{"slug":"api-orioncmd-com-v1-watch-f089ee","title":"OrionCMD Checks","host":"api.orioncmd.com","method":"POST","resource":"https://api.orioncmd.com/v1/watch","category":"other","description":"OrionCMD Checks: Prepaid domain threat watch: up to 25 domains for 30 days, webhook alerts. Pay once; each domain is re-checked about once a day for 30 days. You get an HMAC-signed JSON POST at your https webhook_url (event watch.changed) when a domain or its IPv4 appears in (or leaves) ThreatCluste","price_listed":0.3,"price_asked":0.3,"state":"answering","state_label":"Answering","checks_7d":1,"answered_7d":1,"latency_ms_median":288,"reported_calls_30d":1,"reported_payers_30d":1,"networks":["eip155:8453"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"body":{"items":["example.com"],"webhook_url":"https://example.com/hooks/orion-watch"},"bodyType":"json","method":"POST","type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"properties":{"items":{"description":"Domains","items":{"type":"string"},"maxItems":25,"minItems":1,"type":"array"},"webhook_url":{"description":"Public https URL that receives POSTs","type":"string"}},"required":["items","webhook_url"],"type":"object"},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"method":{"enum":["POST"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method","bodyType","body"],"type":"object"},"output":{"properties":{"example":{"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"},"history":[{"day":"2026-10-18","reachable":true,"status":402,"valid_402":true,"asked_usdc":0.3,"price_match":true,"latency_ms":288,"error":null}],"description_full":"OrionCMD Checks: Prepaid domain threat watch: up to 25 domains for 30 days, webhook alerts. Pay once; each domain is re-checked about once a day for 30 days. You get an HMAC-signed JSON POST at your https webhook_url (event watch.changed) when a domain or its IPv4 appears in (or leaves) ThreatCluster's high-confidence IOC feed, when a new ransomware leak-site claim names it, when its A/NS/MX records change, or when registration expiry changes or falls within 30 days. A watch.created POST is sent","last_updated":"2026-10-17T06:10:23.876Z","schemes":["exact"]}