Events API

The Events API exposes tracker events and event history for automation. Use it for incremental polling, internal alerting, enrichment workflows, and pivots from a company, domain, actor, country, sector, or event status.

Endpoints

GET  /api/v1/events/list/
GET  /api/v1/events/list/from/{from}/to/{to}/
POST /api/v1/events/list/
POST /api/v1/events/list/from/{from}/to/{to}/
GET  /api/v1/events/view/{id}/
GET  /api/v1/events/search/{query}/
GET  /api/v1/events/search/{query}/from/{from}/to/{to}/
GET  /api/v1/events/historySearch/?query={query}
GET  /api/v1/events/status/{status}/
GET  /api/v1/events/status/{status}/from/{from}/to/{to}/
GET  /api/v1/events/sectorGroups/
GET  /api/v1/events/extensionArchive/

from and to accept the date formats supported by the live API, including YYYY-MM-DD values and UNIX timestamps where applicable. When no date range is supplied, the list endpoint returns the API’s default recent window.

Endpoint Details

GET /events/list/ returns recent tracker events. Use this for simple polling when you do not need filters.

GET /events/list/from/{from}/to/{to}/ returns tracker events first seen inside the requested time range. This is the preferred endpoint for scheduled imports because your integration can store the last successful timestamp and resume from there.

POST /events/list/ and POST /events/list/from/{from}/to/{to}/ accept the same list behavior, plus optional filters in the request body. Use POST when filtering by sector, actor, domain, country, or employee count.

GET /events/view/{id}/ returns the full event object for one event ID. Use it after a list or search result when you need the complete details.

GET /events/search/{query}/ searches event data for a company, domain, title, actor, country, sector, or related metadata.

GET /events/historySearch/?query={query} searches historical event detail snapshots and post content.

GET /events/status/{status}/ returns events that received a specific status marker.

GET /events/sectorGroups/ returns the maintained combined sector groups that can be used with the sector_group filter.

Filters

POST /events/list/ and date-range list requests support filters such as:

sector
sector_group
actor
domain
country
employees

Filters may be sent as form fields. Some integrations send repeated fields or array-style keys for multi-value filtering.

Sector vs. Sector Group

Use sector when you want to match one exact raw sector value as it appears on event objects. This is best for precise queries where your integration already knows the exact sector label, such as Hospitals and Health Care or Oil and Gas.

Use sector_group when you want a maintained broad category such as Healthcare and Medical, Finance and Insurance, or Information Technology and Services. A sector group expands server-side to its member raw sectors, so this is the safer choice for monitoring, alerting, and broad industry searches where raw sector labels may vary or change over time.

sector and sector_group can be used together. The list endpoint returns events matching either the raw sector value or any raw sector inside the requested group.

Sector groups are maintained by eCrime.ch and are exposed through:

curl -X GET "https://ecrime.ch/api/v1/events/sectorGroups/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

Example response shape:

{
  "status": "200",
  "message": "OK",
  "results": 1,
  "data": [
    {
      "name": "Healthcare and Medical",
      "sectors": [
        "Hospitals and Health Care",
        "Medical Practice",
        "Pharmaceutical Manufacturing"
      ]
    }
  ]
}

Example exact raw-sector POST request:

curl -X POST "https://ecrime.ch/api/v1/events/list/from/2026-06-01/to/2026-06-17/" \
  -H "X-API-Key: YOUR_API_KEY_HERE" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "sector=Hospitals and Health Care"

Example combined-sector POST request:

curl -X POST "https://ecrime.ch/api/v1/events/list/from/2026-06-01/to/2026-06-17/" \
  -H "X-API-Key: YOUR_API_KEY_HERE" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "sector_group=Healthcare and Medical"

Example multiple combined-sector POST request:

curl -X POST "https://ecrime.ch/api/v1/events/list/from/2026-06-01/to/2026-06-17/" \
  -H "X-API-Key: YOUR_API_KEY_HERE" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "sector_group[]=Healthcare and Medical" \
  --data-urlencode "sector_group[]=Finance and Insurance"

Example multi-filter POST request:

curl -X POST "https://ecrime.ch/api/v1/events/list/" \
  -H "X-API-Key: YOUR_API_KEY_HERE" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "country=United States&actor=Akira&sector_group=Healthcare and Medical"

Comments

Authenticated users can add and manage their own event comments:

POST /api/v1/events/addComment/{id}/
GET  /api/v1/events/deleteComment/{id}/
GET  /api/v1/events/listComments/

Deleting a comment requires the comment ID, not the event ID.

GET Example

curl -X GET "https://ecrime.ch/api/v1/events/list/from/2026-06-01/to/2026-06-17/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

Search Example

curl -X GET "https://ecrime.ch/api/v1/events/search/example.com/" \
  -H "X-API-Key: YOUR_API_KEY_HERE"

Sample Response

{
  "status": "200",
  "message": "OK",
  "date": 1781677568,
  "results": 1,
  "data": [
    {
      "id": 15152,
      "first_seen": "2023-07-09 05:31:14.000000+00:00",
      "last_seen": "2023-07-09 14:16:34.000000+00:00",
      "leak_site": "8BASE",
      "leak_title": "Cabra Consulting Ltd",
      "country": "Canada",
      "sector": "Oil and Gas",
      "name": "Cabra Consulting Ltd.",
      "website": "https://www.cabra.ca/",
      "employees": "11-50 employees",
      "revenue": "$5 Million",
      "stock_symbol": null,
      "leak_url": "http://example.onion/company/7890167",
      "duplicate": null,
      "data_leak": 0,
      "last_update": "2023-07-09 05:32:34.000000+00:00",
      "logo": "https://ecrime.ch/image/logos/example.jpg",
      "keyword": "false",
      "links": [
        {
          "url": "https://www.cabra.ca/security-notice/",
          "title": "Security Notice",
          "date": "2023-07-09"
        }
      ],
      "status": [
        {
          "name": "initial",
          "date": 1688913874
        },
        {
          "name": "enriched",
          "date": 1688914200
        }
      ]
    }
  ]
}

The response envelope is stable across endpoints. results is the number of returned items, and data contains event objects. Event objects may include nullable enrichment fields when no company match or enrichment value exists yet.

Status Values

Common status filters include:

initial
enriched
data_leak
screenshot
comment_added
comment_deleted
dls_removed