Observability

Durable threat register for the org, worst reach first

Threats are ranked by blast radius — the size of the affected agent's topology neighbourhood (vaults + connectors + chains) — not by recency or severity alone, so the row an operator should look at first is first. Ties fall back to recency.

shadow: true marks a threat the trust engine produced while running in recommend-only mode. Those are shown with a badge and never acted on automatically.

Evidence carries trace and span ids and a note. It never contains secret values or HTTP bodies.

get/v1/otel/threats

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/otel/threats
  • Auth: HTTP bearer

Query parameters

state'open' | 'all'

open (default) returns anything not yet resolved; all includes resolved.

Response

Threats, highest blast radius first

idstring uuid required
agent_idstring uuid required
class'prompt_injection' | 'policy_breach' | 'spend_anomaly' | 'key_exfil' | 'off_hours' | 'consensus_bypass' | 'trust_breach' required
severity'critical' | 'warn' required
detected_bystring required
status'open' | 'acknowledged' | 'resolved' required
shadowboolean required
evidenceobject[]
blast_radius_sizeinteger required

Sum of the blast radius. The sort key.

resolved_bystring nullable
created_atstring date-time
updated_atstring date-time

Changes

No recorded changes to this operation across all 2 revisions of this API.