> ## Documentation Index > Fetch the complete documentation index at: https://chainpatrol-knowledge-update-blockaid-and-hypernative-partn.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # List Threat Detection Results > List threat detection results for an organization using API key authentication. Returns human-readable confidence levels (none, low, medium, high) and report status. Supports filtering by source, confidence level, asset status, and asset type. Includes pagination and search capabilities. ## Quick Start ### Authentication Include your API key in the `X-API-KEY` header: ```bash theme={null} X-API-KEY: ``` ### Example Request ```bash theme={null} curl --request POST \ --url https://api.chainpatrol.io/detection/list \ --header 'Content-Type: application/json' \ --header 'X-API-KEY: ' \ --data '{ "slug": "your-org", "limit": 50, "query": "phishing", "filters": [ { "property": "source", "operator": "in", "value": ["EXTERNAL", "GOOGLE_SEARCH"] }, { "property": "assetStatus", "operator": "in", "value": ["BLOCKED"] }, { "property": "confidence", "operator": "in", "value": ["high", "medium"] } ] }' ``` ## Request Schema ### Request Body | Field | Type | Required | Default | Constraints | Description | | ----------- | ---------- | -------- | ------- | ---------------- | -------------------------------------------------- | | `slug` | `string` | ✅ Yes | - | - | Organization slug identifier | | `cursor` | `number` | ❌ No | - | - | Pagination cursor from previous response | | `limit` | `number` | ❌ No | `50` | Min: 1, Max: 100 | Number of results to return | | `filters` | `Filter[]` | ❌ No | `[]` | - | Array of filter objects | | `query` | `string` | ❌ No | `""` | - | Search query for threat content (case-insensitive) | | `startDate` | `string` | ❌ No | - | ISO 8601 format | Start date for filtering results | | `endDate` | `string` | ❌ No | - | ISO 8601 format | End date for filtering results | ### Filter Schema Each filter object must have the following structure: | Field | Type | Required | Description | | ---------- | ---------- | -------- | ----------------------------------- | | `property` | `string` | ✅ Yes | Filter property (see options below) | | `operator` | `string` | ✅ Yes | `"in"` or `"notIn"` | | `value` | `string[]` | ✅ Yes | Array of values to filter by | #### Filter Properties **1. Source Filter (`"source"`)** ```typescript theme={null} { "property": "source", "operator": "in" | "notIn", "value": ThreatDetectionSourceKey[] } ``` * `"ASSET_CHECK"` - Asset verification checks * `"BING_SEARCH"` - Bing search results * `"CERTSTREAM"` - Certificate transparency logs * `"DNS_TWIST"` - DNS twist detection * `"DUCK_DUCK_GO_SEARCH"` - DuckDuckGo search results * `"EXTERNAL"` - External threat submissions * `"GOOGLE_SEARCH"` - Google search results * `"GUESTBOOK"` - Guestbook submissions * `"MEDIUM_TAG_RSS"` - Medium RSS feeds * `"MOZILLA_ADDON_SEARCH"` - Mozilla addon searches * `"REDDIT_SUBREDDIT_SEARCH"` - Reddit subreddit searches * `"TWITTER"` - Twitter monitoring * `"TWITTER_POST_SEARCH"` - Twitter post searches * `"TWITTER_SEARCH"` - Twitter search results * `"URLSCAN"` - URLScan.io results * `"YAHOO_SEARCH"` - Yahoo search results * `"YOUTUBE_SEARCH"` - YouTube search results **2. Asset Status Filter (`"assetStatus"`)** ```typescript theme={null} { "property": "assetStatus", "operator": "in" | "notIn", "value": AssetStatus[] } ``` **Available Asset Status Values:** * `"UNKNOWN"` - Status not yet determined * `"ALLOWED"` - Asset is legitimate/allowed * `"BLOCKED"` - Asset is blocked/malicious **3. Confidence Filter (`"confidence"`)** ```typescript theme={null} { "property": "confidence", "operator": "in" | "notIn", "value": ConfidenceLevel[] } ``` **Available Confidence Level Values:** * `"none"` - No confidence threshold met * `"low"` - Low confidence threat detection * `"medium"` - Medium confidence threat detection * `"high"` - High confidence threat