Seqlense docs

Alerts

Business alerts raised by Seqlense itself (market abuse scans, order-book abuse runs) or by your own services through the API.

List alerts

GET
/v1/alerts/

Returns one page of the workspace's alerts, newest first (created_at descending), with the total number of alerts matching the same filters.

All filters are exact matches and are combined with AND. An empty value (status=) is ignored, not treated as "equals empty". A tag_id that is not a UUID v4 and a q longer than 100 characters are silently dropped. A from / to that is not a valid YYYY-MM-DD date is ignored.

Authorization

ApiKeyAuth
AuthorizationBearer <token>

Send your API key as a bearer token: Authorization: Bearer sq_YOUR_API_KEY.

In: header

Query Parameters

status?string

Filter by status.

Value in

  • "OPEN"
  • "ACKNOWLEDGED"
  • "RESOLVED"
  • "MUTED"
severity?string

Filter by severity.

Value in

  • "INFO"
  • "MEDIUM"
  • "HIGH"
  • "CRITICAL"
source?string

Filter by source, exact match (for example market_abuse).

entity_type?string

Filter by entity type, exact match (for example WALLET, IDENTITY, OB_CLIENT).

tag_id?string

Only alerts carrying this tag. Ignored unless it is a UUID v4.

Formatuuid
from?string

First day included (YYYY-MM-DD, compared with created_at).

Formatdate
to?string

Last day included (YYYY-MM-DD). The whole day is included.

Formatdate
q?string

Substring search in title, message and source. Ignored if longer than 100 characters.

Lengthlength <= 100
page?integer

1-based page number, clamped to 1..10000.

Range1 <= value <= 10000
Default1
limit?integer

Page size, clamped to 10..100 (values below 10 become 10).

Range10 <= value <= 100
Default20

Response Body

application/json

application/json

curl -X GET "https://example.com/v1/alerts/"
{  "alerts": [    {      "id": "5b1f7c1e-2a4d-4c8e-9f3a-8d2e6b0c1a47",      "source": "market_abuse",      "severity": "HIGH",      "title": "Market abuse detected on 0xd90e...f31b",      "message": "Scan flagged wash_trading (score 74, threshold 60).",      "entity_type": "WALLET",      "entity_id": "9a0c3e2b-7d41-4f5a-b6e8-1c2d3e4f5a6b",      "status": "OPEN",      "created_at": "2026-09-24 14:02:11"    }  ],  "total": 1,  "page": 1,  "limit": 20}

Create an alert

POST
/v1/alerts/

Raises an alert in the workspace. The alert is stored with status OPEN, written to the alert history, and dispatched to every active notification channel whose filters match (see Notification Channels).

Delivery happens before the response is returned: the call waits for the webhook, Discord and Slack requests to finish (each has a 10 second timeout), so a slow receiver slows this call down. Delivery failures never fail the call; they are recorded on the alert (deliveries in GET /v1/alerts/detail).

severity and entity_type are upper-cased before validation and storage, so high is accepted and stored as HIGH. No de-duplication is applied: posting the same alert twice creates two alerts.

Authorization

ApiKeyAuth
AuthorizationBearer <token>

Send your API key as a bearer token: Authorization: Bearer sq_YOUR_API_KEY.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/v1/alerts/" \  -H "Content-Type: application/json" \  -d '{    "source": "my-risk-engine",    "severity": "HIGH",    "title": "Unusual counterparty",    "message": "Wallet 0xabc... received funds from a newly created address.",    "entity_type": "WALLET",    "entity_id": "9a0c3e2b-7d41-4f5a-b6e8-1c2d3e4f5a6b",    "metadata": {      "tx_hash": "0x1234...",      "amount": "150",      "currency": "ETH"    }  }'
{  "status": "ok",  "id": "5b1f7c1e-2a4d-4c8e-9f3a-8d2e6b0c1a47"}

Delete an alert

DELETE
/v1/alerts/

Permanently deletes an alert and its delivery records. Its entry in the alert history is kept. Returns {"status":"ok"} even when no alert with this id exists in the workspace.

Authorization

ApiKeyAuth
AuthorizationBearer <token>

Send your API key as a bearer token: Authorization: Bearer sq_YOUR_API_KEY.

In: header

Query Parameters

id*string

Alert ID.

Formatuuid

Response Body

application/json

application/json

application/json

curl -X DELETE "https://example.com/v1/alerts/?id=497f6eca-6276-4993-bfeb-53cbbbba6f08"
{  "status": "ok"}

Acknowledge an alert

POST
/v1/alerts/acknowledge

Moves an OPEN alert to ACKNOWLEDGED and records who (acknowledged_by) and when (acknowledged_at). With an API key, acknowledged_by is 0.

