{"uid":"cap_MQuTf1SR8MI5w9ZhnKqUs","slug":"2s-ioc-reputation-watcher-102f4df2","name":"2s IOC Reputation Watcher","description":"The (most) everything API: 575+ pay-per-call endpoints for AI agents — ground-truth data, a full AI gateway, and agent infrastructure (storage, queues, watchers). USDC via x402, no signup, no API keys, and upto billing: pay actual usage, not the quote.","url":"https://2s.io/api/watchers/ioc-reputation","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"ioc":{"type":"string","maxLength":255,"minLength":3,"description":"Indicator to watch: an IP address or domain."},"label":{"type":"string","maxLength":64,"description":"Optional free-text tag."},"payload":{"type":"object","description":"Arbitrary JSON echoed back in every callback.","additionalProperties":{}},"maxFires":{"type":"integer","maximum":1000,"minimum":1,"description":"Stop after this many changes (default 10)."},"callbackUrl":{"type":"string","maxLength":2048,"description":"Signed event POSTed here (verify X-2s-Signature). Any http(s) URL."},"expiresInSeconds":{"type":"integer","maximum":7776000,"minimum":60,"description":"Active window in seconds (default 30d, max 90d)."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.125","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.125/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.125","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.125","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_autE8-S142mGY0bXIWxoa","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.125","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Registers a persistent webhook watcher on an IP address or domain that fires a signed callback whenever the target's threat-intelligence reputation changes.","exampleAgentPrompt":"Set up a reputation watcher on the IP 185.220.101.45 and POST signed alerts to https://hooks.myapp.com/ioc-events with a label 'tor-exit-node' whenever its threat status changes — stop after 50 changes and expire in 30 days.","exampleUseCases":[{"title":"Automated malware C2 domain tracking","prompt":"Watch the domain evil-c2-server.ru for any reputation changes and send a signed callback to https://soc.acme.com/webhooks/ioc with the label 'c2-suspect' whenever it fires — run for up to 90 days and stop after 100 events."},{"title":"Dynamic IP blocklist enforcement","prompt":"Set up a watcher on 203.0.113.77 that POSTs to https://firewall.internal/update whenever its AbuseIPDB or threat-intel reputation changes, tag it 'untrusted-egress', and include a JSON payload with {\"assetId\": \"prod-db-01\"} so my firewall knows which asset to protect."},{"title":"Third-party vendor domain surveillance","prompt":"Monitor supplier-domain.com for any reputation or blacklist changes and alert https://risk.mycompany.com/vendor-alerts — label it 'vendor-acme', expire the watcher in 60 days, and stop firing after 20 events."}],"resultDescription":"Returns a JSON object confirming watcher registration with ok: true, an items array containing the watcher record, the total count, and a source object identifying the underlying threat-intelligence provider, its URL, and license. After registration, signed HTTP POST callbacks are delivered to the specified callbackUrl whenever the IOC's reputation changes, with an X-2s-Signature header for verification.","failureModes":["Invalid or too-short IOC string (fails minLength:3 validation)","callbackUrl is unreachable or returns non-2xx — callbacks may be dropped","expiresInSeconds exceeds 90-day maximum (7776000 seconds)","maxFires exceeds 1000 limit","Malformed callbackUrl (not a valid http/https URL)","No reputation data available for the given IOC — watcher registered but never fires","USDC payment failure via x402 — endpoint returns 402 without creating watcher"],"whenToPreferThis":"Choose this endpoint when you need continuous, event-driven monitoring of a specific IP or domain's threat reputation rather than a one-time lookup. It is ideal for SOC automation, dynamic firewall rule updates, or vendor risk monitoring where you want push notifications on reputation changes without polling. Prefer it over static IOC lookup endpoints when the indicator is long-lived and reputation drift matters.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T19:07:26.907Z","isFirstParty":false}