watchers

WATCHER: get a signed callback when an indicator of...

WATCHER: get a signed callback when an indicator of compromise (IP or domain) changes malicious status across threat feeds. Arm once, pay once. Pass ioc (an IP address or domain). Fires when the malicious verdict flips; bounded by maxFires/expiry. The status at arm time is baselined. Signed (verify offline) + retried; recoverable via watchers.status. Returns a watcherId.

post/api/watchers/ioc-reputation

Request

  • Base URL: https://2s.io
  • URL: https://2s.io/api/watchers/ioc-reputation
  • Auth: API key in header PAYMENT-SIGNATURE

Request body

iocstring required

Indicator to watch: an IP address or domain.

callbackUrlstring uri required

Signed event POSTed here (verify X-2s-Signature). Any http(s) URL.

payloadobject

Arbitrary JSON echoed back in every callback.

expiresInSecondsinteger

Active window in seconds (default 30d, max 90d).

maxFiresinteger

Stop after this many changes (default 10).

labelstring

Optional free-text tag.

Response

(unresolved $ref)

Changes

No recorded changes to this operation across all 1 revision of this API.