Events API

The Events API exposes tracker events and event history for automation. Use it for incremental polling, internal alerting, enrichment workflows, and pivots from a company, domain, actor, country, sector, or event status.

Endpoints

GET  /api/v1/events/list/
GET  /api/v1/events/list/from/{from}/to/{to}/
POST /api/v1/events/list/
POST /api/v1/events/list/from/{from}/to/{to}/
GET  /api/v1/events/view/{id}/
GET  /api/v1/events/search/{query}/
GET  /api/v1/events/search/{query}/from/{from}/to/{to}/
GET  /api/v1/events/historySearch/?query={query}
GET  /api/v1/events/status/{status}/
GET  /api/v1/events/status/{status}/from/{from}/to/{to}/
GET  /api/v1/events/extensionArchive/

from and to accept the date formats supported by the live API, including YYYY-MM-DD values and UNIX timestamps where applicable. When no date range is supplied, the list endpoint returns the API’s default recent window.

Endpoint Details

GET /events/list/ returns recent tracker events. Use this for simple polling when you do not need filters.

GET /events/list/from/{from}/to/{to}/ returns tracker events first seen inside the requested time range. This is the preferred endpoint for scheduled imports because your integration can store the last successful timestamp and resume from there.

POST /events/list/ and POST /events/list/from/{from}/to/{to}/ accept the same list behavior, plus optional filters in the request body. Use POST when filtering by sector, actor, domain, country, or employee count.

GET /events/view/{id}/ returns the full event object for one event ID. Use it after a list or search result when you need the complete details.

GET /events/search/{query}/ searches event data for a company, domain, title, actor, country, sector, or related metadata.

GET /events/historySearch/?query={query} searches historical event detail snapshots and post content.

GET /events/status/{status}/ returns events that received a specific status marker.

Filters

POST /events/list/ and date-range list requests support filters such as:

• sector
• actor
• domain
• country
• employees

Filters may be sent as form fields. Some integrations send repeated fields or array-style keys for multi-value filtering.

Example single-filter POST request:

curl -X POST "https://ecrime.ch/api/v1/events/list/from/2026-06-01/to/2026-06-17/" \
  -H "X-API-Key: YOUR_API_KEY_HERE" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "sector=Healthcare"

Example multi-filter POST request:

curl -X POST "https://ecrime.ch/api/v1/events/list/" \
  -H "X-API-Key: YOUR_API_KEY_HERE" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "country=United States&actor=Akira&domain=example.com"

Comments

Authenticated users can add and manage their own event comments:

POST /api/v1/events/addComment/{id}/
GET  /api/v1/events/deleteComment/{id}/
GET  /api/v1/events/listComments/

Deleting a comment requires the comment ID, not the event ID.

GET Example

curl -X GET "https://ecrime.ch/api/v1/events/list/from/2026-06-01/to/2026-06-17/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

Search Example

curl -X GET "https://ecrime.ch/api/v1/events/search/example.com/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

Sample Response

{
  "status": "200",
  "message": "OK",
  "date": 1781677568,
  "results": 1,
  "data": [
    {
      "id": 15152,
      "first_seen": "2023-07-09 05:31:14.000000+00:00",
      "last_seen": "2023-07-09 14:16:34.000000+00:00",
      "leak_site": "8BASE",
      "leak_title": "Cabra Consulting Ltd",
      "country": "Canada",
      "sector": "Oil and Gas",
      "name": "Cabra Consulting Ltd.",
      "website": "https://www.cabra.ca/",
      "employees": "11-50 employees",
      "revenue": "$5 Million",
      "stock_symbol": null,
      "leak_url": "http://example.onion/company/7890167",
      "duplicate": null,
      "data_leak": 0,
      "last_update": "2023-07-09 05:32:34.000000+00:00",
      "logo": "https://ecrime.ch/image/logos/example.jpg",
      "keyword": "false",
      "links": [
        {
          "url": "https://www.cabra.ca/security-notice/",
          "title": "Security Notice",
          "date": "2023-07-09"
        }
      ],
      "status": [
        {
          "name": "initial",
          "date": 1688913874
        },
        {
          "name": "enriched",
          "date": 1688914200
        }
      ]
    }
  ]
}

The response envelope is stable across endpoints. results is the number of returned items, and data contains event objects. Event objects may include nullable enrichment fields when no company match or enrichment value exists yet.

Status Values

Common status filters include:

• initial
• enriched
• data_leak
• screenshot
• comment_added
• comment_deleted
• dls_removed