detection **4. Asset Type Filter (`"assetType"`)** ```typescript theme={null} { "property": "assetType", "operator": "in" | "notIn", "value": AssetType[] } ``` * `"URL"` - Website URLs * `"PAGE"` - Web pages * `"ADDRESS"` - Blockchain addresses * `"TWITTER"` - Twitter profiles/posts * `"FACEBOOK"` - Facebook profiles/pages * `"YOUTUBE"` - YouTube channels/videos * `"REDDIT"` - Reddit posts/subreddits * `"TELEGRAM"` - Telegram channels/groups * `"DISCORD"` - Discord servers (deprecated) * `"DISCORD_USER"` - Discord users * `"LINKEDIN"` - LinkedIn profiles * `"INSTAGRAM"` - Instagram profiles * `"THREADS"` - Threads profiles * `"TIKTOK"` - TikTok profiles * `"MEDIUM"` - Medium articles/profiles * `"EMAIL"` - Email addresses * `"WHATSAPP"` - WhatsApp contacts * `"GOOGLE_APP_STORE"` - Google Play Store apps * `"APPLE_APP_STORE"` - Apple App Store apps * `"AMAZON_APP_STORE"` - Amazon App Store apps * `"MICROSOFT_APP_STORE"` - Microsoft Store apps * `"CHROME_WEB_STORE"` - Chrome extensions * `"MOZILLA_ADDONS"` - Firefox addons * `"OPERA_ADDONS"` - Opera addons * `"PATREON"` - Patreon profiles * `"OPENSEA"` - OpenSea collections/profiles * `"FARCASTER"` - Farcaster profiles * `"IPFS"` - IPFS hashes * `"GOOGLE_FORM"` - Google Forms * `"QUORA"` - Quora profiles/posts * `"GITHUB"` - GitHub repositories/profiles * `"TEACHABLE"` - Teachable courses * `"SUBSTACK"` - Substack publications * `"DEBANK"` - DeBank profiles * `"TAWK_TO"` - Tawk.to chat widgets * `"JOTFORM"` - JotForm forms * `"PRIMAL"` - Primal profiles * `"BLUESKY"` - Bluesky profiles * `"SNAPCHAT"` - Snapchat profiles * `"DESO"` - DeSo profiles ## Response Schema ### Response Body ```typescript theme={null} { detections: DetectionResult[]; nextCursor: number | null; } ``` ### Detection Result Object Each item in the `detections` array has the following structure: | Field | Type | Description | | --------------- | ------------- | --------------------------------------------------------- | | `id` | `number` | Unique threat detection result identifier | | `threatContent` | `string` | Content that was detected as threatening | | `source` | `string` | Source of the threat detection (ThreatDetectionSourceKey) | | `createdAt` | `string` | ISO 8601 timestamp of when threat was detected | | `confidence` | `string` | Confidence level: "none", "low", "medium", or "high" | | `reportStatus` | `string` | Report status: "REPORTED" or "NOT\_REPORTED" | | `asset` | `AssetObject` | Associated asset information | ### Asset Object | Field | Type | Description | | --------- | -------- | --------------------------------------------- | | `id` | `number` | Unique asset identifier | | `content` | `string` | Asset content (URL, address, username, etc.) | | `type` | `string` | Asset type (AssetType enum value) | | `status` | `string` | Current asset status (AssetStatus enum value) | ### Complete Response Example ```json theme={null} { "detections": [ { "id": 12345, "threatContent": "Phishing site detected mimicking legitimate service", "source": "GOOGLE_SEARCH", "createdAt": "2024-01-15T10:30:00Z", "confidence": "high", "reportStatus": "REPORTED", "asset": { "id": 67890, "content": "https://fake-site.com", "type": "URL", "status": "BLOCKED" } }, { "id": 12346, "threatContent": "Suspicious crypto address found in scam report", "source": "EXTERNAL", "createdAt": "2024-01-15T09:15:00Z", "confidence": "medium", "reportStatus": "NOT_REPORTED", "asset": { "id": 67891, "content": "0x1234567890123456789012345678901234567890", "type": "ADDRESS", "status": "BLOCKED" } } ], "nextCursor": 12347 } ``` ## Access Control The API enforces strict access control based on your API key: 1. **Organization API Keys**: * Can only access detection results for their associated organization * Must match the `slug` parameter exactly * Example: An API key for "acme-org" can only query results for "acme-org" 2. **User API Keys**: * Can access detection results for any organization