api
read-only json, regenerated with the database. no keys, no rate limits beyond politeness, no server: every url is a file. an agent can start from api/index.json or api/openapi.json, and there is an llms.txt.
one thing with everything attached
| GET /api/incident/{id}.json | the docket: incident row, milestones, venues with counts, findings, defences, recommendations, figures, claims |
| GET /api/campaign/{id}.json | campaign row, its clusters, style fingerprints, figures, claims, record and handle counts |
| GET /api/cluster/{id}.json | cluster row, counts, claims |
| GET /api/venue/{id}.json | venue row, counts, records by kind and month, most active handles, links to other venues, claims |
| GET /api/tracker/{id}.json | who holds data, and the evidence rows from them |
whole tables
| GET /api/incidents.json | all incidents |
| GET /api/campaigns.json | all campaigns |
| GET /api/clusters.json | all clusters |
| GET /api/venues.json | all venues |
| GET /api/venue_links.json | venue to venue edges with evidence |
| GET /api/claims.json | the claim register |
| GET /api/evidence.json | the sources |
| GET /api/trackers.json | who holds data |
| GET /api/categories.json | the codebook |
| GET /api/findings.json | findings with status |
| GET /api/defences.json | defence layers per incident |
| GET /api/recommendations.json | recommendations with addressee and status |
bulk
| GET /pub/manifest.json | row counts and sha256 per table, schema version |
| GET /pub/schema.json | json schema derived from the sqlite ddl: types, required fields, enums |
| GET /pub/{table}.jsonl | every table as jsonl, including record (80k+ rows) and edge (16k) |
| GET /pub/incidents.sqlite | the whole database as one sqlite file, about 50 mb. sqlite3, datasette, pandas, or sql.js in a browser |
| GET /pub/datasets/datasets.json | the dataset bundles with sizes and sha256: agent paste bodies, anonymised recent-changes records per venue, the xz ciphertext collection |
what to trust
a row is a fact about a record or a source. a claim is an assertion by someone, with status one of verified (we hold the bytes), inferred (a reading of them), reported (someone else's claim, unchecked by us), contradicted. made_by and checked_by are evidence ids. findings carry assessed, probable or established. read the status before the text.
what's been removed
people are human-N with one stable number per name across venues, so a conversation between two people is still followable and neither is named. residential ips are masked to /24 or the registered domain; cloud ranges are kept. record bodies are not carried, only their hashes and lengths. encoded payloads are described by shape.
manners
it's static files on a small box. fetch what you need, cache it, and if you're building on it say hello: roarch@proton.me. if you hold records we don't, the schema is the offer.