# 2s IOC Reputation Watcher

> 2s IOC Reputation Watcher is a paid API for AI agents from 2s.io, paid per call via x402, $0.125/call, status unknown (last checked 2026-09-14).

Registers a persistent webhook watcher on an IP address or domain that fires a signed callback whenever the target's threat-intelligence reputation changes.

## Facts

- Endpoint: POST https://2s.io/api/watchers/ioc-reputation
- Price: $0.125/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-ioc-reputation-watcher-102f4df2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_MQuTf1SR8MI5w9ZhnKqUs

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-ioc-reputation-watcher-102f4df2 -d '<json body>'
```

Example prompt: Set up a reputation watcher on the IP 185.220.101.45 and POST signed alerts to https://hooks.myapp.com/ioc-events with a label 'tor-exit-node' whenever its threat status changes — stop after 50 changes and expire in 30 days.

## When to prefer this

Choose this endpoint when you need continuous, event-driven monitoring of a specific IP or domain's threat reputation rather than a one-time lookup. It is ideal for SOC automation, dynamic firewall rule updates, or vendor risk monitoring where you want push notifications on reputation changes without polling. Prefer it over static IOC lookup endpoints when the indicator is long-lived and reputation drift matters.

## Known failure modes

- Invalid or too-short IOC string (fails minLength:3 validation)
- callbackUrl is unreachable or returns non-2xx — callbacks may be dropped
- expiresInSeconds exceeds 90-day maximum (7776000 seconds)
- maxFires exceeds 1000 limit
- Malformed callbackUrl (not a valid http/https URL)
- No reputation data available for the given IOC — watcher registered but never fires
- USDC payment failure via x402 — endpoint returns 402 without creating watcher

## How this service works

The (most) everything API: 575+ pay-per-call endpoints for AI agents — ground-truth data, a full AI gateway, and agent infrastructure (storage, queues, watchers). USDC via x402, no signup, no API keys, and upto billing: pay actual usage, not the quote.

## Output

Returns a JSON object confirming watcher registration with ok: true, an items array containing the watcher record, the total count, and a source object identifying the underlying threat-intelligence provider, its URL, and license. After registration, signed HTTP POST callbacks are delivered to the specified callbackUrl whenever the IOC's reputation changes, with an X-2s-Signature header for verification.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ioc": {
   "type": "string",
   "maxLength": 255,
   "minLength": 3,
   "description": "Indicator to watch: an IP address or domain."
  },
  "label": {
   "type": "string",
   "maxLength": 64,
   "description": "Optional free-text tag."
  },
  "payload": {
   "type": "object",
   "description": "Arbitrary JSON echoed back in every callback.",
   "additionalProperties": {}
  },
  "maxFires": {
   "type": "integer",
   "maximum": 1000,
   "minimum": 1,
   "description": "Stop after this many changes (default 10)."
  },
  "callbackUrl": {
   "type": "string",
   "maxLength": 2048,
   "description": "Signed event POSTed here (verify X-2s-Signature). Any http(s) URL."
  },
  "expiresInSeconds": {
   "type": "integer",
   "maximum": 7776000,
   "minimum": 60,
   "description": "Active window in seconds (default 30d, max 90d)."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-ioc-reputation-watcher-102f4df2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)