Radar API - Coverbase Docs

Radar is Coverbase’s continuous third-party monitoring surface. These object types are exposed here:

A radar event (cbrevent_...) records something that happened to one or more vendors and groups the source data behind it (news, advisories, breach disclosures).
A radar alert (cbrdrres_...) is one detector’s verdict that a piece of source data is relevant to one vendor. Alerts are what you triage here: dismiss the noise, or escalate into a reassessment.
A signal (cbrag_...) is one radar event as it affects your organization. It rolls up the event’s alerts into one row with your organization’s status, title, and summary. You can list, dismiss, restore, and acknowledge signals, and move them between your organization’s statuses.
A case (cbcase_...) tracks one incident across the vendors it may affect. Each vendor on a case has a case thread (cbcseth_...) that records whether that vendor was affected and what was done about it.
A source (cbradarsrc_...) is something Radar watches for your organization: a website, an RSS feed, an API, or a snapshot of a page or list. Each source reads an origin, the URL Radar pulls. An origin is private to your organization or shared from the Coverbase source library.
A detector (cbrdrdet_...) decides which events matter to which vendors. You can create and tune detectors, back-test them against past events, and teach them with examples of events they should and should not alert on.

Read the event for what happened, the signal for where your organization stands on it, and the alerts for which detector flagged which vendor. See the Supplier Radar key concepts. All endpoints are org-scoped to the API key. See API conventions for shared behavior, including pagination.

Method	Path
`GET`	`/v1/radar/events`
`POST`	`/v1/radar/events`
`GET`	`/v1/radar/events/{event_id}`
`GET`	`/v1/radar/events/{event_id}/alerts`
`GET`	`/v1/radar/alerts`
`GET`	`/v1/radar/alerts/{alert_id}`
`POST`	`/v1/radar/alerts/{alert_id}/dismiss`
`POST`	`/v1/radar/alerts/{alert_id}/undismiss`
`PATCH`	`/v1/radar/alerts/{alert_id}`
`PUT`	`/v1/radar/alerts/{alert_id}/dismiss-reason`
`PATCH`	`/v1/radar/events/{event_id}`
`GET`	`/v1/radar/events/{event_id}/updates`
`GET`	`/v1/radar/events/{event_id}/diagnostics`
`GET`	`/v1/radar/signals`
`GET`	`/v1/radar/signals/{signal_id}`
`PATCH`	`/v1/radar/signals/{signal_id}`
`POST`	`/v1/radar/signals/dismiss`
`POST`	`/v1/radar/signals/undismiss`
`POST`	`/v1/radar/signals/{signal_id}/acknowledge`
`POST`	`/v1/radar/signals/risk-impact-decision`
`POST`	`/v1/radar/signals/{signal_id}/regenerate-summary`
`GET`	`/v1/radar/cases`
`POST`	`/v1/radar/cases`
`GET`	`/v1/radar/cases/{case_id}`
`PATCH`	`/v1/radar/cases/{case_id}`
`POST`	`/v1/radar/cases/{case_id}/signals`
`DELETE`	`/v1/radar/cases/{case_id}/signals/{signal_id}`
`POST`	`/v1/radar/cases/{case_id}/description-suggestion`
`GET`	`/v1/radar/cases/{case_id}/threads`
`POST`	`/v1/radar/cases/{case_id}/threads`
`POST`	`/v1/radar/cases/{case_id}/threads/bulk`
`GET`	`/v1/radar/cases/{case_id}/threads/{thread_id}`
`PATCH`	`/v1/radar/cases/{case_id}/threads/{thread_id}`
`POST`	`/v1/radar/cases/{case_id}/threads/{thread_id}/pause-follow-ups`
`GET`	`/v1/radar/detectors`
`GET`	`/v1/radar/sources`
`POST`	`/v1/radar/sources`
`GET`	`/v1/radar/sources/{source_id}`
`PATCH`	`/v1/radar/sources/{source_id}`
`POST`	`/v1/radar/sources/{source_id}/pull`
`GET`	`/v1/radar/source-library`
`GET`	`/v1/radar/source-library/{library_id}`
`GET`	`/v1/radar/origins`
`GET`	`/v1/radar/black-kite`
`PUT`	`/v1/radar/black-kite`
`POST`	`/v1/radar/detectors`
`GET`	`/v1/radar/detectors/{detector_id}`
`PATCH`	`/v1/radar/detectors/{detector_id}`
`GET`	`/v1/radar/vendors/{vendor_id}/detectors`
`POST`	`/v1/radar/detectors/suggest-risk-domains`
`POST`	`/v1/radar/detectors/{detector_id}/suggest-instructions`
`POST`	`/v1/radar/detectors/{detector_id}/tests`
`GET`	`/v1/radar/detectors/{detector_id}/tests/{test_run_id}`
`POST`	`/v1/radar/detectors/{detector_id}/tests/{test_run_id}/alerts`
`POST`	`/v1/radar/detectors/{detector_id}/tests/{test_run_id}/teach`
`GET`	`/v1/radar/detectors/{detector_id}/dismissal-examples`
`POST`	`/v1/radar/detectors/{detector_id}/dismissal-examples`
`PATCH`	`/v1/radar/dismissal-examples/{example_id}`
`DELETE`	`/v1/radar/dismissal-examples/{example_id}`
`POST`	`/v1/radar/alerts`
`GET`	`/v1/radar/events/{event_id}/data-items`
`GET`	`/v1/radar/events/{event_id}/time-to-signal`
`GET`	`/v1/radar/events/{event_id}/exposure-vendors`
`POST`	`/v1/radar/events/{event_id}/detector-runs`
`GET`	`/v1/radar/signals/{signal_id}/alerts`
`GET`	`/v1/radar/vendors/{vendor_id}/stories`
`GET`	`/v1/radar/vendors/{vendor_id}/stories/{event_id}`
`GET`	`/v1/radar/data`
`GET`	`/v1/radar/data/categories`
`GET`	`/v1/radar/data/{data_id}`
`GET`	`/v1/radar/data/{data_id}/content`
`GET`	`/v1/radar/data/{data_id}/event`
`GET`	`/v1/radar/runs`
`GET`	`/v1/radar/runs/{run_id}`
`GET`	`/v1/radar/sources/{source_id}/snapshot`
`GET`	`/v1/radar/sources/{source_id}/snapshot/page`
`POST`	`/v1/radar/sources/{source_id}/test`
`GET`	`/v1/radar/sources/{source_id}/extractor`
`POST`	`/v1/radar/sources/{source_id}/extractor/accept`
`POST`	`/v1/radar/sources/{source_id}/extractor/reject`
`GET`	`/v1/radar/detector-library/sources`
`PUT`	`/v1/radar/vendors/{vendor_id}/black-kite/domains`
`POST`	`/v1/radar/vendors/{vendor_id}/black-kite/scan`
`GET`	`/v1/radar/cases/{case_id}/export`
`POST`	`/v1/radar/cases/{case_id}/threads/source-contacts`
`GET`	`/v1/radar/cases/{case_id}/contact-search`
`POST`	`/v1/radar/cases/{case_id}/threads/{thread_id}/emails`
`POST`	`/v1/radar/detector-replays`
`GET`	`/v1/radar/detector-replays`
`GET`	`/v1/radar/detector-replays/{replay_id}`
`POST`	`/v1/radar/alert-purges/preview`
`POST`	`/v1/radar/alert-purges`
`GET`	`/v1/radar/alert-purges`
`GET`	`/v1/radar/alert-purges/{purge_id}`
`POST`	`/v1/radar/alert-purges/{purge_id}/cancel`

