--- title: "Create Monitor" method: POST path: "/v0/platform/monitors/" tags: ["Monitors"] --- # Create Monitor `POST /v0/platform/monitors/` Create a monitor that tracks configured rules and triggers actions when incidents match. ## Request body - NewMonitorCreation — Payload used to create a monitor with rules, tags, and optional actions. - `name` string, required — Display name for the new monitor. - `tags` string[] — Optional tags used to group and filter the monitor. - `actions` union[] — Actions to execute when monitor rules are triggered. - union - EmailAction - `type` 'email', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `to` string[], required — Primary email recipients. - `cc` string[] — CC email recipients. - `bcc` string[] — BCC email recipients. - `body` string — Request body payload. - SlackAction - `type` 'slack', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `integration_instance_id` string, required — Identifier for the integration instance. - `channels` string[], required — Slack channel names - `message_format` string — Customization of the message to send in the Slack notification. - TelegramAction - `type` 'telegram', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `integration_instance_id` string, required — Identifier for the integration instance. - `chats` object[], required — Telegram chat and topic configuration for posting notifications. - `chat_id` string, required — Telegram channel ID. - `topic_ids` integer[] — Optional topic IDs within the channel where the message should be posted. - `message_format` string — Customization of the message to send in the Telegram notification. - WebhookAction - `type` 'webhook', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `url` string, required — The URL of the endpoint where the platform sends the event payloads. - `authentication` union - HMACAuthentication - `type` 'hmac', required — Type discriminator for this object. - `hmac_secret` string, required — Secret value for hmac secret authentication. - AuthorizationHeaderAuthentication - `type` 'authorization_header', required — Type discriminator for this object. - `value` string, required — Comparison value. - APIKeyAuthorization - `type` 'api_key', required — Type discriminator for this object. - `header_name` string, required — Header name used for API key authentication. - `api_key` string, required — Secret value for api key authentication. - BasicAuth - `type` 'basic_auth', required - `username` string, required - `password` string, required - `custom_headers` object[] — Custom headers to be sent in the HTTP POST request along with the event payload. - `name` string, required — The name of the custom header. - `value` string, required — The value of the custom header. - `custom_payload_fields` object[] — Custom fields to be included in the webhook payload along with the event data. - `key` string, required — The key name for the custom field in the webhook payload. - `value` string, required — The value for the custom field. - PauseContractAction - `type` 'pause-contract' — Type discriminator for this object. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `pause` boolean, required — Whether to pause the contract. - SequencerAction - `type` 'sequencer' — Type discriminator for this object. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `target` 'target' | 'source', required — Target asset or entity selection for this rule or action. - `comment` string — Optional comment for this action. - `expiration_time` string, date-time — Timestamp for expiration time. - APICallAction - `type` 'api_call', required — Type discriminator for this object. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `url` string, required — Target URL. - `authentication` union - HMACAuthentication - `type` 'hmac', required — Type discriminator for this object. - `hmac_secret` string, required — Secret value for hmac secret authentication. - AuthorizationHeaderAuthentication - `type` 'authorization_header', required — Type discriminator for this object. - `value` string, required — Comparison value. - APIKeyAuthorization - `type` 'api_key', required — Type discriminator for this object. - `header_name` string, required — Header name used for API key authentication. - `api_key` string, required — Secret value for api key authentication. - BasicAuth - `type` 'basic_auth', required - `username` string, required - `password` string, required - `custom_headers` object — Additional headers to include in the request. - `request_type` 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', required — HTTP method to use. - `body` object — Request body payload. - `incident_payload_override` object[], required — Incident payload field overrides. - `key_to_override` string, required — Payload key to override. - `incident_field` 'targets' | 'attackers' | 'incident_name' | 'incident_start_date' | 'incident_end_date' | 'incident_duration' | 'severity' | 'dollars_funds_lost' | 'dollars_funds_exposed', required — Incident field mapped into the request payload. - CallContractAction - `type` 'contract_call', required — Type discriminator for this object. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `targets` union, required — Target asset or entity selection for this rule or action. - union[] - union - … - 'dynamic' - `via_router` object — Optional: route calls through these contracts (targets become $address parameter) - `contracts` AssetIDTarget[], required — Contracts used by this routing configuration. - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `function_signature` string, required — e.g. 