Intelligence flow

GET

attribution

flow

Account-scoped feed contribution paths with transport and self-reported skills

curl --request GET \
  --url https://api.example.com/v2/attribution/flow \
  --header 'Authorization: <api-key>'

const options = {method: 'GET', headers: {Authorization: '<api-key>'}};

fetch('https://api.example.com/v2/attribution/flow', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v2/attribution/flow",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v2/attribution/flow"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v2/attribution/flow")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "answers_without_feeds": 123,
  "complete": true,
  "displayed_contributions": 123,
  "feed_id": "<string>",
  "omitted_contributions": 123,
  "paths": [
    {
      "feed_id": "<string>",
      "transport": "rest",
      "agent_key": "<string>",
      "agent_key_type": "<string>",
      "skill_id": "<string>",
      "skill_version": "<string>",
      "contributions": 123,
      "api_key_name": "<string>",
      "api_key_revoked": true
    }
  ],
  "since": "<string>",
  "status": "ok",
  "total_contributions": 123,
  "unique_answers": 123,
  "unit": "feed_contributions",
  "unknown_transport_contributions": 123,
  "unreported_skill_contributions": 123,
  "until": "<string>"
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>",
      "ctx": {},
      "input": "<unknown>"
    }
  ]
}

Requires read:intel. The account comes from your authenticated credentials. window_days defaults to 30 and accepts 1–90. Optional feed_id restricts both contributions and unique recorded answers to that feed. since is inclusive; until is exclusive.

Counts and coverage

Each paths entry describes a feed, transport, agent identity, and optional skill. contributions counts one response once per contributing feed. A response supported by two feeds contributes twice across the full flow. unique_answers counts recorded response IDs; it is not a count of investigations, agent-written reports, or confirmed detections. Responses without recorded feeds appear in answers_without_feeds. These records cover captured attribution, not necessarily all account activity. transport is mcp, rest, or unknown. Historical missing metadata and unverified transport both appear as unknown; the dashboard labels this combined category API/MCP, without claiming which transport was used. Skill IDs and versions are self-reported. Missing skill metadata stays null.

Agent identity and API-key fallback

Explicit agent IDs, connection identities, and caller-reported agent names take precedence. When a record only identifies a principal or has no agent identity, the flow can recover the API key from the matching account-scoped usage request:

agent_key_type: "api_key" means agent_key is the immutable API key ID.
api_key_name is the key’s current display name, or null when unavailable.
api_key_revoked is true when the recovered key ID has no matching key row, false when the row exists, and null for identities that are not API-key fallbacks.
Renaming a key changes the name displayed for historical activity. This field is not a snapshot of its name at request time.
Duplicate names remain separate because grouping uses key IDs. A shared key identifies a credential, not necessarily one agent.
Missing usage records or null key IDs cannot be used to recover a key. Raw principal IDs can remain in the API response; the dashboard displays Agent not identified instead.

For an existing key with no label, display its key ID. When api_key_revoked is true, display Revoked API key and reveal the key ID on hover. Missing key names alone do not establish revocation. Keep IDs accessible to disambiguate duplicate labels. Both key metadata fields are additive; tolerate them being absent on earlier API versions without treating an absent revocation flag as proof of revocation.

Partial results

At most 5,000 paths are returned. If complete is false, use displayed_contributions for rendered path totals and report omitted_contributions. total_contributions covers the complete selection. A feed filter recomputes the selection rather than merely hiding other paths. unknown_transport_contributions and unreported_skill_contributions describe metadata coverage. Database failures return unavailable responses rather than successful zero counts.

Authorizations

Authorization

string

header

required

ApiKey <key_id>:

Query Parameters

window_days

integer

default:30

Required range: 1 <= x <= 90

feed_id

string | null

Required string length: 1 - 64

Response

Successful Response

answers_without_feeds

integer

required

complete

boolean

required

displayed_contributions

integer

required

feed_id

string | null

required

omitted_contributions

integer

required

paths

AttributionFlowPath · object[]

required

Show child attributes

since

string

required

status

enum<string>

required

Available options:

ok,

no_results

total_contributions

integer

required

unique_answers

integer

required

unit

string

required

Allowed value: "feed_contributions"

unknown_transport_contributions

integer

required

unreported_skill_contributions

integer

required

until

string

required

⌘I

Account-scoped feed contribution paths with transport and self-reported skills

curl --request GET \
  --url https://api.example.com/v2/attribution/flow \
  --header 'Authorization: <api-key>'

const options = {method: 'GET', headers: {Authorization: '<api-key>'}};

fetch('https://api.example.com/v2/attribution/flow', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v2/attribution/flow",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v2/attribution/flow"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v2/attribution/flow")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "answers_without_feeds": 123,
  "complete": true,
  "displayed_contributions": 123,
  "feed_id": "<string>",
  "omitted_contributions": 123,
  "paths": [
    {
      "feed_id": "<string>",
      "transport": "rest",
      "agent_key": "<string>",
      "agent_key_type": "<string>",
      "skill_id": "<string>",
      "skill_version": "<string>",
      "contributions": 123,
      "api_key_name": "<string>",
      "api_key_revoked": true
    }
  ],
  "since": "<string>",
  "status": "ok",
  "total_contributions": 123,
  "unique_answers": 123,
  "unit": "feed_contributions",
  "unknown_transport_contributions": 123,
  "unreported_skill_contributions": 123,
  "until": "<string>"
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>",
      "ctx": {},
      "input": "<unknown>"
    }
  ]
}

Overview

Health

Auth

Resolution

Intel and evidence

Relationships

Prioritize

Enterprise feeds

Assessments

Attribution

Counts and coverage

Agent identity and API-key fallback

Partial results

Authorizations

Query Parameters

Response