> ## Documentation Index
> Fetch the complete documentation index at: https://docs.events.intrace.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> How the external Events Monitoring API maps to the internal Intrace events platform

The Intrace Events Monitoring API exposes the internal events-investigation stack as a tenant-scoped product API.

## What this API gives you

You can use the API to:

* register monitored assets with coordinates and metadata
* evaluate nearby or relevant events into **threats**
* fetch grouped **incidents** built from those threats
* configure **alert rules** and consume triggered alerts
* generate **threat**, **incident**, and **landscape** reports
* access the wider **events intelligence** layer for maps and analytics

## Internal-to-external mapping

| Internal Intrace concept                    | External API concept         |
| ------------------------------------------- | ---------------------------- |
| `case_id`                                   | removed from public API      |
| `investigation_id`                          | removed from public API      |
| case assets                                 | assets                       |
| events investigation threat feed            | threats                      |
| physical alert rules                        | alert rules                  |
| aggregate monitor / case event intelligence | event intelligence endpoints |

Your API key determines tenant scope, so clients do not pass internal case or investigation identifiers.

## Base URL

```text theme={null}
https://api.intrace.ai
```

## Resource families

### Assets

Assets are the things you want monitored. In the first external version, the physical monitoring workflow is centered on locatable assets such as:

* `facility`
* `residence`

Assets store both identity metadata and monitoring configuration.

### Threats

Threats are not raw event rows. They are evaluated, asset-relevant records produced by the monitoring pipeline. A threat can include:

* severity and status
* risk scoring fields
* source attributions
* linked or affected assets
* development/version history summaries

### Events

Events are the broad intelligence layer. Use them for:

* background event search
* map rendering
* heatmaps and country summaries
* point inspection and vector tiles

## Design principles

* **Tenant-scoped** — API key scope replaces internal case and investigation references
* **Asset-first** — monitoring begins from registered assets and their radius/config
* **Two layers** — asset-linked threat feed plus full event-intelligence layer
* **Operational workflows** — alerts, incidents, and reports exposed directly