{"uid":"cap_-eAc8JqJVFxvg2wNVaCJy","slug":"telesint-watchlist-create-857ce0b2","name":"TeleSint Watchlist Create","description":"Create a watchlist bound to the paying wallet (no account). Pass organizations (comma list, max 5), sector, country, actor, vendor, keywords. Returns watch_id for /watch/pull.","url":"https://telesint-api.onrender.com/watch/create?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","properties":{"actor":{"type":"string","description":"Actor"},"sector":{"type":"string","description":"Sector"},"vendor":{"type":"string","description":"Vendor"},"window":{"type":"string","description":"Preparation window days 7-90, default 30"},"country":{"type":"string","description":"Country or region"},"keywords":{"type":"string","description":"Comma-separated keywords, max 10"},"organizations":{"type":"string","description":"Comma-separated organisations, max 5"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"next":"GET /watch/pull?watch_id=6f1d2c3b-4a5e-4f60-8a7b-9c0d1e2f3a4b","source":"TeleSint","endpoint":"watch/create","watch_id":"6f1d2c3b-4a5e-4f60-8a7b-9c0d1e2f3a4b","owner_wallet":"0xabc…"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_E9XA1bA_6HjlBeyNHKDAe","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Creates a persistent threat intelligence watchlist on TeleSint bound to the caller's wallet, monitoring Telegram for pre-attack signals matching specified organizations, sector, country, actor, vendor, and keywords.","exampleAgentPrompt":"Set up a TeleSint watchlist to monitor for pre-attack signals against Acme Corp and GlobalBank in the financial sector, focusing on the US and EU regions, and watch for keywords like 'ransomware', 'initial access', 'credential dump' over the next 30 days.","exampleUseCases":[{"title":"Financial sector ransomware threat monitoring","prompt":"Create a watchlist on TeleSint tracking ransomware and access sales targeting JPMorgan and Goldman Sachs in the banking sector, focused on the US, for a 30-day window — I want a watch_id so I can pull updates regularly."},{"title":"Healthcare org pre-attack surveillance","prompt":"Set up a threat watchlist for MedCorp and CityHospital in the healthcare sector, monitoring for keywords like 'patient data', '0day', 'VPN exploit' across any country, with a 60-day preparation window."},{"title":"Nation-state activity watch on critical infrastructure","prompt":"I need a TeleSint watchlist watching for threat actor 'Lazarus' activity targeting energy and utilities companies in South Korea and Japan — set it up with a 90-day window so I can pull alerts as they come in."}],"resultDescription":"Returns a watch_id (identifier string) that the caller uses with the /watch/pull endpoint to retrieve threat intelligence records ingested since the last pull. The watchlist is bound to the paying wallet and persists until deactivated.","failureModes":["Missing or invalid required parameters returns an error with no watch_id","Exceeding 5 organizations in the comma list causes a validation error","Window value outside 7–90 day range is rejected","Payment wallet not recognized or insufficient USDC balance causes a 402 payment required error","Duplicate watchlist creation for same parameters may succeed but creates a separate watch_id"],"whenToPreferThis":"Use this endpoint when you need continuous, pull-based monitoring of Telegram threat intelligence for a specific set of organizations, sectors, or threat actors — rather than a one-time query. It is the starting point for any recurring threat surveillance workflow on TeleSint; prefer it over ad-hoc search endpoints when you need to track new signals over time across a defined scope.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-20T06:40:35.890Z","isFirstParty":false,"canonicalSlug":"telesint-watchlist-create-857ce0b2"}