| https://telesint-api.onrender.com/ioc IOC feed from Telegram CTI channels. Filters: ip (exact lookup), type(ip|domain|url|md5|sha1|sha256|cve), severity, min_confidence, since, tlp, tag, channel, limit, offset. Returns items[] with iocs[], ttps[], confidence, severity, tlp, tags[]. | base | USDC | $0.01 | exact |
| https://telesint-api.onrender.com/preparation Is someone preparing to attack this org, sector or country? Call before escalation decisions. Returns verdict escalate|watch|none, stage ladder with gaps, Dempster-Shafer belief/conflict, EWMA velocity, evidence IDs. | base | USDC | $0.10 | exact |
| https://telesint-api.onrender.com/darkweb Dark web intelligence from Telegram: marketplace listings, forum chatter, access broker posts, credential shops, Tor site activity. Filters: severity, min_confidence, since, tag, sector, country, organization, limit, offset. | base | USDC | $0.03 | exact |
| https://telesint-api.onrender.com/vulnerability CVE and exploitation-in-the-wild signals from Telegram CTI channels. Filters: severity, min_confidence, since, tag(cve|exploit|poc|patch), ttp, type(cve), limit, offset. Returns CVE IDs, affected products, exploit status. | base | USDC | $0.03 | exact |
| https://telesint-api.onrender.com/breach Breach disclosures from Telegram. Filters: sector, country, organization, severity, min_confidence, since, limit. Returns items[] with target{sectors,countries,organizations}, leak iocs[], confidence. | base | USDC | $0.03 | exact |
| https://telesint-api.onrender.com/claim-check Call before acting on a breach, ransomware or hacktivist claim. Tests it for recycling against earlier Telegram posts: verdict recycled|reused_template|previously_claimed|repost|no_prior_match with matching record IDs. | base | USDC | $0.05 | exact |
| https://telesint-api.onrender.com/watch/delete Deactivate a watchlist owned by the paying wallet. | base | USDC | $0.01 | exact |
| https://telesint-api.onrender.com/target-mentions Call when an agent needs to know whether an organisation is being named on Telegram: access sales, credential leaks, targeting announcements, compromise claims. Deduplicated, with specificity, first/last seen and record IDs. | base | USDC | $0.05 | exact |
| https://telesint-api.onrender.com/velocity Call on a schedule to detect tempo changes. Acceleration of Telegram threat activity per preparation stage and category for a sector/country/org (or global): window counts, EWMA, trend accelerating|new|flat|decelerating. | base | USDC | $0.03 | exact |
| https://telesint-api.onrender.com/watch/create Create a watchlist bound to the paying wallet (no account). Pass organizations (comma list, max 5), sector, country, actor, vendor, keywords. Returns watch_id for /watch/pull. | base | USDC | $0.02 | exact |
| https://telesint-api.onrender.com/watch/pull Pull a watchlist (same wallet that created it). Returns only records ingested since the last pull scored by requirement match, preparation verdict per target with transitions, and alerts. | base | USDC | $0.10 | exact |
| https://telesint-api.onrender.com/intent Pre-attack intent signals from Telegram: access sales, 0days, ransomware targeting. Filters: sector, country, organization, intent_type(access_sale|0day|ransomware|exploit), limit. Signals appear before attacks. | base | USDC | $0.05 | exact |