> ## Documentation Index
> Fetch the complete documentation index at: https://docs.events.intrace.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List Threats

> List asset-relevant threats in tenant scope

Returns evaluated threats, not raw event rows.

## Query Parameters

| Parameter           | Type      | Required | Description                          |
| ------------------- | --------- | -------- | ------------------------------------ |
| `asset_id`          | string\[] | No       | Limit to one or more affected assets |
| `severity`          | string    | No       | Filter by threat severity            |
| `status`            | string    | No       | Filter by threat status              |
| `include_dismissed` | boolean   | No       | When true, include dismissed threats |
| `limit`             | integer   | No       | Max items, default `100`             |
| `offset`            | integer   | No       | Row offset                           |

## Response

```json theme={null}
{
  "threats": [
    {
      "id": "4f5d1cc9-d4cc-49a1-a3fc-5ec93d674bc8",
      "title": "Protest blocks access road near Lagos HQ",
      "severity": "high",
      "status": "active",
      "threatType": "civic_activity.protest",
      "location": "Victoria Island, Lagos",
      "locationCountry": "NG",
      "coordinates": {
        "lat": 6.431,
        "lng": 3.421
      },
      "observedAt": "2026-04-18T08:10:00Z",
      "affectedAssets": [
        {
          "assetId": "lagos-hq",
          "assetName": "Lagos HQ",
          "assetType": "facility",
          "distanceKm": 1.8
        }
      ],
      "riskLevel": "high",
      "developmentCount": 2,
      "versionCount": 3
    }
  ],
  "total": 1,
  "assets": [
    {
      "assetId": "lagos-hq",
      "name": "Lagos HQ",
      "type": "facility",
      "lat": 6.4541,
      "lng": 3.3947,
      "monitoringRadiusKm": 12
    }
  ]
}
```

## Example Request

```bash theme={null}
curl -H "X-API-Key: your-api-key" "https://api.intrace.ai/v1/threats?asset_id=lagos-hq&status=active"
```


## OpenAPI

````yaml get /v1/threats
openapi: 3.1.0
info:
  title: Intrace Events Monitoring API
  version: 0.1.0
  description: >
    External asset monitoring and event intelligence API derived from the
    internal

    Intrace events investigations platform.


    This public API is tenant-scoped by API key and intentionally does not
    expose

    internal identifiers such as case_id or investigation_id.
servers:
  - url: https://api.intrace.ai
security:
  - ApiKeyAuth: []
tags:
  - name: Assets
  - name: Threats
  - name: Incidents
  - name: Alerts
  - name: Reports
  - name: Event Intelligence
paths:
  /v1/threats:
    get:
      tags:
        - Threats
      summary: List threats
      operationId: listThreats
      parameters:
        - name: asset_id
          in: query
          schema:
            oneOf:
              - type: string
              - type: array
                items:
                  type: string
          explode: true
        - name: severity
          in: query
          schema:
            type: string
            enum:
              - critical
              - high
              - medium
              - low
              - negligible
        - name: status
          in: query
          schema:
            type: string
            enum:
              - active
              - monitoring
              - contained
              - resolved
              - dismissed
              - ended
        - name: include_dismissed
          in: query
          schema:
            type: boolean
            default: false
        - $ref: '#/components/parameters/Limit'
        - $ref: '#/components/parameters/Offset'
      responses:
        '200':
          description: Threat list.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatListResponse'
components:
  parameters:
    Limit:
      name: limit
      in: query
      schema:
        type: integer
        minimum: 1
        maximum: 5000
        default: 100
    Offset:
      name: offset
      in: query
      schema:
        type: integer
        minimum: 0
        default: 0
  schemas:
    ThreatListResponse:
      type: object
      properties:
        threats:
          type: array
          items:
            $ref: '#/components/schemas/Threat'
        total:
          type: integer
        assets:
          type: array
          items:
            $ref: '#/components/schemas/ThreatAssetSummary'
      required:
        - threats
        - total
        - assets
    Threat:
      type: object
      properties:
        id:
          type: string
          format: uuid
        title:
          type: string
        description:
          type: string
          nullable: true
        threat_rationale:
          type: string
          nullable: true
        severity:
          type: string
          enum:
            - critical
            - high
            - medium
            - low
            - negligible
        status:
          type: string
          enum:
            - active
            - monitoring
            - contained
            - resolved
            - dismissed
            - ended
        threat_type:
          type: string
          nullable: true
        location:
          type: string
          nullable: true
        location_country:
          type: string
          nullable: true
        coordinates:
          $ref: '#/components/schemas/Coordinates'
        observed_at:
          type: string
          format: date-time
          nullable: true
        expires_at:
          type: string
          format: date-time
          nullable: true
        pinned:
          type: boolean
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
        attribution_types:
          type: array
          items:
            type: string
        sources:
          type: array
          items:
            type: string
        affected_assets:
          type: array
          items:
            $ref: '#/components/schemas/AffectedAsset'
        likelihood:
          type: string
          nullable: true
        impact_severity:
          type: string
          nullable: true
        risk_score:
          type: integer
          nullable: true
        risk_level:
          type: string
          nullable: true
        likelihood_rationale:
          type: string
          nullable: true
        impact_rationale:
          type: string
          nullable: true
        dismissal_reason:
          type: string
          nullable: true
        location_precision_level:
          type: string
          nullable: true
        location_uncertainty_km:
          type: number
          nullable: true
        version_count:
          type: integer
        last_version_at:
          type: string
          format: date-time
          nullable: true
        development_count:
          type: integer
        latest_development_title:
          type: string
          nullable: true
      required:
        - id
        - title
        - severity
        - status
        - pinned
        - created_at
        - updated_at
        - attribution_types
        - sources
        - affected_assets
        - version_count
        - development_count
    ThreatAssetSummary:
      type: object
      properties:
        asset_id:
          type: string
        name:
          type: string
        type:
          type: string
        lat:
          type: number
        lng:
          type: number
        country:
          type: string
          nullable: true
        address:
          type: string
          nullable: true
        monitoring_radius_km:
          type: number
          nullable: true
      required:
        - asset_id
        - name
        - type
        - lat
        - lng
    Coordinates:
      type: object
      properties:
        lat:
          type: number
        lng:
          type: number
      required:
        - lat
        - lng
    AffectedAsset:
      type: object
      properties:
        asset_id:
          type: string
        asset_name:
          type: string
        asset_type:
          type: string
        distance_km:
          type: number
      required:
        - asset_id
        - asset_name
        - asset_type
        - distance_km
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key

````