Platform
Observability

Open threats on one connection's agents

/v1/otel/threats filtered to the connection's agents, same ranking (blast radius, then recency).

A plt_ key sees one connection's agents, never the end-user's org: that org may hold agents from other platforms or the user's own. The set is agents attributed to the connection plus the ones listed on it, constrained to the connection's org. A connection that does not belong to the calling app is a 404.

get/v1/platform/connections/{connection_id}/otel/threats

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/platform/connections/{connection_id}/otel/threats
  • Auth: HTTP bearer

Path parameters

connection_idstring uuid required

Query parameters

state'open' | 'all'

Response

Threats on the connection's agents, highest blast radius first

idstring uuid required
agent_idstring uuid required
class'prompt_injection' | 'policy_breach' | 'spend_anomaly' | 'key_exfil' | 'off_hours' | 'consensus_bypass' | 'trust_breach' required
severity'critical' | 'warn' required
detected_bystring required
status'open' | 'acknowledged' | 'resolved' required
shadowboolean required
evidenceobject[]
blast_radius_sizeinteger required

Sum of the blast radius. The sort key.

resolved_bystring nullable
created_atstring date-time
updated_atstring date-time

Changes

No recorded changes to this operation across all 2 revisions of this API.