Blockaid Monitors API

openapi: 3.1.0
info:
  title: Blockaid Asset Management Monitors API
  description: Blockaid Risk Score API
  termsOfService: https://www.blockaid.io/legal/terms-of-use
  license:
    name: Proprietary
    url: https://www.blockaid.io/legal
  version: 1.0.0
servers:
- url: https://api.blockaid.io
  description: Production server
- url: https://client.blockaid.io
  description: Clients server
tags:
- name: Monitors
paths:
  /v0/platform/monitors/:
    post:
      summary: Create Monitor
      deprecated: false
      description: Create a monitor that tracks configured rules and triggers actions when incidents match.
      tags:
      - Monitors
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NewMonitorCreation'
            examples:
              Create Monitor Example:
                summary: Create monitor
                value:
                  name: High-Risk Activity Monitor
                  tags:
                  - security
                  actions: []
                  monitors:
                  - type: approval_to_multicall_contract
                    target:
                    - type: asset_id
                      identifier: asset_123
                    severity: high
                    is_silent: false
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MonitorObject'
              example:
                id: mon_123
                name: High-Risk Activity Monitor
                is_enabled: true
                created_by: api
                updated_by: api
                updated_at: '2026-02-11T12:00:00Z'
                created_at: '2026-02-11T12:00:00Z'
                monitors:
                - type: approval_to_multicall_contract
                  target:
                  - type: asset_id
                    identifier: asset_123
                  severity: high
                  is_silent: false
                tags:
                - security
          headers: {}
      security:
      - APIKey: []
      - ClientID: []
      - JWT: []
  /v0/platform/monitors/{id}:
    get:
      summary: Get Monitor
      deprecated: false
      description: Fetch a single monitor by ID.
      tags:
      - Monitors
      parameters:
      - name: id
        in: path
        description: The monitor's ID.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MonitorObject'
              example:
                id: mon_123
                name: High-Risk Activity Monitor
                is_enabled: true
                created_by: api
                updated_by: api
                updated_at: '2026-02-11T12:00:00Z'
                created_at: '2026-02-11T12:00:00Z'
                monitors:
                - type: approval_to_multicall_contract
                  target:
                  - type: asset_id
                    identifier: asset_123
                  severity: high
                  is_silent: false
                tags:
                - security
          headers: {}
      security:
      - APIKey: []
      - ClientID: []
      - JWT: []
    patch:
      summary: Update Monitor
      deprecated: false
      description: Change a monitor's name, rules, tags, or actions.
      tags:
      - Monitors
      parameters:
      - name: id
        in: path
        description: The monitor's ID.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  description: Updated display name for the monitor.
                is_enabled:
                  type: boolean
                  description: Whether the monitor is enabled.
                tags:
                  type: array
                  description: Updated list of tags assigned to the monitor.
                  items:
                    type: string
                actions:
                  type: array
                  description: Updated actions that run when monitor rules are triggered.
                  items:
                    anyOf:
                    - $ref: '#/components/schemas/EmailAction'
                    - $ref: '#/components/schemas/SlackAction'
                    - $ref: '#/components/schemas/TelegramAction'
                    - $ref: '#/components/schemas/WebhookAction'
                    - $ref: '#/components/schemas/PauseContractAction'
                    - $ref: '#/components/schemas/SequencerAction'
                    - $ref: '#/components/schemas/APICallAction'
                    - $ref: '#/components/schemas/CallContractAction'
                monitors:
                  description: The updated rules this monitor runs.
                  anyOf:
                  - $ref: '#/components/schemas/MonitorRuleRequest'
                  - $ref: '#/components/schemas/SystemMonitorRuleRequest'
            examples:
              Update Monitor Example:
                summary: Update monitor
                value:
                  name: High-Risk Activity Monitor v2
                  is_enabled: true
                  tags:
                  - security
                  - critical
                  actions: []
                  monitors:
                  - type: approval_to_multicall_contract
                    target:
                    - type: asset_id
                      identifier: asset_123
                    severity: critical
                    is_silent: false
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MonitorObject'
              example:
                id: mon_123
                name: High-Risk Activity Monitor v2
                is_enabled: true
                created_by: api
                updated_by: api
                updated_at: '2026-02-11T12:30:00Z'
                created_at: '2026-02-11T12:00:00Z'
                monitors:
                - type: approval_to_multicall_contract
                  target:
                  - type: asset_id
                    identifier: asset_123
                  severity: critical
                  is_silent: false
                tags:
                - security
                - critical
          headers: {}
      security:
      - APIKey: []
      - ClientID: []
      - JWT: []
    delete:
      summary: Delete Monitor
      deprecated: false
      description: Remove a monitor by ID.
