Read recorded incidents
Two scopes over two different stores, selected by scope.
scope=mine (default) — the incident seeds YOU pushed, with the score and active state of each. parked reaches the holding table for chains not indexed yet; those rows carry risk_score_when_replayed, never live risk. Add slug to get the curated record behind one of your pushes alongside the seeds.
scope=canon — the incident RECORD itself: every public incident naming an address, whoever filed it, one row per (incident, address). Filter by chain, by source (who published it, e.g. Chainabuse, SlowMist), by stream (curated = our own investigation, community = a user-filed report ingested from a feed), by label or category, by role, and by occurred_at through since/until. Requires an API key, and is priced one unit per returned row: it is a dataset read, not a lookup.
What scope=canon never returns, whatever you filter by: a private incident, a retracted one, and any victim link. A canon row is not a risk seed either, so it carries no score — status, stream and sources[].tier say how well evidenced the claim is, and what it is WORTH to an address is /v2/enrich's answer, not this one. In particular a community report scores nothing on its own: those seeds were deactivated in August and the report lives here as evidence.
Request
- Base URL: https://intelapi.publicaml.org
- URL: https://intelapi.publicaml.org/v1/incidents
- Auth: one of:
- API key in header X-API-Key
- none
Query parameters
mine = the seeds you pushed; canon = the incident record.
One incident by key. Under mine it also returns the curated record; under canon it narrows the listing to that incident.
Both scopes.
canon only. Who published the incident, matched case-insensitively against the publisher of a non-retracted source.
canon only. Which population: analyst-recorded investigation, or user-filed report from a feed.
canon only. Confirmation level, independent of stream. retracted is not selectable: such an incident is never listed.
canon only. victim is not selectable: victim links are never listed.
Both scopes. An exact label from GET /v1/risk-labels, e.g. pig-butchering.
canon only. The numeric form of label.
canon only. The label's category, e.g. romance — wider than label.
canon only. Earliest occurred_at, as YYYY-MM-DD.
canon only. Latest occurred_at, as YYYY-MM-DD.
mine only — a canon row is not a seed and has no active state.
mine only. Which store: seeds, both, or the parking table alone.
1..1000. Defaults to 100 under canon.
Response
Incidents.
Changes
No recorded changes to this operation across all 1 revision of this API.