---
title: "Per-axis Protection Network threat state"
method: GET
path: "/network/threat-state"
tags: ["Network"]
---

# Per-axis Protection Network threat state

`GET /network/threat-state`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/network/threat-state`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Mnemom-Api-Key`
  - API key in cookie `mnemom_session`

Returns the current aggregated `network_campaign_state` grouped by axis (substrate / vertical / pattern / source), plus per-state totals. Backs the customer-facing L4 thermometer page. Public-aggregate disclosure: any authenticated principal may read; rows carry no per-tenant identifiers (L0 fingerprints only).

## Query parameters

- `max_buckets` integer

## Response `200`

Aggregated threat state snapshot.

- object
  - `snapshot_at` string, date-time, required: RPC evaluation timestamp.
  - `totals` object, required
    - `calm` integer, required
    - `elevated` integer, required
    - `high` integer, required
    - `under_attack` integer, required
    - `total` integer, required
  - `by_substrate` NetworkThreatBucket[], required
    - `bucket_value` string, required: L0 fingerprint slice (e.g. substrate / vertical / pattern / source identifier).
    - `state` 'calm' | 'elevated' | 'high' | 'under_attack', required
    - `prior_state` 'calm' | 'elevated' | 'high' | 'under_attack' | 'null', nullable: Previous state if a transition has been observed; null until the bucket has changed state at least once.
    - `state_changed_at` string, date-time, required: Wall-clock time of the most recent state transition.
    - `updated_at` string, date-time, required: Wall-clock time the rolling-stats roll-up last touched this row.
  - `by_vertical` NetworkThreatBucket[], required
    - `bucket_value` string, required: L0 fingerprint slice (e.g. substrate / vertical / pattern / source identifier).
    - `state` 'calm' | 'elevated' | 'high' | 'under_attack', required
    - `prior_state` 'calm' | 'elevated' | 'high' | 'under_attack' | 'null', nullable: Previous state if a transition has been observed; null until the bucket has changed state at least once.
    - `state_changed_at` string, date-time, required: Wall-clock time of the most recent state transition.
    - `updated_at` string, date-time, required: Wall-clock time the rolling-stats roll-up last touched this row.
  - `by_pattern` NetworkThreatBucket[], required
    - `bucket_value` string, required: L0 fingerprint slice (e.g. substrate / vertical / pattern / source identifier).
    - `state` 'calm' | 'elevated' | 'high' | 'under_attack', required
    - `prior_state` 'calm' | 'elevated' | 'high' | 'under_attack' | 'null', nullable: Previous state if a transition has been observed; null until the bucket has changed state at least once.
    - `state_changed_at` string, date-time, required: Wall-clock time of the most recent state transition.
    - `updated_at` string, date-time, required: Wall-clock time the rolling-stats roll-up last touched this row.
  - `by_source` NetworkThreatBucket[], required
    - `bucket_value` string, required: L0 fingerprint slice (e.g. substrate / vertical / pattern / source identifier).
    - `state` 'calm' | 'elevated' | 'high' | 'under_attack', required
    - `prior_state` 'calm' | 'elevated' | 'high' | 'under_attack' | 'null', nullable: Previous state if a transition has been observed; null until the bucket has changed state at least once.
    - `state_changed_at` string, date-time, required: Wall-clock time of the most recent state transition.
    - `updated_at` string, date-time, required: Wall-clock time the rolling-stats roll-up last touched this row.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.
- `502`: An upstream dependency returned an invalid response.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)