Only OPEN alerts change. The call returns {"status":"ok"} even when the alert does not exist or is not OPEN (nothing is changed then).

Authorization

ApiKeyAuth
AuthorizationBearer <token>

Send your API key as a bearer token: Authorization: Bearer sq_YOUR_API_KEY.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/v1/alerts/acknowledge" \  -H "Content-Type: application/json" \  -d '{    "id": "5b1f7c1e-2a4d-4c8e-9f3a-8d2e6b0c1a47"  }'
{  "status": "ok"}

Acknowledge or resolve many alerts

POST
/v1/alerts/bulk-action

Applies acknowledge or resolve to up to 100 alerts at once, with the same status rules as the single-alert endpoints. action is case-insensitive. Entries of ids that are not UUID v4 strings are dropped before the count is checked; ids that do not exist are skipped silently.

Authorization

ApiKeyAuth
AuthorizationBearer <token>

Send your API key as a bearer token: Authorization: Bearer sq_YOUR_API_KEY.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/v1/alerts/bulk-action" \  -H "Content-Type: application/json" \  -d '{    "action": "resolve",    "ids": [      "5b1f7c1e-2a4d-4c8e-9f3a-8d2e6b0c1a47",      "0c7d2a91-5e3b-4f60-8a1d-2b3c4d5e6f70"    ]  }'
{  "status": "ok"}

Count alerts

GET
/v1/alerts/count

Returns workspace-wide alert counts for dashboard badges. Takes no parameters and ignores filters.

Authorization

ApiKeyAuth
AuthorizationBearer <token>

Send your API key as a bearer token: Authorization: Bearer sq_YOUR_API_KEY.

In: header

Response Body

application/json

application/json

curl -X GET "https://example.com/v1/alerts/count"
{  "total": 128,  "open": 9,  "critical_open": 2}

Get an alert

GET
/v1/alerts/detail

Returns one alert with its parsed metadata, its resolved subject, up to 10 other alerts on the same subject (related), and every notification delivery attempt (deliveries).

Authorization

ApiKeyAuth
AuthorizationBearer <token>

Send your API key as a bearer token: Authorization: Bearer sq_YOUR_API_KEY.

In: header

Query Parameters

id*string

Alert ID.

Formatuuid

Response Body

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/v1/alerts/detail?id=497f6eca-6276-4993-bfeb-53cbbbba6f08"
{  "id": "5b1f7c1e-2a4d-4c8e-9f3a-8d2e6b0c1a47",  "source": "market_abuse",  "severity": "HIGH",  "title": "Market abuse detected on 0xd90e...f31b",  "message": "Scan flagged wash_trading (score 74, threshold 60).",  "entity_type": "WALLET",  "entity_id": "9a0c3e2b-7d41-4f5a-b6e8-1c2d3e4f5a6b",  "subject": {    "kind": "WALLET",    "label": "0xd90e2f925da726b50c4ed8d0fb90ad053324f31b",    "url": "/w/detail/9a0c3e2b-7d41-4f5a-b6e8-1c2d3e4f5a6b",    "identity": null  },  "related": [    {      "id": "0c7d2a91-5e3b-4f60-8a1d-2b3c4d5e6f70",      "severity": "MEDIUM",      "title": "Market abuse detected on 0xd90e...f31b",      "status": "RESOLVED",      "created_at": "2026-09-10 08:15:42"    }  ],  "metadata": {    "scan_id": "2966a324-2b67-48ee-a0e1-3fe6b123e1b2"  },  "status": "ACKNOWLEDGED",  "acknowledged_by": 42,  "acknowledged_at": "2026-09-24 14:30:05",  "resolved_by": null,  "resolved_at": "",  "created_at": "2026-09-24 14:02:11",  "deliveries": [    {      "id": "7e8f9a0b-1c2d-4e3f-8a5b-6c7d8e9f0a1b",      "status": "DELIVERED",      "channel_name": "Slack #compliance",      "channel_type": "SLACK",      "response_code": 200,      "error_message": "",      "delivered_at": "2026-09-24 14:02:12"    }  ]}

Detector signal heatmap

GET
/v1/alerts/heatmap

Which detector signals fire most across every scan of one source, grouped by pattern. Built from the per-run signal tallies of market abuse scans (market_abuse) or order-book abuse runs (orderbook_abuse), not from alerts: a run that raised no alert still counts.

hits is how many times a signal was confirmed, evaluated how many times it could be assessed, and rate = hits / evaluated rounded to 3 decimals (0 when nothing was assessable). Patterns are sorted by hits descending; inside a pattern, signals are sorted by hits descending then id. Signals that never fired are listed by label in quiet instead of signals.