'transfer(address,uint256)' - `function_parameters` string[], required — Function arguments to pass. - `response_wallet` object, required — Wallet integration used for action responses. - `integration_instance_id` string, required — Identifier for the integration instance. - LabelEntityAction - `type` 'label_entity', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `entity_from_incident` 'target' | 'source', required — Specifies which entity from the incident to label - either the target(s) or source(s) of the incident. - `label` 'account_takeover' | 'compromised' | 'custom_malicious' | 'investment_scam' | 'address_poisoning_impersonator_wallet' | 'address_poisoning_operator' | 'exploiter' | 'exploit_contract' | 'malicious_airdrop_operator' | 'wallet_drainer' | 'rugpull_operator' | 'malicious_implementation', required — The malicious label to apply to the entity. Available labels include classifications for various threat types such as drainers, exploiters, scams, and compromised entities. - `monitors` union, required - ApprovalToMulticallContractMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'approval_to_multicall_contract', required — Type discriminator for this object. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `is_silent` boolean, required — Whether incidents from this rule should be silent. - AssetHasDeployedContractMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'asset_has_deployed_contract', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `parameters` object — Parameters for this configuration. - `chain` object — Chain for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for chain. - `value` 'abstract' | 'apechain' | 'arbitrum' | 'avalanche' | 'avalanche-fuji' | 'base' | 'berachain' | 'bitcoin' | 'blast' | 'bsc' | 'degen' | 'ethereum' | 'ethereum-sepolia' | 'gnosis' | 'hedera' | 'hyperevm' | 'hyperliquid' | 'aster' | 'lighter' | 'ink' | 'kaia' | 'katana' | 'kite-ai' | 'linea' | 'monad' | 'optimism' | 'plume' | 'polymarket' | 'polygon' | 'ronin' | 'scroll' | 'sei' | 'solana' | 'soneium' | 'soneium-minato' | 'stellar' | 'sui' | 'unichain' | 'worldchain' | 'zksync' | 'mainnet' | 'kaia' | 'tron' | 'robinhood' | 'arc' | 'flare' | 'xlayer' | 'tempo', required — The chain name - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - BenignInteractionWithAnAssetMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'benign_interaction_with_an_asset', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `parameters` object, required — Parameters for this configuration. - `interaction_type` object — Interaction Type for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for interaction type. - `value` string[], required — Comparison value for interaction type. - `interacted_addresses` object, required — Interacted Addresses for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for interacted addresses. - `value` AssetIDTarget[], required — Comparison value for interacted addresses. - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `interaction_direction` object, required — Interaction Direction for this configuration. - `operator` 'is' | 'is_not', required — Comparison operator for interaction direction. - `value` 'inbound' | 'outbound' | 'any', required — Comparison value for interaction direction. - `interaction_usd_value` object — Interaction USD Value for this configuration. - `operator` 'is' | 'is_not' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for interaction usd value. - `value` integer, required — Comparison value for interaction usd value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - ContractOwnerChangeMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'contract_owner_change', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - ObjectOwnerChangeMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'object_owner_change', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `parameters` object — Parameters for this configuration. - `change_type` object — Change Type for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for change type. - `value` string[], required — Comparison value for change type. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - DelegateCallToNonApprovedContractMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'delegate_call_to_non_approved_contract', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `parameters` object, required — Parameters for this configuration. - `function_name` object, required — Function Name to match. - `operator` 'is' | 'is_not', required — Comparison operator for function name. - `value` string, required — Comparison value for function name. - `function_parameter` union[] — Function Parameter for this configuration. - union - object - … - object - … - `approved_contract` object, required — Approved Contract for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for approved contract. - `value` AssetIDTarget[], required — Comparison value for approved contract. - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - Eip7702SetCodeUpgradeMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'eip_7702_set_code_upgrade_monitor', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - EventEmittedMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'event_emitted', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `parameters` object, required — Parameters for this configuration. - `event_name` object, required — Event