      tags:
      - Monitors
      parameters:
      - name: id
        in: path
        description: The monitor's ID.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: ''
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
              example: {}
          headers: {}
      security:
      - APIKey: []
      - ClientID: []
      - JWT: []
  /v0/platform/monitors/search:
    post:
      summary: Search Monitors
      deprecated: false
      description: Search monitors with pagination and sorting controls.
      tags:
      - Monitors
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                page_size:
                  type: integer
                  description: Number of results returned per page.
                page:
                  type: integer
                  description: Page number to return.
                sort:
                  type: array
                  description: Sorting rules applied to the result set.
                  items:
                    type: object
                    properties:
                      field:
                        type: string
                        description: Field to sort by.
                        enum:
                        - id
                        - created_at
                      operator:
                        type: string
                        description: Sort direction.
                        enum:
                        - asc
                        - desc
                    required:
                    - field
                    - operator
                filter:
                  type: object
                  description: Optional filter criteria.
                  properties:
                    name:
                      type: object
                      description: Filter by monitor name. Exactly one operator must be provided.
                      properties:
                        eq:
                          type: string
                          description: Exact match.
                        in:
                          type: array
                          items:
                            type: string
                          description: Match any value in the list.
                        contains:
                          type: string
                          description: Substring match (case-insensitive).
                        contains_all:
                          type: array
                          items:
                            type: string
                          description: Must contain all specified words.
              required:
              - page_size
              - page
              - sort
            examples:
              Search Monitors Example:
                summary: Search monitors
                value:
                  page_size: 20
                  page: 1
                  sort:
                  - field: created_at
                    operator: desc
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/MonitorObject'
                    description: Monitor objects returned for this page.
                  total:
                    type: integer
                    description: Total number of matching results.
                  page:
                    type: integer
                    description: Current page number in the response.
                  pages:
                    type: integer
                    description: Total number of pages available.
                  size:
                    type: integer
                    description: Number of objects returned in this page.
                required:
                - items
                - total
                - page
                - pages
                - size
              example:
                items:
                - id: mon_123
                  name: High-Risk Activity Monitor
                  is_enabled: true
                  created_by: api
                  updated_by: api
                  updated_at: '2026-02-11T12:00:00Z'
                  created_at: '2026-02-11T12:00:00Z'
                  monitors:
                  - type: approval_to_multicall_contract
                    target:
                    - type: asset_id
                      identifier: asset_123
                    severity: high
                    is_silent: false
                  tags:
                  - security
                total: 1
                page: 1
                pages: 1
                size: 1
          headers: {}
      security:
      - APIKey: []
      - ClientID: []
      - JWT: []
components:
  schemas:
    SystemMonitorRuleRequest:
      title: System Monitor Rule Request
      description: Supported system monitor rule collections accepted by the API.
      oneOf:
      - type: array
        items:
          $ref: '#/components/schemas/MaliciousInteractionWithOFACAddressMonitor'
        title: Malicious Interaction With OFACAddress Rules
      - type: array
        items:
          $ref: '#/components/schemas/MonitoredContractExploitMonitor'
        title: Monitored Contract Exploit Rules
      - type: array
        items:
          $ref: '#/components/schemas/ImpersonatorDappDeployedMonitor'
        title: Impersonator Dapp Deployed Rules
      - type: array
        items:
          $ref: '#/components/schemas/ImpersonatorTokenDeployedMonitor'
        title: Impersonator Token Deployed Rules
      - type: array
        items:
          $ref: '#/components/schemas/FrontendAttackMonitor'
        title: Frontend Attack Rules
      - type: array
        items:
          $ref: '#/components/schemas/ExploitContractDeployedWithReferenceToMonitoredAssetMonitor'
        title: Exploit Contract Deployed With Reference To Monitored Asset Rules
      - type: array
        items:
          $ref: '#/components/schemas/MaliciousFundsExposureMonitor'
        title: Malicious Funds Exposure Rules
      - type: array
        items:
          $ref: '#/components/schemas/UserGotDrainedMonitor'
        title: User Got Drained Rules
      - type: array
        items:
          $ref: '#/components/schemas/MaliciousTransactionWasBlockedMonitor'
        title: Malicious Transaction Was Blocked Rules
      - type: array
        items:
          $ref: '#/components/schemas/MaliciousTransactionDetectedMonitor'
        title: Malicious Transaction Detected Rules
      - type: array
        items:
          $ref: '#/components/schemas/ToctouPackageDeployedMonitor'
        title: TOCTOU Package Deployed Rules
      - type: array
        items:
          $ref: '#/components/schemas/ActiveMaliciousAirdropCampaignMonitor'
        title: Active Malicious Airdrop Campaign Rules
      - type: array
        items:
          $ref: '#/components/schemas/AddressPoisoningCampaignMonitor'
        title: Address Poisoning Campaign Rules
    UserGotDrainedMonitor:
      type: object
      properties:
        type:
          type: string
          const: user_got_drained
          description: Type discriminator for this object.