None of these honor Idempotency-Key. The read routes need the radar_alert:read:org permission, and the routes that change something need radar_alert:update:org. API keys hold both. You cannot archive a case or a case thread through the API. The source and detector routes use the Radar detector permissions instead: reads need radar_detector:read:org, creating a detector needs radar_detector:create:org, and edits, back-tests and examples need radar_detector:update:org. Pulling a source needs radar_detector:run:org, and saving Black Kite settings needs integration:update:org. API keys hold all of them. An API key cannot archive or restore a source or a detector, or delete an example: those requests return 403 api_key_not_allowed, and a signed-in user must make them. Radar data, the case export, the case contact search, stories, snapshots and signal alerts need radar_alert:read:org. Writing an alert by hand, filling case contacts and emailing a vendor from a case need radar_alert:update:org. Runs, the detector library sources and extractor runs need radar_detector:read:org. Testing a source, accepting or rejecting an extractor, and running a detector on an event need radar_detector:update:org. Changing a vendor’s Black Kite domains needs vendor:update:org, and a Black Kite scan needs integration:run:org. Story reads also check that you can read the vendor. API keys hold all of these permissions. An API key cannot accept a generated extractor. Detector replays and alert purges are for Coverbase staff only: any other caller gets 403 coverbase_staff_only, and an API key gets 403 api_key_not_allowed on every purge route.

Create a radar event

POST

POST /v1/radar/events

Returns 201 Created. Use this to seed an event into Radar without waiting for a source feed to pick up the underlying article; useful for recording out-of-band incidents and for exercising your detectors against a known event. Supplied vendors are linked to the event as primary-impacted, and the event is evaluated against your detectors unless you opt out (see detector evaluation).

Request body

string

required

Short event name.

string

required

Event summary / description.

string

required

Primary impact category. Case-sensitive; one of Infosec, Financial, Operational, Legal, Compliance, Reputational, Contractual, ESG, Corporate, Geopolitical & External, Inapplicable, Other.

string[]

Additional impact categories, from the same list as primary_impact_type. A value outside it is rejected with 422. These categories decide which category-filtered detectors can match the event.

string[]

Vendors directly impacted (cbvndr_...). Each is linked as primary-impacted. Vendors that cannot be resolved, or that are not yet linked to a company record, are skipped silently.

string[]

Risk domains to record on the event (cbrdom_...), returned on the radar event object. An id your org does not have is rejected with 400 risk_domain_not_found.

string

URL of the underlying article / report.

string

Name of the source.

integer

When the event occurred (Unix seconds). Defaults to now when omitted.

boolean

Evaluate the event against the detectors that target each linked vendor, raising radar alerts for the ones that fire. Default true. Pass false to record an event without spending a model call per (detector, vendor).

Detector evaluation

The scheduled Radar pipeline is source-driven: it evaluates what its configured sources pull in, and never sees an event created through this endpoint. Events posted here are therefore evaluated out of band, which happens by default. Pass create_alert: false to store one without evaluating it. Evaluation is asynchronous: the response returns as soon as the event is stored, and alerts appear on GET /v1/radar/alerts once the detectors finish, each carrying this event’s event_id. What runs against the event:

Vendors. The vendors in vendor_ids that resolve within your org, plus the vendors that depend on them: a breach at a supplier is evaluated against the customers exposed to it, the same expansion the scheduled pipeline performs, and through the same caps. An event with no resolvable vendor is stored but never evaluated.
Detectors. Only the ones that already target each of those vendors, including the detector’s source scoping: a detector limited to specific sources sees this event only if it includes the org’s Manually-created events source. Detectors with an impact-category filter are matched against the event’s own primary_impact_type and secondary_impact_types.
Cost. One model call per (detector, vendor) pair, counting the vendors reached by expansion. Pass create_alert: false on events you only want recorded.

Re-posting the same event is safe: each (event, vendor, detector) combination is evaluated once, so retries do not duplicate alerts or re-notify reviewers. To tell whether an event was evaluated, read its alerts: evaluation_status separates “never evaluated”, “still evaluating”, and “evaluated with nothing raised”.

Example request

cURL

curl -X POST "https://api.coverbase.app/v1/radar/events" \
  -H "Authorization: Bearer ak_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme data breach",
    "summary": "Acme disclosed unauthorized access to a customer database.",
    "primary_impact_type": "Infosec",
    "vendor_ids": ["cbvndr_e448ba62882143f3ba0c140bb2e30162"],
    "source_url": "https://news.example.com/acme-breach",
    "source_name": "Example News",
    "create_alert": true
  }'

Returns the radar event object.

Radar event object

string

Radar event ID (cbrevent_...).

string | null

Event name.

string

Event summary.

string

Primary impact category.

string[]

Additional impact categories.

string[]

Risk domains recorded on the event.

integer | null

When the event occurred (Unix seconds).

boolean

true if archived.

integer

Unix timestamp (seconds).

integer

Unix timestamp (seconds).

List radar events

GET

GET /v1/radar/events

Query parameters

string

Filter by primary impact category.

boolean

Include archived events. Default false.

integer

Page size. Default 50, range 1-200.

integer

Page offset. Default 0.

The list envelope adds total, limit, and offset. See pagination.

Retrieve a radar event

GET

GET /v1/radar/events/{event_id}

Returns the radar event object, or 404 radar_event_not_found.

List an event’s alerts

GET

GET /v1/radar/events/{event_id}/alerts

Returns the detector results for one event, plus the state of its evaluation. An event that raised nothing looks the same from outside whether it was never evaluated, is still being evaluated, or was evaluated and judged irrelevant; the envelope’s counts separate the three.

boolean

Include detector runs that scored the event without alerting. Default false.

boolean

Dismissal filter. Omit for both; true for only dismissed; false for only active.

boolean

Include archived results. Default false.

integer

Page size. Default 50, range 1-200.

integer

Page offset. Default 0.