where the user is a member * Requires the user to be an active member of the queried organization If you attempt to query an organization without proper permissions, you will receive a 403 Forbidden error with the message: "API key does not have access to this organization" ## Example Implementation ```javascript JavaScript theme={null} async function fetchDetectionResults(params) { const response = await fetch("https://api.chainpatrol.io/detection/list", { method: "POST", headers: { "Content-Type": "application/json", "X-API-KEY": "", }, body: JSON.stringify(params), }); return response.json(); } // Example usage fetchDetectionResults({ slug: "your-org", limit: 50, query: "phishing", filters: [ { property: "assetStatus", operator: "in", value: ["BLOCKED"], }, { property: "assetType", operator: "in", value: ["URL", "ADDRESS"], }, ], startDate: "2024-01-01T00:00:00Z", endDate: "2024-03-01T00:00:00Z", }) .then((data) => { console.log("Detection results:", data.detections); console.log("Next cursor:", data.nextCursor); }) .catch((error) => console.error("Error fetching results:", error)); ``` ```typescript TypeScript theme={null} interface DetectionFilter { property: "source" | "assetStatus" | "assetType" | "confidence"; operator: "in" | "notIn"; value: string[]; } interface DetectionListParams { slug: string; cursor?: number; limit?: number; filters?: DetectionFilter[]; query?: string; startDate?: string; endDate?: string; } interface AssetObject { id: number; content: string; type: string; status: string; } interface DetectionResult { id: number; threatContent: string; source: string; createdAt: string; confidence: "none" | "low" | "medium" | "high"; reportStatus: "REPORTED" | "NOT_REPORTED"; asset: AssetObject; } interface DetectionListResponse { detections: DetectionResult[]; nextCursor: number | null; } async function fetchDetectionResults( params: DetectionListParams ): Promise { const response = await fetch("https://api.chainpatrol.io/detection/list", { method: "POST", headers: { "Content-Type": "application/json", "X-API-KEY": "", }, body: JSON.stringify(params), }); return response.json(); } // Example usage fetchDetectionResults({ slug: "your-org", limit: 50, filters: [ { property: "source", operator: "in", value: ["GOOGLE_SEARCH", "EXTERNAL"], }, { property: "assetStatus", operator: "in", value: ["BLOCKED"], }, ], }) .then((data) => { console.log(`Found ${data.detections.length} detection results`); data.detections.forEach((item) => { console.log(`Threat: ${item.threatContent}`); console.log(`Asset: ${item.asset.content} (${item.asset.type})`); console.log(`Status: ${item.asset.status}`); console.log(`Confidence: ${item.confidence}`); console.log(`Report Status: ${item.reportStatus}`); console.log("---"); }); if (data.nextCursor) { console.log("More results available with cursor:", data.nextCursor); } }) .catch((error) => console.error("Error fetching results:", error)); ``` ## OpenAPI ````yaml POST /detection/list openapi: 3.0.3 info: title: ChainPatrol External API - OpenAPI 3.0 description: ChainPatrol External API documentation version: 2.0.0 servers: - url: https://app.chainpatrol.io/api/v2 security: [] tags: - name: asset - name: report externalDocs: url: https://chainpatrol.com/docs paths: /detection/list: post: tags: - detection summary: List threat detection results for organization description: >- List threat detection results for an organization using API key authentication. Returns human-readable confidence levels (none, low, medium, high) and report status. Supports filtering by source, confidence level, asset status, and asset type. Includes pagination and search capabilities. operationId: detectionList requestBody: required: true content: application/json: schema: type: object properties: slug: type: string cursor: type: number limit: type: number minimum: 1 maximum: 100 default: 50 filters: type: array items: oneOf: - type: object properties: property: type: string enum: - source operator: type: string enum: - in - notIn value: type: array items: type: string enum: - meta_ads_search - telegram_channels_search - telegram_user_search - tik_tok_video_search - tik_tok_user_search - blocklist - apple_app_store - google_ads_search - mozilla_addon_search - reddit_subreddit_search - asset_check - twitter_post_search - medium_tag_rss - twitter_search - yahoo_search - duck_duck_go_search - bing_search - guestbook - certstream - external - google_search - dns_twist - twitter - twitter_username_monitor - urlscan - urlscan_hostname_search - youtube_search - google_play_search - dexscreener_search - blocked_ip_scan - blocked_bilibili_suggested - grok_post_search - grok_user_search - google_lens_image_search - yandex_search - linkedin_employee_detection - bing_ads_search - tik_tok_ads_search - dnsdb required: - property - operator - value - type: object properties: property: type: string enum: - confidence operator: type: string enum: - in - notIn value: type: array items: type: string enum: - none - low - medium - high required: - property - operator - value - type: object properties: property: type: string enum: - assetStatus operator: type: string enum: - in - notIn value: type: array items: type: string enum: - UNKNOWN - ALLOWED - BLOCKED required: - property - operator - value - type: object properties: property: type: string enum: - assetType operator: type: string enum: - in - notIn value: type: array items: type: string enum: - URL - PAGE - ADDRESS - DISCORD - LINKEDIN - TWITTER - FACEBOOK - YOUTUBE - REDDIT - TELEGRAM - GOOGLE_APP_STORE - APPLE_APP_STORE - AMAZON_APP_STORE - MICROSOFT_APP_STORE - TIKTOK - INSTAGRAM - THREADS - MEDIUM - CHROME_WEB_STORE - MOZILLA_ADDONS - OPERA_ADDONS - EMAIL - PATREON - OPENSEA - FARCASTER - IPFS - GOOGLE_FORM - WHATSAPP - DISCORD_USER - QUORA - GITHUB - TEACHABLE - SUBSTACK - DEBANK - TAWK_TO - JOTFORM - PRIMAL - BLUESKY - SNAPCHAT - DESO - PINTEREST - FLICKR - GALXE - VELOG - NPM - PYPI - HEX - DOCKER_HUB - VOCAL_MEDIA - TECKFINE - TENDERLY - HACKMD - ETSY - ZAZZLE - BASENAME - BILIBILI_TV - VIMEO - DAILYMOTION - PHONE_NUMBER - SLACK - CALENDLY - NGROK - RARIBLE - RUST_PACKAGE - FLATHUB - VIDLII - VEVIOZ - ISSUU - SOUNDCLOUD - ZAPPER - REDNOTE - SAMSUNG_APP_STORE - HUAWEI_APP_STORE - XIAOMI_APP_STORE - TENCENT_APP_STORE - OPPO_APP_STORE - VIVO_APP_STORE - F_DROID - GOOGLE_AD - BING_AD - TWITCH - BEHANCE - ZORA - META_AD - SIGNAL - DEVIANTART - BANDCAMP - ARCHIVE_ORG - FIVE_HUNDRED_PX required: - property - operator - value - type: object properties: property: type: string enum: - brand operator: type: string enum: - in - notIn value: type: array items: type: number required: - property - operator - value default: [] query: type: string default: '' startDate: type: string endDate: type: string required: - slug responses: '200': description: Successful response content: application/json: schema: type: object properties: detections: type: array items: type: object properties: id: type: number threatContent: type: string source: type: string enum: - meta_ads_search - telegram_channels_search - telegram_user_search - tik_tok_video_search - tik_tok_user_search - blocklist - apple_app_store - google_ads_search - mozilla_addon_search - reddit_subreddit_search - asset_check - twitter_post_search - medium_tag_rss - twitter_search - yahoo_search - duck_duck_go_search - bing_search - guestbook - certstream - external - google_search - dns_twist - twitter - twitter_username_monitor - urlscan - urlscan_hostname_search - youtube_search - google_play_search - dexscreener_search - blocked_ip_scan - blocked_bilibili_suggested - grok_post_search - grok_user_search - google_lens_image_search - yandex_search - linkedin_employee_detection - bing_ads_search - tik_tok_ads_search - dnsdb createdAt: type: string confidence: type: string enum: - none - low - medium - high reportStatus: type: string enum: - REPORTED - NOT_REPORTED asset: type: object properties: id: type: number content: type: string type: type: string enum: - URL - PAGE - ADDRESS - DISCORD - LINKEDIN - TWITTER - FACEBOOK - YOUTUBE - REDDIT - TELEGRAM - GOOGLE_APP_STORE - APPLE_APP_STORE - AMAZON_APP_STORE - MICROSOFT_APP_STORE - TIKTOK - INSTAGRAM - THREADS - MEDIUM - CHROME_WEB_STORE - MOZILLA_ADDONS - OPERA_ADDONS - EMAIL - PATREON - OPENSEA - FARCASTER - IPFS - GOOGLE_FORM - WHATSAPP - DISCORD_USER - QUORA - GITHUB - TEACHABLE - SUBSTACK - DEBANK - TAWK_TO - JOTFORM - PRIMAL - BLUESKY - SNAPCHAT - DESO - PINTEREST - FLICKR - GALXE - VELOG - NPM - PYPI - HEX - DOCKER_HUB - VOCAL_MEDIA - TECKFINE - TENDERLY - HACKMD - ETSY - ZAZZLE - BASENAME - BILIBILI_TV - VIMEO - DAILYMOTION - PHONE_NUMBER - SLACK - CALENDLY - NGROK - RARIBLE - RUST_PACKAGE - FLATHUB - VIDLII - VEVIOZ - ISSUU - SOUNDCLOUD - ZAPPER - REDNOTE - SAMSUNG_APP_STORE - HUAWEI_APP_STORE - XIAOMI_APP_STORE - TENCENT_APP_STORE - OPPO_APP_STORE - VIVO_APP_STORE - F_DROID - GOOGLE_AD - BING_AD - TWITCH - BEHANCE - ZORA - META_AD - SIGNAL - DEVIANTART - BANDCAMP - ARCHIVE_ORG - FIVE_HUNDRED_PX status: type: string enum: - UNKNOWN - ALLOWED - BLOCKED required: - id - content - type - status required: - id - threatContent - source - createdAt - confidence - reportStatus - asset nextCursor: type: number required: - detections '400': description: Invalid input data content: application/json: schema: $ref: '#/components/schemas/error.BAD_REQUEST' '401': description: Authorization not provided content: application/json: schema: $ref: '#/components/schemas/error.UNAUTHORIZED' '403': description: Insufficient access content: application/json: schema: $ref: '#/components/schemas/error.FORBIDDEN' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/error.INTERNAL_SERVER_ERROR' security: - ApiKey: [] components: schemas: error.BAD_REQUEST: type: object properties: message: type: string description: The error message example: Invalid input data code: type: string description: The error code example: BAD_REQUEST issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Invalid input data error (400) description: The error information example: code: BAD_REQUEST message: Invalid input data issues: [] error.UNAUTHORIZED: type: object properties: message: type: string description: The error message example: Authorization not provided code: type: string description: The error code example: UNAUTHORIZED issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Authorization not provided error (401) description: The error information example: code: UNAUTHORIZED message: Authorization not provided issues: [] error.FORBIDDEN: type: object properties: message: type: string description: The error message example: Insufficient access code: type: string description: The error code example: FORBIDDEN issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Insufficient access error (403) description: The error information example: code: FORBIDDEN message: Insufficient access issues: [] error.INTERNAL_SERVER_ERROR: type: object properties: message: type: string description: The error message example: Internal server error code: type: string description: The error code example: INTERNAL_SERVER_ERROR issues: type: array items: type: object properties: message: type: string required: - message description: An array of issues that were responsible for the error example: [] required: - message - code title: Internal server error error (500) description: The error information example: code: INTERNAL_SERVER_ERROR message: Internal server error issues: [] securitySchemes: ApiKey: type: apiKey in: header name: X-API-KEY description: >- Your API key. This is required by most endpoints to access our API programatically. Reach out to us at [support@chainpatrol.io](mailto:support@chainpatrol.io?subject=Re:%20API%20Key%20for%20SDK&body=Company:%20%0AName:%20%0APurpose:%20) to get an API key for your use. ````