        target:
          type: array
          items:
            anyOf:
            - $ref: '#/components/schemas/AssetIDTarget'
            - $ref: '#/components/schemas/AssetTagTarget'
            - $ref: '#/components/schemas/AssetLabelTarget'
            - $ref: '#/components/schemas/AssetIDExcludeTarget'
          description: Target asset or entity selection for this rule or action.
        parameters:
          type: object
          properties:
            drain_amount_usd:
              type: array
              items:
                type: object
                properties:
                  operator:
                    type: string
                    enum:
                    - eq
                    - neq
                    - gt
                    - gte
                    - lt
                    - lte
                    description: Comparison operator for drain amount usd.
                  value:
                    type: number
                    description: Comparison value for drain amount usd.
                required:
                - operator
                - value
              minItems: 1
              description: Drain Amount USD for this configuration.
            chain:
              type: object
              properties:
                operator:
                  type: string
                  enum:
                  - in
                  - not_in
                  description: Comparison operator for chain.
                value:
                  type: array
                  items:
                    $ref: '#/components/schemas/MonitoringSupportedChains'
                  description: Comparison value for chain.
              required:
              - operator
              - value
              description: Chain for this configuration.
          required:
          - drain_amount_usd
          description: Parameters for this configuration.
        severity:
          $ref: '#/components/schemas/Severity'
          description: Severity level for incidents that match this rule.
        is_silent:
          type: boolean
          default: false
          description: Whether incidents from this rule should be silent.
      required:
      - type
      - target
      - parameters
      - severity
      description: User Got Drained
    LabelEntityAction:
      type: object
      properties:
        type:
          type: string
          const: label_entity
          description: Action type.
        severity:
          type: array
          items:
            $ref: '#/components/schemas/Severity'
          description: Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values.
        entity_from_incident:
          type: string
          enum:
          - target
          - source
          title: Entity From Incident
          description: Specifies which entity from the incident to label - either the target(s) or source(s) of the incident.
        label:
          type: string
          enum:
          - account_takeover
          - compromised
          - custom_malicious
          - investment_scam
          - address_poisoning_impersonator_wallet
          - address_poisoning_operator
          - exploiter
          - exploit_contract
          - malicious_airdrop_operator
          - wallet_drainer
          - rugpull_operator
          - malicious_implementation
          title: Label
          description: The malicious label to apply to the entity. Available labels include classifications for various threat types such as drainers, exploiters, scams, and compromised entities.
      title: Label Entity Action
      required:
      - type
      - entity_from_incident
      - label
    WebhookAction:
      type: object
      properties:
        type:
          type: string
          const: webhook
          description: Action type.
        severity:
          type: array
          items:
            $ref: '#/components/schemas/Severity'
          description: Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values.
        url:
          type: string
          title: Consumer URL
          description: The URL of the endpoint where the platform sends the event payloads.
        authentication:
          title: Authentication Method
          description: The authentication method used for the webhook request.
          $ref: '#/components/schemas/Authentication'
        custom_headers:
          type: array
          items:
            type: object
            properties:
              name:
                type: string
                title: Header Name
                description: The name of the custom header.
              value:
                type: string
                title: Value
                description: The value of the custom header.
            required:
            - name
            - value
          title: Custom Headers
          description: Custom headers to be sent in the HTTP POST request along with the event payload.
        custom_payload_fields:
          type: array
          items:
            type: object
            properties:
              key:
                type: string
                title: Field Key
                description: The key name for the custom field in the webhook payload.
              value:
                type: string
                title: Field Value
                description: The value for the custom field.
            required:
            - key
            - value
          title: Custom Payload Fields
          description: Custom fields to be included in the webhook payload along with the event data.
      title: Webhook Action
      required:
      - type
      - url
    Severity:
      type: string
      enum:
      - info
      - low
      - medium
      - high
      - critical
      title: Severity
    TransferToNonApprovedEntityMonitor:
      type: object
      properties:
        type:
          type: string
          const: transfer_to_non_approved_entity
          description: Type discriminator for this object.
