---
title: "Read recorded incidents"
method: GET
path: "/v1/incidents"
tags: ["Reference"]
---

# Read recorded incidents

`GET /v1/incidents`

## Request

- Base URL: `https://intelapi.publicaml.org`
- URL: `https://intelapi.publicaml.org/v1/incidents`
- Auth: one of:
  - API key in header `X-API-Key`
  - none

Two scopes over two different stores, selected by `scope`.

**`scope=mine`** (default) — the incident seeds YOU pushed, with the score and active state of each. `parked` reaches the holding table for chains not indexed yet; those rows carry `risk_score_when_replayed`, never live risk. Add `slug` to get the curated record behind one of your pushes alongside the seeds.

**`scope=canon`** — the incident RECORD itself: every public incident naming an address, whoever filed it, one row per (incident, address). Filter by `chain`, by `source` (who published it, e.g. `Chainabuse`, `SlowMist`), by `stream` (`curated` = our own investigation, `community` = a user-filed report ingested from a feed), by `label` or `category`, by `role`, and by `occurred_at` through `since`/`until`. Requires an API key, and is priced one unit per returned row: it is a dataset read, not a lookup.

What `scope=canon` never returns, whatever you filter by: a private incident, a retracted one, and any `victim` link. A canon row is not a risk seed either, so it carries no score — `status`, `stream` and `sources[].tier` say how well evidenced the claim is, and what it is WORTH to an address is `/v2/enrich`'s answer, not this one. In particular a `community` report scores nothing on its own: those seeds were deactivated in August and the report lives here as evidence.

## Query parameters

- `scope` 'mine' | 'canon'
- `slug` string
- `chain` 'bitcoin' | 'ethereum' | 'bsc' | 'tron'
- `source` string
- `stream` 'curated' | 'community'
- `status` 'confirmed' | 'alleged' | 'disputed'
- `role` 'perpetrator' | 'intermediary' | 'recipient' | 'mentioned'
- `label` string
- `label_id` integer
- `category` string
- `since` string, date
- `until` string, date
- `active` boolean
- `parked` 'true' | 'false' | 'only'
- `limit` integer
- `offset` integer

## Response `200`

Incidents.

- object

## Other responses

- `400`: Malformed request.
- `429`: Rate limited: anonymous callers, and keys issued with a quota of their own. Authenticate to remove the limit.
- `500`: Server error.

---

[API](https://skmtc.dev/publicaml/apis/publicaml-intelligence-api.md) · [All operations](https://skmtc.dev/publicaml/apis/publicaml-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/publicaml/apis/publicaml-intelligence-api/revisions/7c0c6315088c?raw)