Radar API

Radar is Coverbase’s continuous third-party monitoring surface. Two object types are exposed here:

A radar event (cbrevent_...) records something that happened to one or more vendors and groups the source data behind it (news, advisories, breach disclosures).
A radar alert (cbrdrres_...) is one detector’s verdict that a piece of source data is relevant to one vendor. Alerts are what you triage here: dismiss the noise, or escalate into a reassessment.

The dashboard rolls an event’s alerts up into a signal: one row per event carrying your organization’s status, title, and summary. Signals are not addressable through the API. Read the event for what happened, and the alerts for which detector flagged which vendor. See the Supplier Radar key concepts. All endpoints are org-scoped to the API key. See API conventions for shared behavior, including pagination.

Method	Path
`GET`	`/v1/radar/events`
`POST`	`/v1/radar/events`
`GET`	`/v1/radar/events/{event_id}`
`GET`	`/v1/radar/alerts`
`GET`	`/v1/radar/alerts/{alert_id}`
`POST`	`/v1/radar/alerts/{alert_id}/dismiss`
`POST`	`/v1/radar/alerts/{alert_id}/undismiss`

None of these honor Idempotency-Key.

Create a radar event

POST

POST /v1/radar/events

Returns 201 Created. Use this to seed an event into Radar without waiting for a source feed to pick up the underlying article; useful for recording out-of-band incidents and for exercising your detectors against a known event. Supplied vendors are linked to the event as primary-impacted, and the event is evaluated against your detectors unless you opt out (see detector evaluation).

Request body

string

required

Short event name.

string

required

Event summary / description.

string

required

Primary impact category. Case-sensitive; one of Infosec, Financial, Operational, Legal, Compliance, Reputational, Contractual, ESG, Corporate, Geopolitical & External, Inapplicable, Other.

string[]

Additional impact categories, from the same list as primary_impact_type. A value outside it is rejected with 422. These categories decide which category-filtered detectors can match the event.

string[]

Vendors directly impacted (cbvndr_...). Each is linked as primary-impacted. Vendors that cannot be resolved are skipped silently.

string[]

Risk domains to record on the event (cbrskdmn_...), returned on the radar event object. An id your org does not have is rejected with 400 risk_domain_not_found.

string

URL of the underlying article / report.

string

Name of the source.

integer

When the event occurred (Unix seconds). Defaults to now when omitted.

boolean

Evaluate the event against the detectors that target each linked vendor, raising radar alerts for the ones that fire. Default true. Pass false to record an event without spending a model call per (detector, vendor).

Detector evaluation

The scheduled Radar pipeline is source-driven: it evaluates what its configured sources pull in, and never sees an event created through this endpoint. Events posted here are therefore evaluated out of band, which happens by default. Pass create_alert: false to store one without evaluating it. Evaluation is asynchronous: the response returns as soon as the event is stored, and alerts appear on GET /v1/radar/alerts once the detectors finish, each carrying this event’s event_id. What runs against the event:

Vendors. The vendors in vendor_ids that resolve within your org, plus the vendors that depend on them: a breach at a supplier is evaluated against the customers exposed to it, the same expansion the scheduled pipeline performs, and through the same caps. An event with no resolvable vendor is stored but never evaluated.
Detectors. Only the ones that already target each of those vendors, including the detector’s source scoping: a detector limited to specific sources sees this event only if it includes the org’s Manually-created events source. Detectors with an impact-category filter are matched against the event’s own primary_impact_type and secondary_impact_types.
Cost. One model call per (detector, vendor) pair, counting the vendors reached by expansion. Pass create_alert: false on events you only want recorded.

Re-posting the same event is safe: each (event, vendor, detector) combination is evaluated once, so retries do not duplicate alerts or re-notify reviewers.

Example request

cURL

curl -X POST "https://api.coverbase.app/v1/radar/events" \
  -H "Authorization: Bearer ak_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme data breach",
    "summary": "Acme disclosed unauthorized access to a customer database.",
    "primary_impact_type": "Infosec",
    "vendor_ids": ["cbvndr_e448ba62882143f3ba0c140bb2e30162"],
    "source_url": "https://news.example.com/acme-breach",
    "source_name": "Example News",
    "create_alert": true
  }'

Returns the radar event object.

Radar event object

string

Radar event ID (cbrevent_...).

string | null

Event name.

string

Event summary.

string

Primary impact category.

string[]

Additional impact categories.

string[]

Risk domains recorded on the event.

integer | null

When the event occurred (Unix seconds).

boolean

true if archived.

integer

Unix timestamp (seconds).

integer

Unix timestamp (seconds).

List radar events

GET

GET /v1/radar/events

Query parameters

string

Filter by primary impact category.

boolean

Include archived events. Default false.

integer

Page size. Default 50, range 1-200.

integer

Page offset. Default 0.

