_EVIDENCE`), or null when no reason was recorded firstReportedAt: type: string description: >- When this organization first filed a report against the asset lastScanAt: type: string nullable: true description: >- When the asset was last scanned, or null if it has not been required: - id - content - type - status - pendingStatus - livenessStatus - watchlistedAt - reason - firstReportedAt - lastScanAt next_page: type: string nullable: true description: >- Cursor for fetching the next page of results, or null on the last page total: type: number description: >- How many watchlisted assets match the filters across all pages, regardless of `next_page`. Present only when `includeTotal` is true. required: - watchlist description: Successful operation '400': description: Invalid input data content: application/json: schema: $ref: '#/components/schemas/error.BAD_REQUEST' '401': description: Authorization not provided content: application/json: schema: $ref: '#/components/schemas/error.UNAUTHORIZED' '403': description: Insufficient access content: application/json: schema: $ref: '#/components/schemas/error.FORBIDDEN' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/error.NOT_FOUND' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/error.INTERNAL_SERVER_ERROR' security: - ApiKey: [] components: schemas: error.BAD_REQUEST: type: object properties: message: type: string description: The error message example: Invalid input data code: type: string description: The error code example: BAD_REQUEST issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Invalid input data error (400) description: The error information example: code: BAD_REQUEST message: Invalid input data issues: [] error.UNAUTHORIZED: type: object properties: message: type: string description: The error message example: Authorization not provided code: type: string description: The error code example: UNAUTHORIZED issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Authorization not provided error (401) description: The error information example: code: UNAUTHORIZED message: Authorization not provided issues: [] error.FORBIDDEN: type: object properties: message: type: string description: The error message example: Insufficient access code: type: string description: The error code example: FORBIDDEN issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Insufficient access error (403) description: The error information example: code: FORBIDDEN message: Insufficient access issues: [] error.NOT_FOUND: type: object properties: message: type: string description: The error message example: Not found code: type: string description: The error code example: NOT_FOUND issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Not found error (404) description: The error information example: code: NOT_FOUND message: Not found issues: [] error.INTERNAL_SERVER_ERROR: type: object properties: message: type: string description: The error message example: Internal server error code: type: string description: The error code example: INTERNAL_SERVER_ERROR issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Internal server error error (500) description: The error information example: code: INTERNAL_SERVER_ERROR message: Internal server error issues: [] securitySchemes: ApiKey: type: apiKey in: header name: X-API-KEY description: >- Your API key. This is required by most endpoints to access our API programatically. Reach out to us at [support@chainpatrol.io](mailto:support@chainpatrol.io?subject=Re:%20API%20Key%20for%20SDK&body=Company:%20%0AName:%20%0APurpose:%20) to get an API key for your use. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.