The response is the usual list envelope of radar alert objects (items, total, limit, offset) plus:

string

not_requested (the event was stored without evaluation, or no linked vendor resolved), pending (evaluation was requested and no detector has reported yet), or completed (at least one detector scored the event).

integer

Detector results recorded for the event, alerting or not, ignoring your filters.

integer

How many of those results raised an alert.

Returns 404 radar_event_not_found for an unknown event.

List radar alerts

GET

GET /v1/radar/alerts

Query parameters

string

Filter to alerts on a vendor (cbvndr_...).

string[]

Filter by severity, one of informational, low, medium, high. Repeat the param for multiple values: severity=high&severity=medium.

boolean

Dismissal filter. Omit to hide dismissed alerts (default); true for only dismissed; false for only active.

boolean

Include archived alerts. Default false.

integer

Page size. Default 50, range 1-200.

integer

Page offset. Default 0.

Example response

{
  "items": [
    {
      "id": "cbrdrres_9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d",
      "vendor_id": "cbvndr_e448ba62882143f3ba0c140bb2e30162",
      "detector_id": "cbrdrdet_2d5e8f1a4b7c0d3e6f9a2b5c8d1e4f7a",
      "source_id": "cbradarsrc_1111111111111111111111111111aaaa",
      "data_id": "cbradardata_2222222222222222222222222222bbbb",
      "event_id": "cbrevent_3333333333333333333333333333cccc",
      "summary": "Acme disclosed a data breach affecting customer records.",
      "severity": "high",
      "confidence": "high",
      "should_alert": true,
      "is_dismissed": false,
      "dismiss_reason": null,
      "dismissed_at": null,
      "is_archived": false,
      "created_at": 1746576000,
      "updated_at": 1746576400
    }
  ],
  "total": 1,
  "limit": 50,
  "offset": 0
}

Radar alert object

string

Radar alert ID (cbrdrres_...).

string

Vendor the alert is on (cbvndr_...).

string

Detector that produced the alert (cbrdrdet_...).

string

Radar source (cbradarsrc_...).

string

Underlying source data item (cbradardata_...).

string | null

Radar event the alert’s data belongs to (cbrevent_...), if any.

string

Alert summary.

string

Severity (informational, low, medium, high).

string

Detector confidence (low, medium, high).

boolean

true for a triggered alert.

boolean

true if dismissed.

string | null

Reason recorded at dismissal, if any.

integer | null

When dismissed (Unix seconds).

boolean

true if archived.

integer

Unix timestamp (seconds).

integer

Unix timestamp (seconds).

Retrieve a radar alert

GET

GET /v1/radar/alerts/{alert_id}

Returns the radar alert object, or 404 alert_not_found.

Dismiss a radar alert

POST

POST /v1/radar/alerts/{alert_id}/dismiss

Marks an alert as dismissed (triaged as not actionable). Returns the refreshed radar alert object.

Request body

string

Optional dismissal reason. It shows in the dashboard and goes into the detector’s learning context. Each person you mention in it with @[name](cbuser_...) gets a notification.

boolean

Accepted for compatibility. When the alert belongs to an event, every dismissal records it as a negative example on its detector, so future runs suppress similar alerts, whatever this field says.

Example request

cURL

curl -X POST "https://api.coverbase.app/v1/radar/alerts/cbrdrres_9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d/dismiss" \
  -H "Authorization: Bearer ak_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{ "reason": "Duplicate of an existing event", "suppress_similar": true }'

Status	Body	When
404	`{"detail": {"code": "alert_not_found", "message": "Radar alert not found."}}`	Not found, or not in the API key’s org.

Dismissing an already-dismissed alert is a no-op that returns 200 with the alert; a reason supplied on the repeat call replaces the stored one.

Restore a dismissed alert

POST

POST /v1/radar/alerts/{alert_id}/undismiss

Restores a dismissed alert to the active list. Returns the refreshed radar alert object, or 404 alert_not_found.

Update a radar alert

PATCH

PATCH /v1/radar/alerts/{alert_id}

Changes the fields you send and returns the refreshed radar alert object. Fields you leave out stay as they are.

string

New alert summary.

boolean

Whether the result counts as a triggered alert.

string

New detector reasoning.

string

One of low, medium, high.

Status	Code	When
400	`alert_system_managed`	The alert is a BOM correlation result, whose evidence Coverbase manages.
404	`alert_not_found`	Not found, or not in the API key’s org.

Set a dismissal reason

PUT

PUT /v1/radar/alerts/{alert_id}/dismiss-reason

Replaces the reason stored on a dismissed alert. Returns the refreshed radar alert object, or 404 alert_not_found.

string | null

The new reason. Send null to clear it.

Update a radar event

PATCH

PATCH /v1/radar/events/{event_id}

Renames or re-summarizes an event for your organization, or links more vendors to it. Returns the refreshed radar event object, or 404 event_not_found. A new name or summary becomes your organization’s title and summary for the event’s signal. On an event your organization created, the event changes too. On a shared event, the event keeps its own text. Vendors already linked to the event are skipped.

string | null

New title. Send null to clear your organization’s title.

string | null

New summary. Send null to clear your organization’s summary.

string[]

Vendors to link as primary-impacted (cbvndr_...).

string[]

Vendors to link as directly impacted (cbvndr_...).

List an event’s updates

GET

GET /v1/radar/events/{event_id}/updates

Lists the developments Coverbase recorded on an event as its story changed, newest first. Pages with limit (default 50, range 1-200) and offset. Returns 404 event_not_found for an unknown event. Each update carries id, event_id, update_kind, update_metadata (an object whose fields depend on update_kind), and created_at.

Diagnose an event

GET

GET /v1/radar/events/{event_id}/diagnostics

Explains whether an event reached your organization and, if it did not, why. Returns 404 event_not_found for an unknown event.

string

The event diagnosed.

object[]

One entry per check, in order. Each has id (ingested, source_enabled, detector_enabled, detector_evaluated, or vendor_matched), status (passed, failed, or not_evaluated), and completed_at.

string | null

Why the event did not reach your organization, for example source_not_subscribed or detector_did_not_alert.

string | null

What fixes it, for example add_library_source or run_detector_on_event.

object[]

Sources that fed the event and your organization may see, with name, canonical_url, library_name, and source_id (your organization’s source on it, if any).

object[]

Detectors that bear on the event, with name, library_slug, and detector_id.

integer | null

How many of your vendors the event matched.

List signals

GET

GET /v1/radar/signals

Lists your organization’s signals, most recently alerted first.

string

One of tracked, alerting, triaged, dismissed.

string

Only signals with an active alert on this vendor (cbvndr_...).

string

Text in the signal’s title or summary.

integer

Page size. Default 50, range 1-200.

integer

Page offset. Default 0.