The list envelope adds total, limit, and offset. See pagination.

Retrieve a radar event

GET

GET /v1/radar/events/{event_id}

Returns the radar event object, or 404 radar_event_not_found.

List radar alerts

GET

GET /v1/radar/alerts

Query parameters

string

Filter to alerts on a vendor (cbvndr_...).

string[]

Filter by severity, one of informational, low, medium, high. Repeat the param for multiple values: severity=high&severity=medium.

boolean

Dismissal filter. Omit to hide dismissed alerts (default); true for only dismissed; false for only active.

boolean

Include archived alerts. Default false.

integer

Page size. Default 50, range 1-200.

integer

Page offset. Default 0.

Example response

{
  "items": [
    {
      "id": "cbrdrres_9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d",
      "vendor_id": "cbvndr_e448ba62882143f3ba0c140bb2e30162",
      "detector_id": "cbrdrdet_2d5e8f1a4b7c0d3e6f9a2b5c8d1e4f7a",
      "source_id": "cbradarsrc_1111111111111111111111111111aaaa",
      "data_id": "cbradardata_2222222222222222222222222222bbbb",
      "event_id": "cbrevent_3333333333333333333333333333cccc",
      "summary": "Acme disclosed a data breach affecting customer records.",
      "severity": "high",
      "confidence": "high",
      "should_alert": true,
      "is_dismissed": false,
      "dismiss_reason": null,
      "dismissed_at": null,
      "is_archived": false,
      "created_at": 1746576000,
      "updated_at": 1746576400
    }
  ],
  "total": 1,
  "limit": 50,
  "offset": 0
}

Radar alert object

string

Radar alert ID (cbrdrres_...).

string

Vendor the alert is on (cbvndr_...).

string

Detector that produced the alert (cbrdrdet_...).

string

Radar source (cbradarsrc_...).

string

Underlying source data item (cbradardata_...).

string | null

Radar event the alert’s data belongs to (cbrevent_...), if any.

string

Alert summary.

string

Severity (informational, low, medium, high).

string

Detector confidence (low, medium, high).

boolean

true for a triggered alert.

boolean

true if dismissed.

string | null

Reason recorded at dismissal, if any.

integer | null

When dismissed (Unix seconds).

boolean

true if archived.

integer

Unix timestamp (seconds).

integer

Unix timestamp (seconds).

Retrieve a radar alert

GET

GET /v1/radar/alerts/{alert_id}

Returns the radar alert object, or 404 alert_not_found.

Dismiss a radar alert

POST

POST /v1/radar/alerts/{alert_id}/dismiss

Marks an alert as dismissed (triaged as not actionable). Returns the refreshed radar alert object.

Request body

string

Optional dismissal reason. Surfaced in the UI and, when suppress_similar is set, fed into the detector’s learning context.

boolean

When true, the alert is also recorded as a negative example on its detector so future runs suppress similar alerts. Default false.

Example request

cURL

curl -X POST "https://api.coverbase.app/v1/radar/alerts/cbrdrres_9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d/dismiss" \
  -H "Authorization: Bearer ak_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{ "reason": "Duplicate of an existing event", "suppress_similar": true }'

Status	Body	When
404	`{"detail": {"code": "alert_not_found", "message": "Radar alert not found."}}`	Not found, or not in the API key’s org.

Dismissing an already-dismissed alert is a no-op that returns 200 with the alert; a reason supplied on the repeat call replaces the stored one.

Restore a dismissed alert

POST

POST /v1/radar/alerts/{alert_id}/undismiss

Restores a dismissed alert to the active list. Returns the refreshed radar alert object, or 404 alert_not_found.

Reassessments API: escalate an alert/event into a batch of vendor reassessments.
Webhooks: subscribe to RadarEvent.* and RadarDetectorResult.* events.

Getting started

API reference

Data import and export

Field reference

Integration workflows

AI, agents and MCP

Create a radar event

Request body

Detector evaluation

Example request

Radar event object

List radar events

Query parameters

Retrieve a radar event

List radar alerts

Query parameters

Example response

Radar alert object

Retrieve a radar alert

Dismiss a radar alert

Request body

Example request

Restore a dismissed alert

​Create a radar event

​Request body

​Detector evaluation

​Example request

​Radar event object

​List radar events

​Query parameters

​Retrieve a radar event

​List radar alerts

​Query parameters

​Example response

​Radar alert object

​Retrieve a radar alert

​Dismiss a radar alert

​Request body

​Example request

​Restore a dismissed alert

​Related

Create a radar event

Request body

Detector evaluation

Example request

Radar event object

List radar events

Query parameters

Retrieve a radar event

List radar alerts

Query parameters

Example response

Radar alert object

Retrieve a radar alert

Dismiss a radar alert

Request body

Example request

Restore a dismissed alert

Related