# TeleSint Breach Disclosure Feed

> TeleSint Breach Disclosure Feed is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-15).

Returns breach disclosure intelligence sourced from Telegram CTI channels, filterable by sector, country, organization, severity, and confidence.

## Facts

- Endpoint: GET https://telesint-api.onrender.com/breach
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/telesint-api-onrender-com-01f6593f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ZC20IYZ2PWaXbnLa4J5gp

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability telesint-api-onrender-com-01f6593f
```

Example prompt: Pull the latest high-severity breach disclosures from Telegram targeting financial sector organizations in the United States — show up to 20 results with at least 75% confidence, sourced since January 1 2025.

## When to prefer this

Use this endpoint when you specifically need breach disclosure intelligence derived from Telegram CTI channels, especially when you need to filter by sector, country, or specific organization. Prefer this over the full intel feed when you only care about breach disclosures, not IOCs, C2, or actor profiles.

## Known failure modes

- Invalid filter values (e.g. unrecognized sector or country codes) may return empty results or 400 error
- min_confidence out of 0-100 range may cause validation error
- since date in wrong format may fail parsing
- No matching results returns empty items array
- Service unavailable on Render cold-start may cause timeout or 503

## How this service works

Breach disclosures from Telegram. Filters: sector, country, organization, severity, min_confidence, since, limit. Returns items[] with target{sectors,countries,organizations}, leak iocs[], confidence.

## Output

Returns an array of breach disclosure items, each containing a target object with sectors, countries, and organizations affected; a list of leaked IOCs; and a confidence score for the intelligence.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {}
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "limit": {
       "type": "number",
       "description": "Page size, default 20, max 100"
      },
      "since": {
       "type": "string",
       "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
      },
      "offset": {
       "type": "number",
       "description": "Pagination offset, default 0"
      },
      "sector": {
       "type": "string",
       "description": "Targeted sector: finance | healthcare | government | energy | retail"
      },
      "country": {
       "type": "string",
       "description": "Targeted country keyword, e.g. us | uk | de | fr"
      },
      "severity": {
       "type": "string",
       "description": "Minimum severity: critical | high | medium | low | info"
      },
      "organization": {
       "type": "string",
       "description": "Targeted organization name partial match"
      },
      "min_confidence": {
       "type": "number",
       "description": "Minimum AI confidence score 0-100"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "items": [
   {
    "id": "b1r2e3a4-c5h6-7890-abcd-123456789012",
    "ts": "2026-05-27T11:45:00Z",
    "tlp": "WHITE",
    "iocs": [
     {
      "type": "url",
      "value": "https://lockbit3[.]onion/leak/usbank-data",
      "context": "Ransomware leak site"
     }
    ],
    "tags": [
     "lockbit",
     "ransomware",
     "finance",
     "data-leak",
     "pii"
    ],
    "ttps": [
     {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
     },
     {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
     }
    ],
    "target": {
     "sectors": [
      "finance"
     ],
     "countries": [
      "US"
     ],
     "organizations": [
      "Regional Bank Corp"
     ]
    },
    "channel": "https://t[.]me/cyberinsider",
    "summary": "LockBit claims breach of US regional bank: 2.4M customer records including SSNs and account numbers",
    "category": "breach",
    "severity": "critical",
    "confidence": 75
   }
  ],
  "limit": 20,
  "total": 17,
  "offset": 0,
  "source": "TeleSint",
  "endpoint": "breach"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-api-onrender-com-01f6593f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)