Signal object

string

Signal ID (cbrag_...).

string

Radar event the signal covers (cbrevent_...).

string | null

Your organization’s title for the signal.

string | null

Your organization’s summary.

string

tracked, alerting, triaged, or dismissed.

string | null

Your organization’s Radar status (cbstatus_...).

string | null

That status’s label.

string | null

Highest severity among the signal’s active alerts.

integer | null

When the signal first appeared (Unix seconds).

integer | null

When a detector last alerted on it (Unix seconds).

boolean

true if archived.

integer

Unix timestamp (seconds).

integer

Unix timestamp (seconds).

Retrieve a signal

GET

GET /v1/radar/signals/{signal_id}

Returns the signal object, or 404 signal_not_found.

Set a signal’s status

PATCH

PATCH /v1/radar/signals/{signal_id}

Moves a signal to one of your organization’s Radar statuses. The signal’s alerts stay as they are. Returns the refreshed signal object.

string

required

The Radar status to move to (cbstatus_...).

Status	Code	When
400	`invalid_status`	The status is not one of your organization’s Radar statuses.
404	`signal_not_found`	Not found, or not in the API key’s org.

Dismiss signals

POST

POST /v1/radar/signals/dismiss

Dismisses each signal and every active alert on it. Each newly dismissed alert teaches its detector a negative example, and each person mentioned in reason gets a notification. A signal id that is not found is skipped.

string[]

required

Signals to dismiss (cbrag_...). At least one.

string

Dismissal reason, shared by every signal.

The response carries dismissed_signal_ids and dismissed_alert_ids.

Restore signals

POST

POST /v1/radar/signals/undismiss

Restores the dismissed alerts on each signal.

string[]

required

Signals to restore (cbrag_...). At least one.

The response carries undismissed_signal_ids and undismissed_alert_ids. A signal with no dismissed alert is left out of undismissed_signal_ids.

Acknowledge a signal

POST

POST /v1/radar/signals/{signal_id}/acknowledge

Records that a signal’s alerts are real and relevant. The signal keeps its status, and each detector learns that its alert was right. Coverbase then proposes a residual-risk change for the affected vendors, which you decide with POST /v1/radar/signals/risk-impact-decision.

string[]

Alerts on this signal to acknowledge (cbrdrres_...). Omit to acknowledge every active alert on it.

The response carries signal (the signal object), acknowledged_alert_ids, and risk_impact_proposals. Each proposal has vendor_id, alert_ids, previous_score, and delta (the proposed change in points).

Status	Code	When
404	`signal_not_found`	Not found, or not in the API key’s org.
409	`signal_dismissed`	The signal is dismissed. Restore it first.
422	`alert_not_on_signal`	An alert in `alert_ids` is not found or belongs to another signal.

Decide a risk impact

POST

POST /v1/radar/signals/risk-impact-decision

Resolves the residual-risk changes proposed on alerts. Returns 204 No Content.

string[]

required

Alerts whose proposals you are deciding (cbrdrres_...).

string

required

accept moves each vendor’s score by the proposed points. skip leaves every score as it is. manual writes the scores in manual_scores.

object[]

For manual, one object per vendor: vendor_id, overall_score (0 to 100), domain_scores (a list of risk_domain_id and score), and note.

Regenerate a signal’s summary

POST

POST /v1/radar/signals/{signal_id}/regenerate-summary

Rewrites a signal’s title and summary from its current alerts and returns {"signal": ...} with the refreshed signal object. The new text replaces any title and summary your organization edited by hand, and follows your organization’s saved summary instructions. The event the signal covers keeps its own text.

Status	Code	When
404	`signal_not_found`	Not found, or not in the API key’s org.
503	`summary_unavailable`	The summary could not be written. Try again.

List cases

GET

GET /v1/radar/cases

Lists your organization’s Radar cases, newest first.

string

open or closed.

string

Only cases covering this event (cbrevent_...).

string

Text in the case title.

boolean

Include archived cases. Default false.

integer

Page size. Default 50, range 1-200.

integer

Page offset. Default 0.

Case object

string

Case ID (cbcase_...).

string

Case title.

string | null

Case description.

string

open or closed.

string | null

How a closed case ended: resolved, false_positive, or wont_fix.

string | null

User the case is assigned to (cbuser_...).

string

User who opened the case.

string[]

Signals linked to the case.

boolean

true if archived.

integer

Unix timestamp (seconds).

integer

Unix timestamp (seconds).

Create a case

POST

POST /v1/radar/cases

Opens a case and returns 201 Created with the case object. Nothing is sent to a vendor. To track vendors on it, add threads.

string

Case title.

string

Case description.

string[]

Signals the case covers (cbrag_...).

string[]

Events the case covers (cbrevent_...). Each resolves to your organization’s signal for that event, which Coverbase creates when there is none.

Returns 400 invalid_case_link when a signal or event is not found.

Retrieve a case

GET

GET /v1/radar/cases/{case_id}

Returns the case object, or 404 case_not_found.

Update a case

PATCH

PATCH /v1/radar/cases/{case_id}

Changes the fields you send and returns the refreshed case object. To close a case, send status: "closed" with a resolution. A resolved or wont_fix resolution raises the residual risk of the case’s vendors, and false_positive does not. Reopening with status: "open" clears the resolution.

string

New title.

string | null

New description. Send null to clear it.

string

open or closed.

string

resolved, false_positive, or wont_fix.

string | null

User to assign (cbuser_...). Send null to unassign.

Status	Code	When
404	`case_not_found`	Not found, or not in the API key’s org.
422	`case_archived`	The case is archived.

Link signals to a case

POST

POST /v1/radar/cases/{case_id}/signals

Links signals to a case and returns the refreshed case object. Signals already on the case are left alone.

string[]

required

Signals to link (cbrag_...). At least one.

Returns 404 case_not_found, or 400 invalid_case_link when a signal is not found.

Unlink a signal from a case

DELETE

DELETE /v1/radar/cases/{case_id}/signals/{signal_id}

Removes one signal from a case and returns the refreshed case object. The case’s threads stay. Returns 404 signal_not_linked when the signal is not on the case.

Draft a case description

POST

POST /v1/radar/cases/{case_id}/description-suggestion

Drafts a description from every signal linked to the case and returns it as {"description": "..."}. Nothing is saved. To keep the draft, send it as description to PATCH /v1/radar/cases/{case_id}. This route needs radar_alert:update:org.

Status	Code	When
404	`case_not_found`	Not found, or not in the API key’s org.
422	`case_has_no_signals`	No signal is linked to the case.
502	`description_unavailable`	A draft could not be written. Try again.

