Reference

Read recorded incidents

Two scopes over two different stores, selected by scope.

scope=mine (default) — the incident seeds YOU pushed, with the score and active state of each. parked reaches the holding table for chains not indexed yet; those rows carry risk_score_when_replayed, never live risk. Add slug to get the curated record behind one of your pushes alongside the seeds.

scope=canon — the incident RECORD itself: every public incident naming an address, whoever filed it, one row per (incident, address). Filter by chain, by source (who published it, e.g. Chainabuse, SlowMist), by stream (curated = our own investigation, community = a user-filed report ingested from a feed), by label or category, by role, and by occurred_at through since/until. Requires an API key, and is priced one unit per returned row: it is a dataset read, not a lookup.

What scope=canon never returns, whatever you filter by: a private incident, a retracted one, and any victim link. A canon row is not a risk seed either, so it carries no score — status, stream and sources[].tier say how well evidenced the claim is, and what it is WORTH to an address is /v2/enrich's answer, not this one. In particular a community report scores nothing on its own: those seeds were deactivated in August and the report lives here as evidence.

get/v1/incidents

Request

  • Base URL: https://intelapi.publicaml.org
  • URL: https://intelapi.publicaml.org/v1/incidents
  • Auth: one of:
    • API key in header X-API-Key
    • none

Query parameters

scope'mine' | 'canon'

mine = the seeds you pushed; canon = the incident record.

slugstring

One incident by key. Under mine it also returns the curated record; under canon it narrows the listing to that incident.

chain'bitcoin' | 'ethereum' | 'bsc' | 'tron'

Both scopes.

sourcestring

canon only. Who published the incident, matched case-insensitively against the publisher of a non-retracted source.

stream'curated' | 'community'

canon only. Which population: analyst-recorded investigation, or user-filed report from a feed.

status'confirmed' | 'alleged' | 'disputed'

canon only. Confirmation level, independent of stream. retracted is not selectable: such an incident is never listed.

role'perpetrator' | 'intermediary' | 'recipient' | 'mentioned'

canon only. victim is not selectable: victim links are never listed.

labelstring

Both scopes. An exact label from GET /v1/risk-labels, e.g. pig-butchering.

label_idinteger

canon only. The numeric form of label.

categorystring

canon only. The label's category, e.g. romance — wider than label.

sincestring date

canon only. Earliest occurred_at, as YYYY-MM-DD.

untilstring date

canon only. Latest occurred_at, as YYYY-MM-DD.

activeboolean

mine only — a canon row is not a seed and has no active state.

parked'true' | 'false' | 'only'

mine only. Which store: seeds, both, or the parking table alone.

limitinteger

1..1000. Defaults to 100 under canon.

offsetinteger

Response

Incidents.

object required

Changes

No recorded changes to this operation across all 1 revision of this API.