Radar API

Radar is Coverbase’s continuous third-party monitoring surface. Two object types are exposed here:

A radar event (cbrevent_...) groups source data (news, advisories, breach disclosures) about something that happened to one or more vendors.
A radar alert (cbrdrres_...) is produced when a Radar detector flags a piece of source data as relevant to a vendor. Alerts are what you triage — dismiss the noise, or escalate the signal into a reassessment.

All endpoints are org-scoped to the API key. See API conventions for shared behavior, including pagination.

Method	Path
`GET`	`/v1/radar/events`
`POST`	`/v1/radar/events`
`GET`	`/v1/radar/events/{event_id}`
`GET`	`/v1/radar/alerts`
`GET`	`/v1/radar/alerts/{alert_id}`
`POST`	`/v1/radar/alerts/{alert_id}/dismiss`
`POST`	`/v1/radar/alerts/{alert_id}/undismiss`

None of these honor Idempotency-Key.

Create a radar event

POST

POST /v1/radar/events

Returns 201 Created. Use this to seed an event into Radar without waiting for a source feed to pick up the underlying article — useful for recording out-of-band incidents and for exercising your detectors against a known event. Supplied vendors are linked to the event as primary-impacted.

Request body

string

required

Short event name.

string

required

Event summary / description.

string

required

Primary impact category. Case-sensitive; one of Infosec, Financial, Operational, Legal, Compliance, Reputational, Contractual, ESG, Corporate, Geopolitical & External, Inapplicable, Other.

string[]

Additional impact categories.

string[]

Vendors directly impacted (cbvndr_...). Each is linked as primary-impacted. Vendors that cannot be resolved are skipped silently.

string[]

Risk domains to associate with the event.

string

URL of the underlying article / report.

string

Name of the source.

integer

When the event occurred (Unix seconds). Defaults to now when omitted.

Example request

cURL

curl -X POST "https://api.coverbase.app/v1/radar/events" \
  -H "Authorization: Bearer ak_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme data breach",
    "summary": "Acme disclosed unauthorized access to a customer database.",
    "primary_impact_type": "Infosec",
    "vendor_ids": ["cbvndr_e448ba62882143f3ba0c140bb2e30162"],
    "source_url": "https://news.example.com/acme-breach",
    "source_name": "Example News"
  }'

Returns the radar event object.

Radar event object

string

Radar event ID (cbrevent_...).

string | null

Event name.

string

Event summary.

string

Primary impact category.

string[]

Additional impact categories.

integer | null

When the event occurred (Unix seconds).

boolean

true if archived.

integer

Unix timestamp (seconds).

integer

Unix timestamp (seconds).

List radar events

GET

GET /v1/radar/events

Query parameters

string

Filter by primary impact category.

boolean

Include archived events. Default false.

integer

Page size. Default 50, range 1–200.

integer

Page offset. Default 0.

The list envelope adds total, limit, and offset — see pagination.

Retrieve a radar event

GET

GET /v1/radar/events/{event_id}

Returns the radar event object, or 404 radar_event_not_found.

List radar alerts

GET

GET /v1/radar/alerts

Query parameters

string

Filter to alerts on a vendor (cbvndr_...).

string[]

Filter by severity. Repeat the param for multiple values: severity=high&severity=critical.

boolean

Dismissal filter. Omit to hide dismissed alerts (default); true for only dismissed; false for only active.

boolean

Include archived alerts. Default false.

integer

Page size. Default 50, range 1–200.

integer

Page offset. Default 0.

Example response

{
  "items": [
    {
      "id": "cbrdrres_9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d",
      "vendor_id": "cbvndr_e448ba62882143f3ba0c140bb2e30162",
      "detector_id": "cbrdet_2d5e8f1a4b7c0d3e6f9a2b5c8d1e4f7a",
      "source_id": "cbrsrc_1111111111111111111111111111aaaa",
      "data_id": "cbrdata_2222222222222222222222222222bbbb",
      "event_id": "cbrevent_3333333333333333333333333333cccc",
      "summary": "Acme disclosed a data breach affecting customer records.",
      "severity": "high",
      "confidence": "high",
      "should_alert": true,
      "is_dismissed": false,
      "dismiss_reason": null,
      "dismissed_at": null,
      "is_archived": false,
      "created_at": 1746576000,
      "updated_at": 1746576400
    }
  ],
  "total": 1,
  "limit": 50,
  "offset": 0
}

Radar alert object

string

Radar alert ID (cbrdrres_...).

string

Vendor the alert is on (cbvndr_...).

string

Detector that produced the alert (cbrdet_...).

string

Radar source (cbrsrc_...).

string

Underlying source data item (cbrdata_...).

string | null

Radar event the alert’s data belongs to (cbrevent_...), if any.

string

Alert summary.

string

Severity (informational, low, medium, high).

string

Detector confidence (low, medium, high).

boolean

true for a triggered alert.

boolean

true if dismissed.

string | null

Reason recorded at dismissal, if any.

integer | null

When dismissed (Unix seconds).

boolean

true if archived.

integer

Unix timestamp (seconds).

integer

Unix timestamp (seconds).

Retrieve a radar alert

GET

GET /v1/radar/alerts/{alert_id}

Returns the radar alert object, or 404 alert_not_found.

Dismiss a radar alert

POST

POST /v1/radar/alerts/{alert_id}/dismiss

Marks an alert as dismissed (triaged as not actionable). Returns the refreshed radar alert object.

Request body

string

Optional dismissal reason. Surfaced in the UI and, when suppress_similar is set, fed into the detector’s learning context.

boolean

When true, the alert is also recorded as a negative example on its detector so future runs suppress similar alerts. Default false.

Example request

cURL

curl -X POST "https://api.coverbase.app/v1/radar/alerts/cbrdrres_9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d/dismiss" \
  -H "Authorization: Bearer ak_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{ "reason": "Duplicate of an existing event", "suppress_similar": true }'

Status	Body	When
404	`{"detail": {"code": "alert_not_found", "message": "Radar alert not found."}}`	Not found, not in the API key’s org, or already dismissed.

Restore a dismissed alert

POST

POST /v1/radar/alerts/{alert_id}/undismiss

Restores a dismissed alert to the active list. Returns the refreshed radar alert object, or 404 alert_not_found.

Reassessments API — escalate an alert/event into a batch of vendor reassessments.
Webhooks — subscribe to RadarEvent.* and RadarDetectorResult.* events.

Getting started

Products

Control Set library

Trust & security

API Reference

Data Import & Export

Integration Workflows

AI, Agents, MCP

Create a radar event

Request body

Example request

Radar event object

List radar events

Query parameters

Retrieve a radar event

List radar alerts

Query parameters

Example response

Radar alert object

Retrieve a radar alert

Dismiss a radar alert

Request body

Example request

Restore a dismissed alert

​Create a radar event

​Request body

​Example request

​Radar event object

​List radar events

​Query parameters

​Retrieve a radar event

​List radar alerts

​Query parameters

​Example response

​Radar alert object

​Retrieve a radar alert

​Dismiss a radar alert

​Request body

​Example request

​Restore a dismissed alert

​Related

Create a radar event

Request body

Example request

Radar event object

List radar events

Query parameters

Retrieve a radar event

List radar alerts

Query parameters

Example response

Radar alert object

Retrieve a radar alert

Dismiss a radar alert

Request body

Example request

Restore a dismissed alert

Related