List a case’s threads

GET

GET /v1/radar/cases/{case_id}/threads

Lists the vendor threads on a case. Pass include_archived=true to include archived threads. Pages with limit (default 50, range 1-200) and offset.

Case thread object

string

Case thread ID (cbcseth_...).

string

Case the thread belongs to.

string

Vendor the thread tracks (cbvndr_...).

string[]

Alerts the thread tracks.

string

open, email_sent, response_received, in_review, assessment_triggered, on_hold, or closed.

string

Thread title.

string | null

Thread description.

string | null

User the thread is assigned to.

string | null

Vendor portal tied to the thread.

string | null

Assessment tied to the thread.

string | null

Finding tied to the thread.

integer | null

Due date (Unix seconds).

integer | null

When the next automatic follow-up email goes out, if one is scheduled.

boolean

true if archived.

integer

Unix timestamp (seconds).

integer

Unix timestamp (seconds).

Add a vendor to a case

POST

POST /v1/radar/cases/{case_id}/threads

Adds one vendor to a case as a thread and returns 201 Created. The vendor’s owners and analysts, and the default reviewers of the alerts’ detectors, get an in-app notification. Nothing is sent to the vendor.

string

required

Vendor to add (cbvndr_...).

string[]

Alerts on that vendor for the thread to track.

string

Thread title.

string

Thread description.

integer

Due date (Unix seconds).

The response carries thread (the case thread object) and risk_impact_proposals, the residual-risk changes proposed for the thread’s alerts.

Status	Code	When
404	`case_not_found`	The case is not found.
404	`thread_target_not_found`	The vendor or an alert is not found.
422	`case_archived`	The case is archived.
422	`alert_vendor_mismatch`	An alert is on another vendor.

Add vendors to a case in bulk

POST

POST /v1/radar/cases/{case_id}/threads/bulk

Adds up to 1,000 vendors to a case, one thread each, and returns 201 Created. A vendor already on the case is skipped. Each person who watches the new vendors gets one in-app notification that names them. Nothing is sent to the vendors.

object[]

required

One object per vendor, with the same fields as adding a vendor to a case.

The response carries items (the new case thread objects), skipped_vendor_ids, and risk_impact_proposals. Errors match adding a vendor to a case.

Retrieve a case thread

GET

GET /v1/radar/cases/{case_id}/threads/{thread_id}

Returns the case thread object, or 404 case_thread_not_found when the thread is not on this case.

Update a case thread

PATCH

PATCH /v1/radar/cases/{case_id}/threads/{thread_id}

Changes the fields you send and returns the refreshed case thread object. Setting status to email_sent records that you emailed the vendor, but sends nothing. Any other status stops the thread’s automatic follow-up emails.

string

New title.

string | null

New description. Send null to clear it.

string

open, email_sent, response_received, in_review, assessment_triggered, on_hold, or closed.

string | null

User to assign. Send null to unassign.

string | null

Vendor portal to tie to the thread. Send null to clear it.

string | null

Assessment to tie to the thread. Send null to clear it.

string | null

Finding to tie to the thread. Send null to clear it.

integer | null

Due date (Unix seconds). Send null to clear it.

Status	Code	When
404	`case_not_found`	The case is not found.
404	`case_thread_not_found`	The thread is not on this case.
422	`case_archived`	The case is archived.
422	`invalid_thread_link`	The assessment or finding is not found.

Pause a thread’s follow-ups

POST

POST /v1/radar/cases/{case_id}/threads/{thread_id}/pause-follow-ups

Stops the automatic follow-up emails on a thread. The thread’s status and fields stay as they are. Returns the refreshed case thread object, or 404 case_thread_not_found.

List detectors

GET

GET /v1/radar/detectors

Lists your organization’s detectors: what an event can be scored against. Filter with enabled (boolean) and include_archived (default false); pages with limit (default 50, range 1-200) and offset. Each detector carries id (cbrdrdet_...), name, description, enabled, category_filters (the impact categories it matches), source_ids (the sources it is limited to), applies_to_all_vendors, included_vendor_ids, excluded_vendor_ids, severity_threshold, is_archived, created_at, and updated_at.

List sources

GET

GET /v1/radar/sources

Lists your organization’s Radar sources. Pages with limit (default 50, range 1-200) and offset; pass include_archived=true to include archived sources. Each source carries id (cbradarsrc_...), name, is_archived, created_at, and is_manual_events, which is true on the source that events created through this API land on. Add that source to a source-limited detector if you want it to evaluate API events.

Source object

GET /v1/radar/sources/{source_id} and the source write routes return the fields of a listed source plus these:

Field	Description
`origin_id`	The origin the source reads.
`origin_canonical_url`	The URL Radar pulls.
`is_shared_origin`	`true` when the origin comes from the Coverbase source library. Coverbase pulls a shared origin once for every subscriber.
`source_type`	How Radar reads the origin, for example `rss_feed`, `api`, `snapshot`, or `null` for a page that still needs an extractor.
`canonical_rss_feed_url`	The feed a website source reads, or `null`.
`cb_vendor_metadata`	The metadata object you stored on the source.
`last_pulled_at`	When Radar last pulled the origin successfully.
`pull_requested_at`	When someone last asked for an on-demand pull.

Create a source

POST

POST /v1/radar/sources

Returns 201 Created with the source object. To have Radar watch a website, send its URL. Radar looks for an RSS feed on the site unless you name one.

string

required

The website, page, or API URL to watch.

string

required

Display name.

boolean

Default true: the origin belongs to your organization. Send false to subscribe to the shared library origin for this URL.

string

One of generic_website, vendor_website, websearch, api, webhook, or snapshot.

string

The site’s RSS feed. Not allowed on an API source.

object

Free-form metadata stored on the source.

object

Required for an API source. Fields: method (GET or POST), query_params, headers, body, items_path, id_path, updated_at_path, title_path, content_path, summary_path, published_at_path, source_url_path, canonical_id_path, and metadata_map. Values in query_params, headers, and body can use vendor placeholders.

object

Required for a snapshot source. Fields: preprocessor (type is generic_snapshot or snapshot_list_json), interval_seconds, retention (keep_versions, keep_days), query_params, and headers.

Status	Code	When
403	`shared_origin_not_allowed`	`private` is `false` on an API source whose shared origin does not exist. Only Coverbase creates shared origins.
409	`source_exists`	Your organization already has a live source for this origin.
422	`invalid_source`	The URL, the API settings, or the snapshot settings are invalid.

Retrieve a source

GET

GET /v1/radar/sources/{source_id}

Returns the source object, or 404 source_not_found.

