Watchlists API

Base Information

• Method: POST

• Endpoint: https://api.whiteintel.io/watchlist_manage.php

• Content-Type: application/json

• Auth: API key in the request body (apikey)

---

Supported Actions

The endpoint is action-based. Send an action field with one of:

• list

• add

• remove

• enable

• disable

---

Entry Types & Access

Allowed entry_type values:

• domain

• email

• computername (requires TIFirm plan)

• ip (requires TIFirm plan)

• keyword

• github_repo

Access to specific types depends on your subscription. If your plan doesn’t include a type (e.g., TIFirm-only), the API returns a 403 Forbidden.

Integrations (Slack and Jira)

To enable Slack notification push: push_to_slack: 1

To enable Jira push:

push_to_jira: 1

In order to set integrations, initial configuration of must be completed via Web-ui under the Organizations page.

---

Credits (Per Type)

Adding a new watchlist item consumes 1 credit for that item’s type. Removing an item refunds 1 credit for that type. Enabling/disabling does not change credits.

If no credits remain for a type, the API returns 402 with a generic balance-exhausted message.

---

Request Schema

Every request must include your API key:

{
  "apikey": "YOUR_API_KEY",
  "action": "list"
}

Examples

List items

curl -sL https://api.whiteintel.io/watchlist_manage.php \
  -H 'Content-Type: application/json' \
  --data '{"apikey":"YOUR_API_KEY","action":"list","type":"domain","status":"enabled","page":1,"limit":50}'

List items Success Response

  {
  "success": true,
  "page": 1,
  "limit": 50,
  "total": 2,
  "results": [
    {
      "id": 987,
      "organizationid": 1337,
      "entry_type": "domain",
      "entry": "example.com",
      "added_by": "api:42",
      "added_at": "2025-09-07 03:21:45",
      "include_usernames": 0,
      "consumer_alerts": 1,
      "corporate_alerts": 1,
      "status": "enabled",
      "notify_email": "[email protected]",
      "updated_by": "api:42",
      "updated_at": "2025-09-07 03:21:45"
    },
    {
      "id": 988,
      "organizationid": 1337,
      "entry_type": "domain",
      "entry": "contoso.com",
      "added_by": "api:42",
      "added_at": "2025-09-07 04:10:02",
      "include_usernames": 0,
      "include_passwords": 0,
      "consumer_alerts": 1,
      "corporate_alerts": 1,
      "status": "enabled",
      "notify_email": "[email protected]",
      "updated_by": "api:42",
      "updated_at": "2025-09-07 04:10:02"
    }
  ]
}

Add Item

curl -sL https://api.whiteintel.io/watchlist_manage.php \
  -H 'Content-Type: application/json' \
  --data '{
    "apikey":"YOUR_API_KEY",
    "action":"add",
    "entry_type":"domain",
    "entry":"example.com",
    "notify_email":"[email protected]"
  }'

Add Item Success Response

{
  "success": true,
  "id": 1001,
  "entry_type": "domain",
  "entry": "example.com",
  "remaining_type_balance": 14
}

Delete Item

curl -sL https://api.whiteintel.io/watchlist_manage.php \
  -H 'Content-Type: application/json' \
  --data '{
    "apikey":"YOUR_API_KEY",
    "action":"remove",
    "id":1001,

  }'

Delete Item Response

{
  "success": true,
  "id": 1001,
  "entry_type": "domain",
  "remaining_type_balance": 15,
  "message": "Removed."
}

Generic Error Examples

Invalid / missing API key (403)

{ "success": false, "error": "Unauthorized." }

Invalid Request (400)

{ "success": false, "error": "Invalid request." }

Quota exceeded

{ "success": false, "error": "Quota exceeded." }