---
title: "Open threats on one connection's agents"
method: GET
path: "/v1/platform/connections/{connection_id}/otel/threats"
tags: ["Platform", "Observability"]
---

# Open threats on one connection's agents

`GET /v1/platform/connections/{connection_id}/otel/threats`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/platform/connections/{connection_id}/otel/threats`
- Auth: HTTP bearer

`/v1/otel/threats` filtered to the connection's agents, same ranking (blast radius, then recency).

A `plt_` key sees one connection's agents, never the end-user's org: that org may hold agents from other platforms or the user's own. The set is agents attributed to the connection plus the ones listed on it, constrained to the connection's org. A connection that does not belong to the calling app is a 404.

## Path parameters

- `connection_id` string, uuid, required

## Query parameters

- `state` 'open' | 'all'

## Response `200`

Threats on the connection's agents, highest blast radius first

- object[]
  - `id` string, uuid, required
  - `agent_id` string, uuid, required
  - `class` 'prompt_injection' | 'policy_breach' | 'spend_anomaly' | 'key_exfil' | 'off_hours' | 'consensus_bypass' | 'trust_breach', required
  - `severity` 'critical' | 'warn', required
  - `detected_by` string, required
  - `status` 'open' | 'acknowledged' | 'resolved', required
  - `shadow` boolean, required
  - `evidence` object[]
  - `blast_radius` object, required
    - `vaults` integer
    - `connectors` integer
    - `chains` integer
  - `blast_radius_size` integer, required: Sum of the blast radius. The sort key.
  - `resolved_by` string, nullable
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `401`: Unauthenticated
- `403`: Not a plt_ key
- `404`: Connection not found for this app

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)