--- title: "Update Ecosystem Incident Subscription" method: PATCH path: "/v0/platform/ecosystem-incidents/subscriptions/{id}" tags: ["Ecosystem Incident Subscriptions"] --- # Update Ecosystem Incident Subscription `PATCH /v0/platform/ecosystem-incidents/subscriptions/{id}` Change a subscription's name or actions. ## Path parameters - `id` string, required ## Request body - object - `name` string — Updated subscription name. - `actions` EcosystemIncidentSubscriptionAction[] — Replacement list of delivery actions with match criteria. - `action` union, required — Delivery action (same schema as monitor actions). - EmailAction - `type` 'email', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `to` string[], required — Primary email recipients. - `cc` string[] — CC email recipients. - `bcc` string[] — BCC email recipients. - `body` string — Request body payload. - SlackAction - `type` 'slack', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `integration_instance_id` string, required — Identifier for the integration instance. - `channels` string[], required — Slack channel names - `message_format` string — Customization of the message to send in the Slack notification. - TelegramAction - `type` 'telegram', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `integration_instance_id` string, required — Identifier for the integration instance. - `chats` object[], required — Telegram chat and topic configuration for posting notifications. - `chat_id` string, required — Telegram channel ID. - `topic_ids` integer[] — Optional topic IDs within the channel where the message should be posted. - `message_format` string — Customization of the message to send in the Telegram notification. - WebhookAction - `type` 'webhook', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `url` string, required — The URL of the endpoint where the platform sends the event payloads. - `authentication` union - HMACAuthentication - `type` 'hmac', required — Type discriminator for this object. - `hmac_secret` string, required — Secret value for hmac secret authentication. - AuthorizationHeaderAuthentication - `type` 'authorization_header', required — Type discriminator for this object. - `value` string, required — Comparison value. - APIKeyAuthorization - `type` 'api_key', required — Type discriminator for this object. - `header_name` string, required — Header name used for API key authentication. - `api_key` string, required — Secret value for api key authentication. - BasicAuth - `type` 'basic_auth', required - `username` string, required - `password` string, required - `custom_headers` object[] — Custom headers to be sent in the HTTP POST request along with the event payload. - `name` string, required — The name of the custom header. - `value` string, required — The value of the custom header. - `custom_payload_fields` object[] — Custom fields to be included in the webhook payload along with the event data. - `key` string, required — The key name for the custom field in the webhook payload. - `value` string, required — The value for the custom field. - `match` EcosystemIncidentSubscriptionMatch — Per-action incident match criteria. Severity is set on the action's own severity field. - `monitor_type` string[] — Monitor types this action matches (any of). Omit for all. A null incident monitor_type matches only when this is omitted. - `chains` string[] — Chain identifiers this action requires (e.g. ethereum, base). Multiple values are AND-ed on one action; use separate actions to match either chain. - `funds_lost_min` number — Minimum funds lost (USD). Omit for no threshold. ## Response `200` - EcosystemIncidentSubscription - `id` string, required — Unique subscription identifier. - `name` string, required — Human-readable subscription name. - `actions` EcosystemIncidentSubscriptionAction[], required - `action` union, required — Delivery action (same schema as monitor actions). - EmailAction - `type` 'email', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `to` string[], required — Primary email recipients. - `cc` string[] — CC email recipients. - `bcc` string[] — BCC email recipients. - `body` string — Request body payload. - SlackAction - `type` 'slack', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `integration_instance_id` string, required — Identifier for the integration instance. - `channels` string[], required — Slack channel names - `message_format` string — Customization of the message to send in the Slack notification. - TelegramAction - `type` 'telegram', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `integration_instance_id` string, required — Identifier for the integration instance. - `chats` object[], required — Telegram chat and topic configuration for posting notifications. - `chat_id` string, required — Telegram channel ID. - `topic_ids` integer[] — Optional topic IDs within the channel where the message should be posted. - `message_format` string — Customization of the message to send in the Telegram notification. - WebhookAction - `type` 'webhook', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `url` string, required — The URL of the endpoint where the platform sends the event payloads. - `authentication` union - HMACAuthentication - `type` 'hmac', required — Type discriminator for this object. - `hmac_secret` string, required — Secret value for hmac secret authentication. - AuthorizationHeaderAuthentication - `type` 'authorization_header', required — Type discriminator for this object. - `value` string, required — Comparison value. - APIKeyAuthorization - `type` 'api_key', required — Type discriminator for this object. - `header_name` string, required — Header name used for API key authentication. - `api_key` string, required — Secret value for api key authentication. - BasicAuth - `type` 'basic_auth', required - `username` string, required - `password` string, required - `custom_headers` object[] — Custom headers to be sent in the HTTP POST request along with the event payload. - `name` string, required — The name of the custom header. - `value` string, required — The value of the custom header. - `custom_payload_fields` object[] — Custom fields to be included in the webhook payload along with the event data. - `key` string, required — The key name for the custom field in the webhook payload. - `value` string, required — The value for the custom field. - `match` EcosystemIncidentSubscriptionMatch — Per-action incident match criteria. Severity is set on the action's own severity field. - `monitor_type` string[] — Monitor types this action matches (any of). Omit for all. A null incident monitor_type matches only when this is omitted. - `chains` string[] — Chain identifiers this action requires (e.g. ethereum, base). Multiple values are AND-ed on one action; use separate actions to match either chain. - `funds_lost_min` number — Minimum funds lost (USD). Omit for no threshold. - `created_by` string, required - `updated_by` string, required - `created_at` string, date-time, required - `updated_at` string, date-time, required ## Changes > 95 revisions in range; 1 not diffed. - **2026-08-20** `e002dafa5723` — 2 breaking, 3 warning, 5 info - removed the enum value `contract_exploit` of the request property `actions/items/match/monitor_type/items/` - removed the enum value `cpk_compromise` of the request property `actions/items/match/monitor_type/items/` - added the new `compromised_private_key` enum value to the `actions/items/match/monitor_type/items/` response property for the response status `200` - added the new `monitored_contract_was_exploited` enum value to the `actions/items/match/monitor_type/items/` response property for the response status `200` - …6 more - **2026-08-13** `2f2726fbf4ca` — 2 info - added `#/components/schemas/WebhookAction` to the `actions/items/action` request property `anyOf` list - added `#/components/schemas/WebhookAction` to the `actions/items/action` response property `anyOf` list for the response status `200` - **2026-07-16** `5a1a878af010` — 1 info - endpoint added [Change history](https://skmtc.dev/blockaid-official/apis/blockaid-api/changes/v0/platform/ecosystem-incidents/subscriptions/:id/patch.md) --- [API](https://skmtc.dev/blockaid-official/apis/blockaid-api.md) · [All operations](https://skmtc.dev/blockaid-official/apis/blockaid-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/blockaid-official/blockaid-api/revisions/e15b4bf2b25b/schema)