Authorization

ApiKeyAuth
AuthorizationBearer <token>

Send your API key as a bearer token: Authorization: Bearer sq_YOUR_API_KEY.

In: header

Query Parameters

source*string

Which scanner's runs to aggregate.

Value in

  • "market_abuse"
  • "orderbook_abuse"
days?integer

Window in days back from now, clamped to 0..3650. 0 means all time.

Range0 <= value <= 3650
Default30

Response Body

application/json

application/json

application/json

curl -X GET "https://example.com/v1/alerts/heatmap?source=market_abuse"
{  "runs": 12,  "patterns": [    {      "pattern": "wash_trading",      "title": "Wash trading",      "hits": 20,      "rate": 0.5,      "quiet": [],      "signals": [        {          "id": "w1",          "label": "Self-matched trades",          "hits": 20,          "evaluated": 40,          "rate": 0.5        }      ]    },    {      "pattern": "pump_dump",      "title": "Pump and dump",      "hits": 10,      "rate": 0.333,      "quiet": [        "Volume spike before listing"      ],      "signals": [        {          "id": "p2",          "label": "Price run-up then sell-off",          "hits": 7,          "evaluated": 10,          "rate": 0.7        },        {          "id": "p1",          "label": "Coordinated buys",          "hits": 3,          "evaluated": 10,          "rate": 0.3        }      ]    }  ]}

List an alert's notes

GET
/v1/alerts/notes

Returns the investigation notes attached to an alert, newest first. An unknown alert id returns an empty list, not a 404.

Authorization

ApiKeyAuth
AuthorizationBearer <token>

Send your API key as a bearer token: Authorization: Bearer sq_YOUR_API_KEY.

In: header

Query Parameters

alert_id*string

Alert ID.

Formatuuid

Response Body

application/json

application/json

application/json

curl -X GET "https://example.com/v1/alerts/notes?alert_id=497f6eca-6276-4993-bfeb-53cbbbba6f08"
{  "notes": [    {      "id": "3d4e5f60-7182-4a93-b4c5-d6e7f8091a2b",      "text": "Counterparty is a known OTC desk, checking with the client.",      "created_by": 42,      "created_by_name": "Jane Doe",      "created_at": "2026-09-24 15:10:00"    }  ]}

Add a note to an alert

POST
/v1/alerts/notes

Attaches a note to an alert of the workspace. text is trimmed and must then be 1 to 2000 characters. Notes written with an API key have created_by = 0.

Authorization

ApiKeyAuth
AuthorizationBearer <token>

Send your API key as a bearer token: Authorization: Bearer sq_YOUR_API_KEY.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/alerts/notes" \  -H "Content-Type: application/json" \  -d '{    "alert_id": "5b1f7c1e-2a4d-4c8e-9f3a-8d2e6b0c1a47",    "text": "Counterparty is a known OTC desk, checking with the client."  }'
{  "status": "ok",  "id": "3d4e5f60-7182-4a93-b4c5-d6e7f8091a2b"}

Delete a note

DELETE
/v1/alerts/notes

Deletes a note by its own id (not the alert id). Returns 404 when no note with this id exists in the workspace.

Authorization

ApiKeyAuth
AuthorizationBearer <token>

Send your API key as a bearer token: Authorization: Bearer sq_YOUR_API_KEY.

In: header

Query Parameters

id*string

Note ID.

Formatuuid

Response Body

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/v1/alerts/notes?id=497f6eca-6276-4993-bfeb-53cbbbba6f08"
{  "status": "ok"}

Resolve an alert

POST
/v1/alerts/resolve

Moves an OPEN or ACKNOWLEDGED alert to RESOLVED and records resolved_by / resolved_at. With an API key, resolved_by is 0. There is no way back: a resolved alert cannot be reopened.

Returns {"status":"ok"} even when the alert does not exist or is already resolved.

Authorization

ApiKeyAuth
AuthorizationBearer <token>

Send your API key as a bearer token: Authorization: Bearer sq_YOUR_API_KEY.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/v1/alerts/resolve" \  -H "Content-Type: application/json" \  -d '{    "id": "5b1f7c1e-2a4d-4c8e-9f3a-8d2e6b0c1a47"  }'
{  "status": "ok"}

Order Book Abuse

Order-book market-abuse runs.

Notification Channels

Where alerts are forwarded when they are created: a generic webhook (optionally HMAC-SHA256 signed), a Discord webhook, a Slack incoming webhook, or in-app.