Skip to main content
These endpoints summarize what your organization’s monitors are catching, so you can chart exposure over time and spot spikes. Four endpoints return figures. Two more read and set the default cadence for new monitors.
Two different things get counted. The overview, history and monthly distribution count result rows: the individual records your monitors found. Alert-hit statistics count matches: how many times a monitor recorded new results. One match can hold many rows, so the two figures usually differ. Pick the one that answers your question.

​
Availability and cost

Availability: every plan with a license in force. Cost: no metered allowance. With an API key, each call counts once toward your monthly API Calls allowance, and only 2xx responses count. See Rate limits. When your organization’s license is not active, every endpoint on this page returns 403:
See Plans and quotas and Errors.

​
Pick a period

The overview, history and alert-hit statistics require period. Each value is a rolling window that ends today, in UTC. It is not a calendar week, month or year. A missing or unknown period returns 400. The overview and history answer {"error": "Invalid request parameters"}. Alert-hit statistics answer {"error": "Invalid period. Must be one of: last_week, last_month, last_6_months, last_year, all_time"}.

​
Overview by source and day

alert_system_statistic_get_alert_overview returns one row per source per day:
  • service_ids narrows the rows to the sources you list, as comma-separated catalog IDs. Send integers only.
  • service_name is the source’s name in the service catalog, not its display alias.
  • count is every row your monitors recorded that day for that source, excluded rows included. excluded_count is how many of them an exclusion flagged.
  • Rows are sorted by date, oldest first, then by count, highest first.

​
History by day

alert_system_statistic_get_alert_history returns one row per day, with all sources added together:
Rows are sorted by date, oldest first. count and excluded_count mean the same as in the overview.

​
How fresh the overview and history are

The overview and history read a daily summary. The summary for today is refreshed each time a monitor records a match. Two things follow:
  • A day can be missing, or present with a count of 0. Fill the gaps yourself when you chart.
  • Deleting a match does not lower the overview or history figures for the day it was recorded, today included, unless another match for that source is recorded later that UTC day. The monthly distribution and alert-hit statistics are counted when you call, so after a delete the two sets of figures can differ.

​
Paging the overview and history

Both take page and page_size. page_size defaults to 10 and must be between 1 and 100. A larger value returns 400 with {"error": "Maximum allowed page_size is 100."}, and a page past the end returns 404. Build each page request yourself with page, and stop once you have read count rows. The next and previous values are passed through from the monitoring service and may not point at client-api.leak.center.

​
Monthly distribution

alert_system_statistic_get_monthly_match_count returns a plain list of 12 entries. It takes no period and is not paginated.
  • Entries run newest first. The first entry is the current calendar month in UTC, which is still in progress.
  • month is YYYY-MM. Key your chart on this value rather than on the entry’s position.
  • The 12 entries are not always 12 different months. A call made in March, April or May can leave out February and list January or December twice. Two entries with the same month carry the same figures, so keep one. To get February in those months, add up its daily rows from the history with period=last_6_months.
  • count is every row recorded that month across all sources, excluded rows included. excluded_count is the flagged subset. A month with nothing recorded returns 0.

​
Alert-hit statistics

alert_system_alert_get_alert_match_statistics counts matches per source per day:
  • The source filter here is named services, not service_ids. It takes comma-separated catalog IDs. A value that is not a list of integers returns 400 with {"error": "Invalid service IDs format. Please provide comma-separated integers."}.
  • By default, a match whose rows are all excluded is not counted. Send show_excluded=true to count it.
  • Rows are sorted by date, oldest first.
  • page_size defaults to 10. Values above 100 are capped at 100.
To list the matches behind a count, call the match list with the same service_id and a from_date and to_date for that day.

​
Your organization’s default cadence

A monitor created without frequency takes your organization’s default. Read it with alert_system_setting_get_organization_alert_frequency and change it with alert_system_setting_update_organization_alert_frequency:
  • default_alert_frequency takes the same six values as a monitor’s frequency: daily, twice_weekly, weekly, biweekly, twice_monthly and monthly. It starts as daily.
  • Always send default_alert_frequency. A PUT with an empty body resets the default to daily.
  • The default is applied once, when a monitor is created without frequency, and stored on that monitor. Changing the default later does not change existing monitors.
  • A monitor never runs more often than its source allows. When the default is faster than the source’s own frequency, the new monitor gets the source’s frequency instead.

​
Endpoints