Name to match. - `operator` 'is' | 'is_not', required — Comparison operator for event name. - `value` string, required — Comparison value for event name. - `event_parameter` union[] — Event Parameter for this configuration. - union - object - … - object - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - FunctionCallMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'function_call', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `parameters` object, required — Parameters for this configuration. - `function_name` object, required — Function Name to match. - `operator` 'is' | 'is_not', required — Comparison operator for function name. - `value` string, required — Comparison value for function name. - `function_parameter` union[] — Function Parameter for this configuration. - union - object - … - object - … - `caller_address` object, required — Caller Address for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for caller address. - `value` AssetIDTarget[], required — Comparison value for caller address. - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - MaliciousInteractionWithAssetMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'malicious_interaction_with_asset', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `parameters` object — Parameters for this configuration. - `chain` object — Chain for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for chain. - `value` MonitoringSupportedChains[], required — Comparison value for chain. - `malicious_actor_label` object — Malicious Actor Label for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for malicious actor label. - `value` string[], required — Comparison value for malicious actor label. - `interaction_type` object, required — Interaction Type for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for interaction type. - `value` string[], required — Comparison value for interaction type. - `interaction_direction` object, required — Interaction Direction for this configuration. - `operator` 'is' | 'is_not', required — Comparison operator for interaction direction. - `value` 'inbound' | 'outbound' | 'any', required — Comparison value for interaction direction. - `interaction_usd_value` object, required — Interaction USD Value for this configuration. - `operator` 'is' | 'is_not' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for interaction usd value. - `value` integer, required — Comparison value for interaction usd value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - PigButcheringInteractionMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'pig_butchering_interaction', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - ProxyUpgradeDetectedMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'proxy_upgrade_detected', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - TokenStateChangedToMaliciousMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'token_state_changed_to_malicious', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - ToxicityRateThresholdCrossedMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'toxicity_monitor', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `parameters` object, required — Parameters for this configuration. - `toxicity_category` object[], required — Toxicity category conditions for this configuration. - `parameter` string, required — Toxicity category parameter. - `operator` 'gte' | 'lte' | 'lt' | 'gt', required — Comparison operator for toxicity category. - `value` string, required — Comparison value for toxicity category. - `proximity` object — Optional condition scoping the toxicity exposure to a specific proximity ring. Omit to evaluate the overall (non-proximity) exposure. - `operator` 'is', required — Comparison operator for the proximity level. - `value` 'ownership' | 'counterparty' | 'indirect', required — Proximity ring to scope the toxicity exposure to. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - TransferToNonApprovedEntityMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'transfer_to_non_approved_entity', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetTagTarget - `type` 'asset_tag', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetLabelTarget - `type` 'asset_label', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - AssetIDExcludeTarget - `type` 'exclude_asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - CompositeMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'composite', required — Type discriminator for this object. - `category` 'scam_fraud' | 'security' | 'compliance' | 'finance', required — Category for this configuration. - `must_match_monitor_configs` object[], required — Must Match Monitor Configs for this configuration. - `monitor_id` string, required — Identifier for the monitor. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `must_not_match_monitor_configs` object[], required — Must Not Match Monitor Configs for this configuration. - `monitor_id` string, required — Identifier for the monitor. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `incidents_must_share_same_target` boolean — Incidents Must Share Same Target for this configuration. - `incidents_must_share_same_attacker` boolean — Incidents Must Share Same Attacker for this configuration. - `timeframe` Timeframe - `value` integer, required — Numeric value of the timeframe window. - `unit` string, required — Unit used for the timeframe value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - FormulaMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'formula', required — Type discriminator for this object. - `category` 'scam_fraud' | 'security' | 'compliance' | 'finance', required — Category for this configuration. - `metrics` object[], required — Metric definitions used by this configuration. - `symbol` string, required — Short symbol used to reference this metric in formulas. - `metric` DefinedMetric, required - `metric_id` string, required — Identifier for the metric. - `aggregation` object — Aggregation configuration applied to metric data. - `aggregation_function` 'sum' | 'avg' | 'min' | 'max' | 'std_dev' | 'count', required — Aggregation function to apply. - `timeframe` Timeframe, required - … - `formula` string, required — Formula expression used to compute the metric. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - IPInfringementMonitor[] — The rules this monitor runs to detect and evaluate activity. - `type` 'ip_infringement', required — Type discriminator for this object. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `parameters` object, required — Parameters for this configuration. - `keywords` object, required — Keywords for this configuration. - `operator` 'in', required — Comparison operator for keywords. - `value` string[], required — Comparison value for keywords. - `search_location` object, required — Search Location for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for search location. - `value` string[], required — Comparison value for search location. - `chains` object — Chains for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for chains. - `value` MonitoringSupportedChains[], required — Comparison value for chains. - `is_silent` boolean — Whether incidents from this rule should be silent. ## Response `200` - MonitorObject - `id` string, required — Unique identifier of the monitor. - `is_enabled` boolean, required — Whether the monitor is enabled. - `name` string, required — Display name of the monitor. - `created_by` string, required — Actor that originally created the monitor. - `updated_by` string, required — Actor that last updated the monitor. - `updated_at` string, required — Timestamp when the monitor was last updated. - `created_at` string, required — Timestamp when the monitor was created. - `monitors` union, required — Rule set configuration evaluated by this monitor. - union — Monitor rule types the API returns for a monitor. - ApprovalToMulticallContractMonitor[] - `type` 'approval_to_multicall_contract', required — Type discriminator for this object. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `is_silent` boolean, required — Whether incidents from this rule should be silent. - AssetHasDeployedContractMonitor[] - `type` 'asset_has_deployed_contract', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object — Parameters for this configuration. - `chain` object — Chain for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for chain. - `value` 'abstract' | 'apechain' | 'arbitrum' | 'avalanche' | 'avalanche-fuji' | 'base' | 'berachain' | 'bitcoin' | 'blast' | 'bsc' | 'degen' | 'ethereum' | 'ethereum-sepolia' | 'gnosis' | 'hedera' | 'hyperevm' | 'hyperliquid' | 'aster' | 'lighter' | 'ink' | 'kaia' | 'katana' | 'kite-ai' | 'linea' | 'monad' | 'optimism' | 'plume' | 'polymarket' | 'polygon' | 'ronin' | 'scroll' | 'sei' | 'solana' | 'soneium' | 'soneium-minato' | 'stellar' | 'sui' | 'unichain' | 'worldchain' | 'zksync' | 'mainnet' | 'kaia' | 'tron' | 'robinhood' | 'arc' | 'flare' | 'xlayer' | 'tempo', required — The chain name - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - BenignInteractionWithAnAssetMonitor[] - `type` 'benign_interaction_with_an_asset', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object, required — Parameters for this configuration. - `interaction_type` object — Interaction Type for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for interaction type. - `value` string[], required — Comparison value for interaction type. - `interacted_addresses` object, required — Interacted Addresses for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for interacted addresses. - `value` AssetIDTarget[], required — Comparison value for interacted addresses. - … - `interaction_direction` object, required — Interaction Direction for this configuration. - `operator` 'is' | 'is_not', required — Comparison operator for interaction direction. - `value` 'inbound' | 'outbound' | 'any', required — Comparison value for interaction direction. - `interaction_usd_value` object — Interaction USD Value for this configuration. - `operator` 'is' | 'is_not' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for interaction usd value. - `value` integer, required — Comparison value for interaction usd value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - ContractOwnerChangeMonitor[] - `type` 'contract_owner_change', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - ObjectOwnerChangeMonitor[] - `type` 'object_owner_change', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object — Parameters for this configuration. - `change_type` object — Change Type for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for change type. - `value` string[], required — Comparison value for change type. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - DelegateCallToNonApprovedContractMonitor[] - `type` 'delegate_call_to_non_approved_contract', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object, required — Parameters for this configuration. - `function_name` object, required — Function Name to match. - `operator` 'is' | 'is_not', required — Comparison operator for function name. - `value` string, required — Comparison value for function name. - `function_parameter` union[] — Function Parameter for this configuration. - union - … - `approved_contract` object, required — Approved Contract for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for approved contract. - `value` AssetIDTarget[], required — Comparison value for approved contract. - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - Eip7702SetCodeUpgradeMonitor[] - `type` 'eip_7702_set_code_upgrade_monitor', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - EventEmittedMonitor[] - `type` 'event_emitted', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object, required — Parameters for this configuration. - `event_name` object, required — Event Name to match. - `operator` 'is' | 'is_not', required — Comparison operator for event name. - `value` string, required — Comparison value for event name. - `event_parameter` union[] — Event Parameter for this configuration. - union - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - FunctionCallMonitor[] - `type` 'function_call', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object, required — Parameters for this configuration. - `function_name` object, required — Function Name to match. - `operator` 'is' | 'is_not', required — Comparison operator for function name. - `value` string, required — Comparison value for function name. - `function_parameter` union[] — Function Parameter for this configuration. - union - … - `caller_address` object, required — Caller Address for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for caller address. - `value` AssetIDTarget[], required — Comparison value for caller address. - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - MaliciousInteractionWithAssetMonitor[] - `type` 'malicious_interaction_with_asset', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object — Parameters for this configuration. - `chain` object — Chain for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for chain. - `value` MonitoringSupportedChains[], required — Comparison value for chain. - `malicious_actor_label` object — Malicious Actor Label for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for malicious actor label. - `value` string[], required — Comparison value for malicious actor label. - `interaction_type` object, required — Interaction Type for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for interaction type. - `value` string[], required — Comparison value for interaction type. - `interaction_direction` object, required — Interaction Direction for this configuration. - `operator` 'is' | 'is_not', required — Comparison operator for interaction direction. - `value` 'inbound' | 'outbound' | 'any', required — Comparison value for interaction direction. - `interaction_usd_value` object, required — Interaction USD Value for this configuration. - `operator` 'is' | 'is_not' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for interaction usd value. - `value` integer, required — Comparison value for interaction usd value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - PigButcheringInteractionMonitor[] - `type` 'pig_butchering_interaction', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - ProxyUpgradeDetectedMonitor[] - `type` 'proxy_upgrade_detected', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - TokenStateChangedToMaliciousMonitor[] - `type` 'token_state_changed_to_malicious', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - ToxicityRateThresholdCrossedMonitor[] - `type` 'toxicity_monitor', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object, required — Parameters for this configuration. - `toxicity_category` object[], required — Toxicity category conditions for this configuration. - `parameter` string, required — Toxicity category parameter. - `operator` 'gte' | 'lte' | 'lt' | 'gt', required — Comparison operator for toxicity category. - `value` string, required — Comparison value for toxicity category. - `proximity` object — Optional condition scoping the toxicity exposure to a specific proximity ring. Omit to evaluate the overall (non-proximity) exposure. - `operator` 'is', required — Comparison operator for the proximity level. - `value` 'ownership' | 'counterparty' | 'indirect', required — Proximity ring to scope the toxicity exposure to. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - TransferToNonApprovedEntityMonitor[] - `type` 'transfer_to_non_approved_entity', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - CompositeMonitor[] - `type` 'composite', required — Type discriminator for this object. - `category` 'scam_fraud' | 'security' | 'compliance' | 'finance', required — Category for this configuration. - `must_match_monitor_configs` object[], required — Must Match Monitor Configs for this configuration. - `monitor_id` string, required — Identifier for the monitor. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `must_not_match_monitor_configs` object[], required — Must Not Match Monitor Configs for this configuration. - `monitor_id` string, required — Identifier for the monitor. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `incidents_must_share_same_target` boolean — Incidents Must Share Same Target for this configuration. - `incidents_must_share_same_attacker` boolean — Incidents Must Share Same Attacker for this configuration. - `timeframe` Timeframe - `value` integer, required — Numeric value of the timeframe window. - `unit` string, required — Unit used for the timeframe value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - FormulaMonitor[] - `type` 'formula', required — Type discriminator for this object. - `category` 'scam_fraud' | 'security' | 'compliance' | 'finance', required — Category for this configuration. - `metrics` object[], required — Metric definitions used by this configuration. - `symbol` string, required — Short symbol used to reference this metric in formulas. - `metric` DefinedMetric, required - `metric_id` string, required — Identifier for the metric. - `aggregation` object — Aggregation configuration applied to metric data. - … - `formula` string, required — Formula expression used to compute the metric. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - IPInfringementMonitor[] - `type` 'ip_infringement', required — Type discriminator for this object. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `parameters` object, required — Parameters for this configuration. - `keywords` object, required — Keywords for this configuration. - `operator` 'in', required — Comparison operator for keywords. - `value` string[], required — Comparison value for keywords. - `search_location` object, required — Search Location for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for search location. - `value` string[], required — Comparison value for search location. - `chains` object — Chains for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for chains. - `value` MonitoringSupportedChains[], required — Comparison value for chains. - `is_silent` boolean — Whether incidents from this rule should be silent. - union — Supported system monitor rule collections returned by the API. - MaliciousInteractionWithOFACAddressMonitor[] - `type` 'malicious_interaction_with_ofac_address', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object, required — Parameters for this configuration. - `malicious_actor_label` object, required — Malicious Actor Label for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for malicious actor label. - `value` string[], required — Comparison value for malicious actor label. - `interaction_direction` object, required — Interaction Direction for this configuration. - `operator` 'is' | 'is_not', required — Comparison operator for interaction direction. - `value` 'any' | 'inbound' | 'outbound', required — Comparison value for interaction direction. - `chain` object — Chain for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for chain. - `value` MonitoringSupportedChains[], required — Comparison value for chain. - `interaction_type` object — Interaction Type for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for interaction type. - `value` string[], required — Comparison value for interaction type. - `interaction_usd_value` object — Interaction USD Value for this configuration. - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for interaction usd value. - `value` number, required — Comparison value for interaction usd value. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - MonitoredContractExploitMonitor[] - `type` 'monitored_contract_was_exploited', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `parameters` object, required — Parameters for this configuration. - `confidence` object, required — Confidence for this configuration. - `operator` 'is' | 'is_not' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for confidence. - `value` number, required — Comparison value for confidence. - `funds_lost` object[] — Funds Lost for this configuration. - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for funds lost. - `value` number, required — Comparison value for funds lost. - `is_silent` boolean — Whether incidents from this rule should be silent. - ImpersonatorDappDeployedMonitor[] - `type` 'impersonator_dapp_deployed', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object, required — Parameters for this configuration. - `similarity_score` object, required — Similarity Score for this configuration. - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for similarity score. - `value` number, required — Comparison value for similarity score. - `popularity_score` object — Popularity Score for this configuration. - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for popularity score. - `value` number, required — Comparison value for popularity score. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - ImpersonatorTokenDeployedMonitor[] - `type` 'impersonator_token_deployed', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - FrontendAttackMonitor[] - `type` 'frontend_attack', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - ExploitContractDeployedWithReferenceToMonitoredAssetMonitor[] - `type` 'exploit_contract_deployed_with_reference', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `parameters` object, required — Parameters for this configuration. - `confidence` object, required — Confidence for this configuration. - `operator` 'is' | 'is_not' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for confidence. - `value` number, required — Comparison value for confidence. - `is_silent` boolean — Whether incidents from this rule should be silent. - MaliciousFundsExposureMonitor[] - `type` 'malicious_funds_exposure', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object, required — Parameters for this configuration. - `exposed_amount_usd` object[], required — Exposed Amount USD for this configuration. - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for exposed amount usd. - `value` number, required — Comparison value for exposed amount usd. - `chains` object — Chains for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for chains. - `value` MonitoringSupportedChains[], required — Comparison value for chains. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - UserGotDrainedMonitor[] - `type` 'user_got_drained', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object, required — Parameters for this configuration. - `drain_amount_usd` object[], required — Drain Amount USD for this configuration. - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for drain amount usd. - `value` number, required — Comparison value for drain amount usd. - `chain` object — Chain for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for chain. - `value` MonitoringSupportedChains[], required — Comparison value for chain. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - MaliciousTransactionWasBlockedMonitor[] - `type` 'malicious_transaction_was_blocked', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object, required — Parameters for this configuration. - `tx_amount_usd` object, required — Tx Amount USD for this configuration. - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for tx amount usd. - `value` number, required — Comparison value for tx amount usd. - `chain` object — Chain for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for chain. - `value` MonitoringSupportedChains[], required — Comparison value for chain. - `domain` object — Domain for this configuration. - `operator` 'is' | 'is_not' | 'contains' | 'not_contains', required — Comparison operator for domain. - `value` string, required — Comparison value for domain. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - MaliciousTransactionDetectedMonitor[] - `type` 'malicious_transaction_detected', required — Type discriminator for this object. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - ToctouPackageDeployedMonitor[] - `type` 'toctou_package_deployed', required — Type discriminator for this object. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - ActiveMaliciousAirdropCampaignMonitor[] - `type` 'active_malicious_airdrop_campaign', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object, required — Parameters for this configuration. - `victims_amount` object[], required — Victims Amount for this configuration. - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for victims amount. - `value` integer, required — Comparison value for victims amount. - `operator_address` object — Operator Address for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for operator address. - `value` string[], required — Comparison value for operator address. - `token_address` object — Token Address for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for token address. - `value` string[], required — Comparison value for token address. - `chain` object — Chain for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for chain. - `value` MonitoringSupportedChains[], required — Comparison value for chain. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - AddressPoisoningCampaignMonitor[] - `type` 'address_poisoning_campaign', required — Type discriminator for this object. - `target` union[], required — Target asset or entity selection for this rule or action. - union - AssetIDTarget - … - AssetTagTarget - … - AssetLabelTarget - … - AssetIDExcludeTarget - … - `parameters` object, required — Parameters for this configuration. - `victims_amount` object, required — Victims Amount for this configuration. - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte', required — Comparison operator for victims amount. - `value` integer, required — Comparison value for victims amount. - `operator_address` object — Operator Address for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for operator address. - `value` string[], required — Comparison value for operator address. - `chain` object — Chain for this configuration. - `operator` 'in' | 'not_in', required — Comparison operator for chain. - `value` MonitoringSupportedChains[], required — Comparison value for chain. - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required - `is_silent` boolean — Whether incidents from this rule should be silent. - `actions` union[] — Actions executed when the monitor rules are triggered. - union - EmailAction - `type` 'email', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `to` string[], required — Primary email recipients. - `cc` string[] — CC email recipients. - `bcc` string[] — BCC email recipients. - `body` string — Request body payload. - SlackAction - `type` 'slack', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `integration_instance_id` string, required — Identifier for the integration instance. - `channels` string[], required — Slack channel names - `message_format` string — Customization of the message to send in the Slack notification. - TelegramAction - `type` 'telegram', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `integration_instance_id` string, required — Identifier for the integration instance. - `chats` object[], required — Telegram chat and topic configuration for posting notifications. - `chat_id` string, required — Telegram channel ID. - `topic_ids` integer[] — Optional topic IDs within the channel where the message should be posted. - `message_format` string — Customization of the message to send in the Telegram notification. - WebhookAction - `type` 'webhook', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `url` string, required — The URL of the endpoint where the platform sends the event payloads. - `authentication` union - HMACAuthentication - `type` 'hmac', required — Type discriminator for this object. - `hmac_secret` string, required — Secret value for hmac secret authentication. - AuthorizationHeaderAuthentication - `type` 'authorization_header', required — Type discriminator for this object. - `value` string, required — Comparison value. - APIKeyAuthorization - `type` 'api_key', required — Type discriminator for this object. - `header_name` string, required — Header name used for API key authentication. - `api_key` string, required — Secret value for api key authentication. - BasicAuth - `type` 'basic_auth', required - `username` string, required - `password` string, required - `custom_headers` object[] — Custom headers to be sent in the HTTP POST request along with the event payload. - `name` string, required — The name of the custom header. - `value` string, required — The value of the custom header. - `custom_payload_fields` object[] — Custom fields to be included in the webhook payload along with the event data. - `key` string, required — The key name for the custom field in the webhook payload. - `value` string, required — The value for the custom field. - PauseContractAction - `type` 'pause-contract' — Type discriminator for this object. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `pause` boolean, required — Whether to pause the contract. - SequencerAction - `type` 'sequencer' — Type discriminator for this object. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `target` 'target' | 'source', required — Target asset or entity selection for this rule or action. - `comment` string — Optional comment for this action. - `expiration_time` string, date-time — Timestamp for expiration time. - APICallAction - `type` 'api_call', required — Type discriminator for this object. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `url` string, required — Target URL. - `authentication` union - HMACAuthentication - `type` 'hmac', required — Type discriminator for this object. - `hmac_secret` string, required — Secret value for hmac secret authentication. - AuthorizationHeaderAuthentication - `type` 'authorization_header', required — Type discriminator for this object. - `value` string, required — Comparison value. - APIKeyAuthorization - `type` 'api_key', required — Type discriminator for this object. - `header_name` string, required — Header name used for API key authentication. - `api_key` string, required — Secret value for api key authentication. - BasicAuth - `type` 'basic_auth', required - `username` string, required - `password` string, required - `custom_headers` object — Additional headers to include in the request. - `request_type` 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', required — HTTP method to use. - `body` object — Request body payload. - `incident_payload_override` object[], required — Incident payload field overrides. - `key_to_override` string, required — Payload key to override. - `incident_field` 'targets' | 'attackers' | 'incident_name' | 'incident_start_date' | 'incident_end_date' | 'incident_duration' | 'severity' | 'dollars_funds_lost' | 'dollars_funds_exposed', required — Incident field mapped into the request payload. - CallContractAction - `type` 'contract_call', required — Type discriminator for this object. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `targets` union, required — Target asset or entity selection for this rule or action. - union[] - union - … - 'dynamic' - `via_router` object — Optional: route calls through these contracts (targets become $address parameter) - `contracts` AssetIDTarget[], required — Contracts used by this routing configuration. - `type` 'asset_id', required — Type discriminator for this object. - `identifier` string, required — Target identifier value. - `function_signature` string, required — e.g. 'transfer(address,uint256)' - `function_parameters` string[], required — Function arguments to pass. - `response_wallet` object, required — Wallet integration used for action responses. - `integration_instance_id` string, required — Identifier for the integration instance. - LabelEntityAction - `type` 'label_entity', required — Action type. - `severity` Severity[] — Incident severities this action runs for. When omitted, null, or an empty list, the action runs for incidents of any severity. Must not contain duplicate values. - `entity_from_incident` 'target' | 'source', required — Specifies which entity from the incident to label - either the target(s) or source(s) of the incident. - `label` 'account_takeover' | 'compromised' | 'custom_malicious' | 'investment_scam' | 'address_poisoning_impersonator_wallet' | 'address_poisoning_operator' | 'exploiter' | 'exploit_contract' | 'malicious_airdrop_operator' | 'wallet_drainer' | 'rugpull_operator' | 'malicious_implementation', required — The malicious label to apply to the entity. Available labels include classifications for various threat types such as drainers, exploiters, scams, and compromised entities. - `tags` string[] — Tags attached to the monitor for grouping and filtering. --- [API](https://skmtc.net/blockaid-official/apis/blockaid-api.md) · [All operations](https://skmtc.net/blockaid-official/apis/blockaid-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/blockaid-official/blockaid-api/versions/17c41f337b2e/schema)