        target:
          type: array
          items:
            anyOf:
            - $ref: '#/components/schemas/AssetIDTarget'
            - $ref: '#/components/schemas/AssetTagTarget'
            - $ref: '#/components/schemas/AssetLabelTarget'
            - $ref: '#/components/schemas/AssetIDExcludeTarget'
          description: Target asset or entity selection for this rule or action.
        severity:
          $ref: '#/components/schemas/Severity'
          description: Severity level for incidents that match this rule.
        is_silent:
          type: boolean
          default: false
          description: Whether incidents from this rule should be silent.
      required:
      - type
      - target
      - severity
      description: Standard Rule
    MaliciousTransactionDetectedMonitor:
      type: object
      properties:
        type:
          type: string
          const: malicious_transaction_detected
          description: Type discriminator for this object.
        severity:
          $ref: '#/components/schemas/Severity'
          description: Severity level for incidents that match this rule.
        is_silent:
          type: boolean
          default: false
          description: Whether incidents from this rule should be silent.
      required:
      - type
      - severity
      description: Malicious Transaction Detected
    SystemMonitorRuleResponse:
      title: System Monitor Rule Response
      description: Supported system monitor rule collections returned by the API.
      oneOf:
      - type: array
        items:
          $ref: '#/components/schemas/MaliciousInteractionWithOFACAddressMonitor'
        title: Malicious Interaction With OFACAddress Rules
      - type: array
        items:
          $ref: '#/components/schemas/MonitoredContractExploitMonitor'
        title: Monitored Contract Exploit Rules
      - type: array
        items:
          $ref: '#/components/schemas/ImpersonatorDappDeployedMonitor'
        title: Impersonator Dapp Deployed Rules
      - type: array
        items:
          $ref: '#/components/schemas/ImpersonatorTokenDeployedMonitor'
        title: Impersonator Token Deployed Rules
      - type: array
        items:
          $ref: '#/components/schemas/FrontendAttackMonitor'
        title: Frontend Attack Rules
      - type: array
        items:
          $ref: '#/components/schemas/ExploitContractDeployedWithReferenceToMonitoredAssetMonitor'
        title: Exploit Contract Deployed With Reference To Monitored Asset Rules
      - type: array
        items:
          $ref: '#/components/schemas/MaliciousFundsExposureMonitor'
        title: Malicious Funds Exposure Rules
      - type: array
        items:
          $ref: '#/components/schemas/UserGotDrainedMonitor'
        title: User Got Drained Rules
      - type: array
        items:
          $ref: '#/components/schemas/MaliciousTransactionWasBlockedMonitor'
        title: Malicious Transaction Was Blocked Rules
      - type: array
        items:
          $ref: '#/components/schemas/MaliciousTransactionDetectedMonitor'
        title: Malicious Transaction Detected Rules
      - type: array
        items:
          $ref: '#/components/schemas/ToctouPackageDeployedMonitor'
        title: TOCTOU Package Deployed Rules
      - type: array
        items:
          $ref: '#/components/schemas/ActiveMaliciousAirdropCampaignMonitor'
        title: Active Malicious Airdrop Campaign Rules
      - type: array
        items:
          $ref: '#/components/schemas/AddressPoisoningCampaignMonitor'
        title: Address Poisoning Campaign Rules
    MonitoredContractExploitMonitor:
      type: object
      properties:
        type:
          type: string
          const: monitored_contract_was_exploited
          description: Type discriminator for this object.
        target:
          type: array
          items:
            anyOf:
            - $ref: '#/components/schemas/AssetIDTarget'
            - $ref: '#/components/schemas/AssetTagTarget'
            - $ref: '#/components/schemas/AssetLabelTarget'
            - $ref: '#/components/schemas/AssetIDExcludeTarget'
          description: Target asset or entity selection for this rule or action.
        severity:
          $ref: '#/components/schemas/Severity'
          description: Severity level for incidents that match this rule.
        parameters:
          type: object
          properties:
            confidence:
              type: object
              properties:
                operator:
                  type: string
                  enum:
                  - is
                  - is_not
                  - gt
                  - gte
                  - lt
                  - lte
                  description: Comparison operator for confidence.
                value:
                  type: number
                  description: Comparison value for confidence.
              required:
              - operator
              - value
              description: Confidence for this configuration.
            funds_lost:
              type: array
              items:
                type: object
                properties:
                  operator:
                    type: string
                    enum:
                    - eq
                    - neq
                    - gt
                    - gte
                    - lt
                    - lte
                    description: Comparison operator for funds lost.
                  value:
                    type: number
                    description: Comparison value for funds lost.