Update a source

PATCH

PATCH /v1/radar/sources/{source_id}

Changes the fields you send and returns the source object. If you edit the API settings of a shared origin, your organization gets a private copy, and other subscribers keep the library version.

string

New display name.

boolean

Archive or restore the source. API keys get 403 api_key_not_allowed.

object

Replacement metadata.

object

The API settings to change. Fields you leave out keep their value, and null clears one.

object

The snapshot settings to change, with the fields of the create request. Send retention: null to keep every capture.

string | null

Point a website source at this feed. Send null to read the page itself.

Status	Code	When
403	`api_key_not_allowed`	An API key sent `is_archived`.
404	`source_not_found`	Not found, or not in the API key’s org.
400, 422	`invalid_source_update`	The source cannot take the change, or it collides with another of your sources.

Pull a source now

POST

POST /v1/radar/sources/{source_id}/pull

Returns 202 Accepted with source_id and pull_requested_at. Radar pulls the origin on its next scheduler run.

Status	Code	When
403	`shared_origin_not_allowed`	The source reads a shared origin. Coverbase pulls those for every subscriber.
404	`source_not_found`	Not found, or not in the API key’s org.
409	`pull_in_flight`	A run for this origin is already in progress.

List source libraries

GET

GET /v1/radar/source-library

Lists the Coverbase source libraries: curated sets of shared origins. Each item has id, name, description, and origin_ids. To subscribe to an origin, create a source for its URL with private: false. Pages with limit and offset; pass include_archived=true to include archived libraries.

Retrieve a source library

GET

GET /v1/radar/source-library/{library_id}

Returns one library, or 404 source_library_not_found.

List origins

GET

GET /v1/radar/origins

Lists the origins your organization can see. Each item has id, canonical_url, is_shared, is_enabled, and last_pulled_at. Pass private_only=true to leave out shared origins. Pages with limit and offset.

Retrieve Black Kite settings

GET

GET /v1/radar/black-kite

Returns integration_configured, the source_id of your Black Kite portfolio monitor (or null), and its config.

Save Black Kite settings

PUT

PUT /v1/radar/black-kite

Creates or replaces your Black Kite portfolio monitor and returns the same body as the read. Every save replaces all settings, so send the full set. Connect the Black Kite integration first, or the request returns 422 integration_not_configured.

string

Source display name.

number | null

Default 0.5. Radar looks closer at companies whose Ransomware Susceptibility Index is above this value, from 0 to 1. Send null to turn this check off.

boolean

Default true. Ingest known exploited vulnerability findings.

boolean

Default true. Ingest focus tag findings.

string[]

Focus tags that qualify a company.

string[]

Cyber rating grades that qualify a company.

object | null

A filter rule group that limits which vendors count.

integer

Default 250, range 1 to 5000.

integer

Default 50, range 1 to 500.

Detector object

GET /v1/radar/detectors/{detector_id} and the detector write routes return the fields of a listed detector plus instructions, detector_type, detector_config, library_slug, default_reviewer_user_ids, default_reviewer_group_ids, vendor_tag_filters, risk_domain_ids, risk_impact_config, and outreach_config.

Create a detector

POST

POST /v1/radar/detectors

Returns 201 Created with the detector object. A standard detector needs instructions or a severity_threshold.

string

required

Detector name.

string

What the detector should alert on, in plain language.

string

Description for your team.

string

standard (default), watchlist, black_kite, or risk_rating. A risk_rating detector needs the engagement record feature.

object

Settings for the type. Its detector_type must match.

boolean

Default false.

boolean

Default false. Monitor every vendor.

string[]

Sources the detector reads. Empty means every source.

string

The detector library template this detector comes from.

boolean

With library_slug, also subscribe your organization to the template’s library sources. This needs radar_detector:update:org.

string[]

Impact categories the detector considers, from the list on create a radar event.

string

high, medium, low, or informational.

string[]

Users notified of each alert.

string[]

Groups notified of each alert.

string[][]

Tag groups. A vendor matches when it has every tag in any one group.

string[]

Vendors the detector always monitors.

string[]

Vendors the detector never monitors.

string[]

Risk domains the detector maps to.

object

How a confirmed alert raises residual risk: enabled, min_score_impact, max_score_impact, and affect_overall.

Status	Code	When
400	`invalid_detector`	The settings do not fit the detector type.
422	validation error	Neither `instructions` nor `severity_threshold` was sent for a standard detector.

Retrieve a detector

GET

GET /v1/radar/detectors/{detector_id}

Returns the detector object, or 404 detector_not_found.

Update a detector

PATCH

PATCH /v1/radar/detectors/{detector_id}

Changes the fields you send and returns the detector object. It takes the create fields except library_slug and attach_library_sources, plus these:

string[]

Users to add as reviewers, keeping the current ones.

string[]

Groups to add as reviewers, keeping the current ones.

string

Also accepts NO_THRESHOLD, which needs instructions.

object | null

Send null to remove it.

object | null

When Coverbase AI may email vendors about this detector’s alerts: enabled, min_severity, vendor_tiers, and follow_up_days. Send null to turn outreach off. It applies only where vendor outreach is available.

boolean

Archive or restore the detector. API keys get 403 api_key_not_allowed.

List a vendor’s detectors

GET

GET /v1/radar/vendors/{vendor_id}/detectors

Lists the detectors that monitor one vendor, by their tag, include, and exclude rules, with the fields of a listed detector. Pass include_disabled=true to also list detectors that are off. Pages with limit and offset. Returns 404 vendor_not_found for an unknown vendor.

Suggest risk domains

POST

POST /v1/radar/detectors/suggest-risk-domains

Returns risk_domain_ids: your organization’s risk domains that match a detector configuration. Nothing is saved. To use them, send them as risk_domain_ids when you create or update the detector. The body takes name (required), description, instructions, and category_filters.

Suggest instructions

POST

POST /v1/radar/detectors/{detector_id}/suggest-instructions

Drafts new instructions from the detector’s examples and returns current_instructions, suggested_instructions, and rationale. Nothing is saved. suggested_instructions is null when the detector has no examples yet. To use the draft, send it as instructions in update a detector.

Back-test a detector

POST

POST /v1/radar/detectors/{detector_id}/tests

Returns 202 Accepted with a test_run_id. Radar runs the detector against the events created between created_at_from and created_at_to (Unix seconds) in the background, up to max_events (default 50, range 1 to 200). A back-test creates no alerts.

Read back-test results

GET

GET /v1/radar/detectors/{detector_id}/tests/{test_run_id}

Returns is_complete and the items found so far. Each item has id, vendor_id, event_id, event_created_at, should_alert, severity, summary, already_alerted, and created_at. already_alerted is true when the detector already raised an alert for that vendor and event.

