---
title: "Report addresses involved in a named incident"
method: POST
path: "/v1/incidents"
tags: ["Write"]
---

# Report addresses involved in a named incident

`POST /v1/incidents`

## Request

- Base URL: `https://intelapi.publicaml.org`
- URL: `https://intelapi.publicaml.org/v1/incidents`
- Auth: API key in header `X-Signature` and API key in header `X-API-Key` and API key in header `X-Timestamp`

Files incident-derived risk seeds. Each entry names an address, the incident, and a label from the published taxonomy (GET /v1/risk-labels) — free-text categories are rejected.

Every address checksum is re-verified server-side (EIP-55, base58check, bech32): a mis-transcribed character would defame an uninvolved address.

An existing seed that already scores HIGHER is never downgraded — your incident is recorded against it and the stronger label stays. The effect on the address itself is immediate; the effect on its counterparties waits for a propagation run.

Requires HMAC.

## Request body

- object
  - `incidents` object[], required
    - `wallet_address` string, required: The address to look up, in its normal display form. * bitcoin — base58 (`1…`, `3…`) or bech32/bech32m (`bc1…`, `bc1p…`). Case is SIGNIFICANT for base58; do not lowercase it. A 64-character lowercase TRANSACTION HASH is also accepted here: on bitcoin the graph is bipartite (address → transaction → address), so a transaction is a node with its own neighbours and its own findings. CoinJoin is classified on the transaction, not on the participants, and this is how you read it. * ethereum, bsc — `0x` + 40 hex characters, any case. * tron — base58 (`T…`, 34 characters); the `0x` 20-byte form is accepted too and is what the API stores and echoes.
    - `chain` 'bitcoin' | 'ethereum' | 'bsc' | 'tron', required: Which blockchain the address belongs to. Send one of the four values in the enum. The short forms used by the older clients (ETH, BTC, TRX, BNB) and any capitalisation are still accepted, but responses always echo the canonical spelling. Getting this wrong is the single commonest integration bug: the same 0x-prefixed address exists on ethereum, bsc and tron and means a different wallet on each, so the chain is part of the identity, never a hint. If it does not match the address format the call fails with `invalid_address_format`, which names the chain the address does look like.
    - `label` string: A label from GET /v1/risk-labels.
    - `label_id` integer: The same, by id.
    - `category` string
    - `incident_name` string, required
    - `description` string
    - `source_url` string: The published evidence. Without it the claim has nothing behind it.
    - `incident_date` string
    - `confidence` number

## Response `200`

Per-entry result plus what was recorded.

- object

## Other responses

- `400`: Malformed request.
- `429`: Rate limited: anonymous callers, and keys issued with a quota of their own. Authenticate to remove the limit.
- `500`: Server error.

---

[API](https://skmtc.dev/publicaml/apis/publicaml-intelligence-api.md) · [All operations](https://skmtc.dev/publicaml/apis/publicaml-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/publicaml/apis/publicaml-intelligence-api/revisions/7c0c6315088c?raw)