---
title: "Shroud threat analytics summary"
method: GET
path: "/v1/shroud/threat-summary"
tags: ["Shroud"]
---

# Shroud threat analytics summary

`GET /v1/shroud/threat-summary`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/shroud/threat-summary`
- Auth: HTTP bearer

Aggregated threat metrics for the organization from `shroud_activity` (detectors, blocked counts, recent flagged requests). Query `period` selects the window; the previous window of equal length is used for request volume trend.

## Query parameters

- `period` '1h' | '24h' | '7d' | '30d'

## Response `200`

Threat summary

- ShroudThreatSummary
  - `total_requests` integer
  - `total_requests_prev` integer
  - `blocked_requests` integer
  - `detectors_triggered` integer
  - `active_agents` integer
  - `detectors` ShroudDetectorStats[]
    - `detector` string
    - `detections` integer
    - `blocks` integer
    - `actions` object
      - `blocked` integer
      - `warned` integer
      - `logged` integer
  - `flagged_requests` ShroudFlaggedRequest[]
    - `id` string
    - `timestamp` string, date-time
    - `agent_id` string
    - `agent_name` string
    - `score` number
    - `reason` string
    - `action` 'blocked' | 'warned' | 'logged'

## Other responses

- `400`: Invalid period
- `401`: Unauthorized

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)