Get Blocked Threats by First-Report Source
Count distinct currently blocked assets whose earliest report for the organization falls in the date range, split into customer vs ChainPatrol (staff + automation). Blocked is current status or pending BLOCKED, not blockedAt. This does not equal /metrics/found.
Overview
Count the distinct currently blocked assets whose earliest report for your organization falls in a date range, split by who reported them first: your team (customer) or
ChainPatrol (chainpatrol). Use this endpoint to see how many blocked threats were
discovered proactively by ChainPatrol versus submitted by your own team and community.
threat-discovery-source-api feature flag on a
per-organization basis. If the flag is not enabled for your organization, the API
returns a 403 Forbidden error. Contact ChainPatrol to enable access.How assets are counted
- First-report cohort — Each asset is attributed to the source of its earliest non-deleted report for your organization. The date range filters on when that first report was created, not on when the asset was blocked.
- Blocked only — Only assets whose current status (or pending status) is
BLOCKEDare counted. Assets that were reported in the range but never blocked, or later unblocked, are excluded. - Source buckets:
customer— assets first reported by your team, an external reporter, or a customer-role user.chainpatrol— assets first reported by ChainPatrol staff or automation. Staff and automation are collapsed into a single bucket.totals—customer+chainpatrol.
Date handling
startDateandendDateare required, andstartDatemust be on or beforeendDate.- Date-only values (
YYYY-MM-DD) are interpreted in UTC.startDatebegins at midnight UTC andendDatecovers the whole day (through 23:59:59.999 UTC). Pass a full ISO 8601 timestamp for a precise cut-off. - Impossible calendar dates (for example
2026-02-31) are rejected with a 400 error instead of being rolled forward to the next month.
Brand filtering
Pass the optionalbrandIds array to restrict counts to assets belonging to specific
brands. Every ID must belong to your organization. If any ID references a brand outside
your organization (or a deleted brand), the API returns a 404 error instead of silently
ignoring it.
Example request
Example response
Authorizations
Your API key. This is required by most endpoints to access our API programatically. Reach out to us at support@chainpatrol.io to get an API key for your use.
Body
Organization slug
1Only include assets whose earliest report was created on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC
Only include assets whose earliest report was created on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off
Only include assets belonging to these brands
x > 0Response
Successful response
Currently blocked assets first reported by the customer (reportedByCustomer, external reporter, or customer-role user)
Currently blocked assets first reported by ChainPatrol staff or automation. Staff and automation are collapsed together.
customer + chainpatrol. This is a first-report blocked cohort and does not equal metrics/found, which counts assets by blockedAt.