Create alerts from a back-test

POST

POST /v1/radar/detectors/{detector_id}/tests/{test_run_id}/alerts

Turns the results in result_ids into real alerts and notifies the detector’s default reviewers. Returns alert_ids and skipped_already_alerted, the number of results skipped because the detector already alerted on them. A result from another detector or run returns 400 result_not_in_test_run.

Teach a detector from a back-test

POST

POST /v1/radar/detectors/{detector_id}/tests/{test_run_id}/teach

Adds the event of each result in should_alert_result_ids as a positive example, and each in should_not_alert_result_ids as a negative one. Labelling an event again moves it to the other side. Returns applied_count, positive_example_count, and negative_example_count. A result from another detector or run returns 400 result_not_in_test_run.

Dismissal example object

An example is an event a detector should (positive) or should not (negative) alert on. It has id, detector_id, kind, event_id, alert_id, example_summary, reason, dismiss_code, created_at, and updated_at. Coverbase classifies the reason on a new negative example and fills in dismiss_code.

List a detector’s examples

GET

GET /v1/radar/detectors/{detector_id}/dismissal-examples

Lists the detector’s examples, newest first. Filter with kind (negative or positive); pages with limit and offset.

Add an example

POST

POST /v1/radar/detectors/{detector_id}/dismissal-examples

Returns 201 Created with the example. The body takes event_id and example_summary (both required), kind (default negative), reason, and alert_id. An event your organization cannot see returns 404 event_not_found.

Update an example

PATCH

PATCH /v1/radar/dismissal-examples/{example_id}

Replaces the example’s reason and returns the example. Send null to clear it. Returns 404 dismissal_example_not_found for an unknown example.

Delete an example

DELETE

DELETE /v1/radar/dismissal-examples/{example_id}

Returns 204 No Content. API keys get 403 api_key_not_allowed, so a signed-in user must delete examples.

Write an alert by hand

POST

POST /v1/radar/alerts

Returns 201 Created with the alert. Use it to record a detector’s verdict on one radar data item for one vendor yourself. Send vendor_id, source_id, detector_id, radar_data_id, summary and reasoning, plus should_alert (default true), severity and confidence (default medium). Set notify_default_reviewers to email the detector’s default reviewers. Radar signs the alert the way the detector signs its own, so a later run finds it instead of adding a duplicate. An unknown detector or data item returns 404 not_found, and a result that changed since you read it returns 409 result_conflict.

Read an event’s data items

GET

GET /v1/radar/events/{event_id}/data-items

Lists the raw items behind the event, each with data, association_type, confidence, created_by and origin_type. Items from sources your organization does not read are left out but still count in total. Pages with limit and offset; include_archived adds unlinked items. An unknown event returns 404 event_not_found.

Read an event’s time to signal

GET

GET /v1/radar/events/{event_id}/time-to-signal

Returns time_to_signal with when the event happened (temporal_start), was first published, and alerted your organization, plus the lag between each. time_to_signal is null when the event never became a signal for your organization.

List an event’s exposed vendors

GET

GET /v1/radar/events/{event_id}/exposure-vendors

Lists your vendors the event exposes, directly or through their suppliers, including vendors that did not alert. Each row has the vendor’s risk, exposure_level, alerted, any bill of materials match, and internal incidents with a relevance judgment. Set include_prior_exposure=true to also scan each vendor’s alerts on other events over the last year.

Run a detector on an event

POST

POST /v1/radar/events/{event_id}/detector-runs

Returns 202 Accepted with a test_run_id. Radar back-tests the enabled detector in detector_id against this one event. Read the results at read back-test results. An event you cannot see or a disabled detector returns 422 detector_not_runnable.

List a signal’s alerts

GET

GET /v1/radar/signals/{signal_id}/alerts

Lists the signal’s active alerts, the set that acknowledging or dismissing the signal acts on. Each is an alert with is_acknowledged.

Read a vendor’s stories

GET

GET /v1/radar/vendors/{vendor_id}/stories

Lists the Radar stories that reached the vendor in the last year, most recent first. A story is one event, or several events Radar Ops filed together, with its milestones and the suppliers it came through. GET /v1/radar/vendors/{vendor_id}/stories/{event_id} returns the story that holds one event, with the sources behind it. An unknown vendor returns 404 vendor_not_found, and an event in no story returns 404 story_not_found.

Read radar data

GET

GET /v1/radar/data

Lists the raw items Radar pulled (articles, advisories, API records), each under a source your organization reads. Give at least one filter: source_id, data_id (both repeatable), search, category (repeatable), or require_event=true. Otherwise you get 400 filter_required. Pages with limit and offset. A source you do not have returns 404 source_not_found. GET /v1/radar/data/{data_id} returns one item, GET /v1/radar/data/{data_id}/content returns its stored text, and GET /v1/radar/data/{data_id}/event returns the newest event it belongs to, or null. GET /v1/radar/data/categories lists the impact categories with a description of each. The storage location of an item is never returned.

Read radar runs

GET

GET /v1/radar/runs

Lists Radar pull runs, newest first, with their status and the sources and origins each read. Filter with start_ts and end_ts (Unix seconds) and origin_id. Metrics count only the sources or origins you name with source_id or origin_id. GET /v1/radar/runs/{run_id} returns one run with its log entries. A start after the end returns 400 invalid_window, and an unknown run 404 run_not_found.

Read a source’s snapshot

GET

GET /v1/radar/sources/{source_id}/snapshot

Returns what Radar last captured at a snapshot source and what changed since the capture before it. A page capture carries the text and a line diff; a list capture carries entries and an entry_delta. Pass observation_id to read a past capture. raw_artifact_url downloads the raw capture and expires in five minutes, so the response is never cached. unsupported is true for a source that does not capture snapshots. GET /v1/radar/sources/{source_id}/snapshot/page returns the captured page as html stripped to markup that is safe to show in a sandboxed frame, or an unavailable_reason. A capture that cannot be read returns 502 snapshot_unavailable.

Test a source

POST

POST /v1/radar/sources/{source_id}/test

Calls an API source’s endpoint once with its saved settings and returns what came back: status is success with a payload preview and the first mapped items, or error with an error_code. Send vendor_id when the request reads vendor fields. Nothing is stored.

Review a generated extractor

GET

GET /v1/radar/sources/{source_id}/extractor

Returns the latest extractor generation for a source that reads a web page: its status, why it stopped, and the proposed_config. run is null before the first one. You start a generation from the source’s page in Coverbase. POST /v1/radar/sources/{source_id}/extractor/accept adopts the proposed extractor, and Radar reads the page with it from the next pull. A source that reads an RSS feed returns 422 source_reads_rss_feed, and a run with no proposal yet returns 409 no_proposed_extractor. An API key gets 403 api_key_not_allowed. POST /v1/radar/sources/{source_id}/extractor/reject sends Coverbase your message about what the extractor gets wrong and returns 204 No Content. The source keeps its settings.