                required:
                - operator
                - value
              minItems: 1
              description: Funds Lost for this configuration.
          required:
          - confidence
          description: Parameters for this configuration.
        is_silent:
          type: boolean
          default: false
          description: Whether incidents from this rule should be silent.
      required:
      - type
      - target
      - severity
      - parameters
      description: Monitored Contract Was Exploited
    EmailAction:
      type: object
      properties:
        type:
          type: string
          const: email
          description: 'Action type. '
        severity:
          type: array
          items:
            $ref: '#/components/schemas/Severity'
          description: Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values.
        to:
          type: array
          items:
            type: string
          description: Primary email recipients.
        cc:
          type: array
          items:
            type: string
          description: CC email recipients.
        bcc:
          type: array
          items:
            type: string
          description: BCC email recipients.
        body:
          type: string
          description: Request body payload.
      title: Email Action
      required:
      - type
      - to
    NewMonitorCreation:
      title: New Monitor Creation
      description: Payload used to create a monitor with rules, tags, and optional actions.
      type: object
      properties:
        name:
          type: string
          description: Display name for the new monitor.
        tags:
          type: array
          default: []
          description: Optional tags used to group and filter the monitor.
          items:
            type: string
        actions:
          type: array
          default: []
          description: Actions to execute when monitor rules are triggered.
          items:
            anyOf:
            - $ref: '#/components/schemas/EmailAction'
            - $ref: '#/components/schemas/SlackAction'
            - $ref: '#/components/schemas/TelegramAction'
            - $ref: '#/components/schemas/WebhookAction'
            - $ref: '#/components/schemas/PauseContractAction'
            - $ref: '#/components/schemas/SequencerAction'
            - $ref: '#/components/schemas/APICallAction'
            - $ref: '#/components/schemas/CallContractAction'
            - $ref: '#/components/schemas/LabelEntityAction'
        monitors:
          allOf:
          - description: The rules this monitor runs to detect and evaluate activity.
          - $ref: '#/components/schemas/MonitorRuleRequest'
      required:
      - name
      - monitors
    CallContractAction:
      type: object
      properties:
        type:
          type: string
          const: contract_call
          description: Type discriminator for this object.
        severity:
          type: array
          items:
            $ref: '#/components/schemas/Severity'
          description: Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values.
        targets:
          anyOf:
          - type: array
            items:
              anyOf:
              - $ref: '#/components/schemas/AssetIDTarget'
              - $ref: '#/components/schemas/AssetTagTarget'
          - type: string
            const: dynamic
          description: Target asset or entity selection for this rule or action.
        via_router:
          type: object
          description: 'Optional: route calls through these contracts (targets become $address parameter)'
          properties:
            contracts:
              type: array
              minItems: 1
              items:
                $ref: '#/components/schemas/AssetIDTarget'
              description: Contracts used by this routing configuration.
          required:
          - contracts
        function_signature:
          type: string
          description: e.g. 'transfer(address,uint256)'
        function_parameters:
          type: array
          items:
            type: string
          description: Function arguments to pass.
        response_wallet:
          type: object
          required:
          - integration_instance_id
          properties:
            integration_instance_id:
              type: string
              description: Identifier for the integration instance.
          description: Wallet integration used for action responses.
      title: Call Contract Action
      required:
      - type
      - function_signature
      - function_parameters
      - response_wallet
      - targets
    BasicAuth:
      type: object
      properties:
        type:
          type: string
          const: basic_auth
        username:
          type: string
        password:
          type: string
      required:
      - type
      - username
      - password
    ApprovalToMulticallContractMonitor:
      type: object
      properties:
        type:
          type: string
          const: approval_to_multicall_contract
          description: Type discriminator for this object.
        severity:
          $ref: '#/components/schemas/Severity'
          description: Severity level for incidents that match this rule.
        target:
          type: array
          items:
            anyOf:
            - $ref: '#/components/schemas/AssetIDTarget'
            - $ref: '#/components/schemas/AssetTagTarget'
            - $ref: '#/components/schemas/AssetLabelTarget'
            - $ref: '#/components/schemas/AssetIDExcludeTarget'
          description: Target asset or entity selection for this rule or action.
        is_silent:
          type: boolean
          description: Whether incidents from this rule should be silent.
      required:
      - type
      - target
      - severity
      - is_silent
      description: Standard Rule
    TokenStateChangedToMaliciousMonitor:
      type: object
      properties:
        type:
          type: string
          const: token_state_changed_to_malicious
          d

# --- truncated at 32 KB (110 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/blockaid/refs/heads/main/openapi/blockaid-monitors-api-openapi.yml