---
title: "Durable threat register for the org, worst reach first"
method: GET
path: "/v1/otel/threats"
tags: ["Observability"]
---

# Durable threat register for the org, worst reach first

`GET /v1/otel/threats`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/otel/threats`
- Auth: HTTP bearer

Threats are ranked by blast radius — the size of the affected agent's topology neighbourhood (vaults + connectors + chains) — not by recency or severity alone, so the row an operator should look at first is first. Ties fall back to recency.

`shadow: true` marks a threat the trust engine produced while running in recommend-only mode. Those are shown with a badge and never acted on automatically.

Evidence carries trace and span ids and a note. It never contains secret values or HTTP bodies.

## Query parameters

- `state` 'open' | 'all'

## Response `200`

Threats, highest blast radius first

- object[]
  - `id` string, uuid, required
  - `agent_id` string, uuid, required
  - `class` 'prompt_injection' | 'policy_breach' | 'spend_anomaly' | 'key_exfil' | 'off_hours' | 'consensus_bypass' | 'trust_breach', required
  - `severity` 'critical' | 'warn', required
  - `detected_by` string, required
  - `status` 'open' | 'acknowledged' | 'resolved', required
  - `shadow` boolean, required
  - `evidence` object[]
  - `blast_radius` object, required
    - `vaults` integer
    - `connectors` integer
    - `chains` integer
  - `blast_radius_size` integer, required: Sum of the blast radius. The sort key.
  - `resolved_by` string, nullable
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `401`: Unauthenticated
- `403`: Not a human user

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)