List detector library sources

GET

GET /v1/radar/detector-library/sources

Lists each detector library template with the library sources it deploys with, and the source_id your organization already has for each, or null.

Link a vendor to Black Kite

PUT

PUT /v1/radar/vendors/{vendor_id}/black-kite/domains

Replaces the Black Kite domains you maintain for a vendor with domains (up to 50). A domain you leave out is removed. Domains a scan learned are kept apart in company_domains. Returns the vendor’s match, including in_monitoring_scope. POST /v1/radar/vendors/{vendor_id}/black-kite/scan looks the vendor up in Black Kite now and ingests what it finds. Findings reach alerts only through your detectors. It returns matched, findings_ingested and requests_spent. A second scan within a minute returns 429 scan_too_soon, and an organization without Black Kite returns 422 black_kite_not_configured.

Export a case

GET

GET /v1/radar/cases/{case_id}/export

Builds a zip with the case workbook and one workbook for each questionnaire the case sent a vendor. Returns download_url, file_name and expires_in. Follow the link with a plain GET; it expires after an hour.

Fill case contacts

POST

POST /v1/radar/cases/{case_id}/threads/source-contacts

Fills every case thread that has no contacts, from the vendor’s other case threads, its vendor record, or a public security email, then starts a background web search at the vendor’s own domain for the rest. It sends nothing. Returns how many threads each step filled. Poll GET /v1/radar/cases/{case_id}/contact-search for the search’s searching, found, not_found and failed counts. An archived case returns 422 case_archived, and a search already running returns 409 contact_search_running.

Email a vendor from a case

POST

POST /v1/radar/cases/{case_id}/threads/{thread_id}/emails

This contacts the vendor. Returns 202 Accepted with the email_id. Send subject, a plain text text_body, and to_addresses, with optional cc_emails and bcc_emails (each { "email": "...", "name": "..." }). Coverbase adds the thread’s open portal link, queues the email, and marks the thread as emailed. An archived case returns 422 case_archived.

Replay a detector

POST

POST /v1/radar/detector-replays

Coverbase staff only. Returns 201 Created. Radar samples the detector’s past results (max_items, lookback_days) and replays them with its current instructions and the proposed instructions, without changing the detector. GET /v1/radar/detector-replays lists replays (filter with detector_id), and GET /v1/radar/detector-replays/{replay_id} returns one with its scores and items.

Purge the alert queue

POST

POST /v1/radar/alert-purges

Coverbase staff only, and never an API key. A purge archives every open, untriaged alert created between created_after and created_before (Unix seconds), and the signals it leaves empty. Detectors, sources and events are not touched. Preview the window first with POST /v1/radar/alert-purges/preview, which clears nothing and returns alert_count, signal_count and the resolved_created_before to send. One run clears at most 50,000 alerts. A window with no open alerts or over the limit returns 422 purge_rejected, and a purge already running returns 409 purge_running. Follow a purge with GET /v1/radar/alert-purges/{purge_id}, list recent ones with GET /v1/radar/alert-purges, and stop one with POST /v1/radar/alert-purges/{purge_id}/cancel. Alerts it already archived stay archived.

Reassessments API: escalate an alert/event into a batch of vendor reassessments.
Webhooks: subscribe to RadarEvent.* and RadarDetectorResult.* events.

⌘I

​Create a radar event

​Request body

​Detector evaluation

​Example request

​Radar event object

​List radar events

​Query parameters

​Retrieve a radar event

​List an event’s alerts

​List radar alerts

​Query parameters

​Example response

​Radar alert object

​Retrieve a radar alert

​Dismiss a radar alert

​Request body

​Example request

​Restore a dismissed alert

​Update a radar alert

​Set a dismissal reason

​Update a radar event

​List an event’s updates

​Diagnose an event

​List signals

​Signal object

​Retrieve a signal

​Set a signal’s status

​Dismiss signals

​Restore signals

​Acknowledge a signal

​Decide a risk impact

​Regenerate a signal’s summary

​List cases

​Case object

​Create a case

​Retrieve a case

​Update a case

​Link signals to a case

​Unlink a signal from a case

​Draft a case description

​List a case’s threads

​Case thread object

​Add a vendor to a case

​Add vendors to a case in bulk

​Retrieve a case thread

​Update a case thread

​Pause a thread’s follow-ups

​List detectors

​List sources

​Source object

​Create a source

​Retrieve a source

​Update a source

​Pull a source now

​List source libraries

​Retrieve a source library

​List origins

​Retrieve Black Kite settings

​Save Black Kite settings

​Detector object

​Create a detector

​Retrieve a detector

​Update a detector

​List a vendor’s detectors

​Suggest risk domains

​Suggest instructions

​Back-test a detector

​Read back-test results

​Create alerts from a back-test

​Teach a detector from a back-test

​Dismissal example object

​List a detector’s examples

​Add an example

​Update an example

​Delete an example

​Write an alert by hand

​Read an event’s data items

​Read an event’s time to signal

​List an event’s exposed vendors

​Run a detector on an event

Create a radar event

Request body

Detector evaluation

Example request

Radar event object

List radar events

Query parameters

Retrieve a radar event

List an event’s alerts

List radar alerts

Query parameters

Example response

Radar alert object

Retrieve a radar alert

Dismiss a radar alert

Request body

Example request

Restore a dismissed alert

Update a radar alert

Set a dismissal reason

Update a radar event

List an event’s updates

Diagnose an event

List signals

Signal object

Retrieve a signal

Set a signal’s status

Dismiss signals

Restore signals

Acknowledge a signal

Decide a risk impact

Regenerate a signal’s summary

List cases

Case object

Create a case

Retrieve a case

Update a case

Link signals to a case

Unlink a signal from a case

Draft a case description

List a case’s threads

Case thread object

Add a vendor to a case

Add vendors to a case in bulk

Retrieve a case thread

Update a case thread

Pause a thread’s follow-ups

List detectors

List sources

Source object

Create a source

Retrieve a source

Update a source

Pull a source now

List source libraries

Retrieve a source library

List origins

Retrieve Black Kite settings

Save Black Kite settings

Detector object

Create a detector

Retrieve a detector

Update a detector

List a vendor’s detectors

Suggest risk domains

Suggest instructions

Back-test a detector

Read back-test results

Create alerts from a back-test

Teach a detector from a back-test

Dismissal example object

List a detector’s examples

Add an example

Update an example

Delete an example

Write an alert by hand

Read an event’s data items

Read an event’s time to signal

List an event’s exposed vendors

Run a detector on an event