# TeleSint Full Intel Feed

> TeleSint Full Intel Feed is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-15).

Returns a unified threat intelligence feed across all categories (IOCs, C2, actors, breaches, intent signals) sourced from Telegram CTI channels, newest first, suitable for SIEM ingestion.

## Facts

- Endpoint: GET https://telesint-api.onrender.com/feed
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/telesint-api-onrender-com-12bc99e5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_zMJORjOKHte4grA7Q9q4G

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability telesint-api-onrender-com-12bc99e5
```

Example prompt: Pull the full TeleSint intel feed for all categories, severity high or critical, minimum confidence 75, since the last 24 hours, TLP amber only, and give me the 50 newest records — I need this for SIEM ingestion.

## When to prefer this

Use this endpoint when you need a single unified feed spanning all threat intelligence categories at once, rather than querying each category endpoint separately. Ideal for SIEM ingestion pipelines, bulk CTI aggregation, or when you want cross-category correlation in one call. Prefer the category-specific sibling endpoints when you need deep filtering unique to a single record type (e.g., C2 framework filtering or nation-state actor filtering).

## Known failure modes

- Invalid category enum value returns 400 bad request
- since parameter in unrecognized format causes parse error
- min_confidence out of 0-100 range returns validation error
- Payment not provided or insufficient USDC results in 402 Payment Required
- Offset beyond available records returns empty items array
- Upstream Telegram data source lag may cause stale results

## How this service works

Full intel feed across all categories. Filters: category(ioc|c2|actor|breach|intent|vulnerability), severity, min_confidence, since, tag, tlp, limit, offset. Returns all record types newest first. Use for SIEM ingestion.

## Output

A unified list of threat intelligence records sorted newest first, spanning IOCs, C2 infrastructure, threat actor profiles, breach disclosures, and pre-attack intent signals. Each record includes confidence scores, severity ratings, TLP classification, tags, and category-specific fields sourced from Telegram CTI channels.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {}
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "tag": {
       "type": "string",
       "description": "Tag keyword filter, e.g. ransomware, cobalt-strike, apt"
      },
      "tlp": {
       "type": "string",
       "description": "TLP classification: WHITE | GREEN | AMBER | RED"
      },
      "limit": {
       "type": "number",
       "description": "Page size, default 20, max 100"
      },
      "since": {
       "type": "string",
       "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"
      },
      "offset": {
       "type": "number",
       "description": "Pagination offset, default 0"
      },
      "category": {
       "type": "string",
       "description": "Intel category filter: ioc | c2 | actor | breach | intent | vulnerability"
      },
      "severity": {
       "type": "string",
       "description": "Minimum severity: critical | high | medium | low | info"
      },
      "min_confidence": {
       "type": "number",
       "description": "Minimum AI confidence score 0-100"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "items": [
   {
    "id": "f1e2e3d4-5678-90ab-cdef-123456789abc",
    "ts": "2026-05-27T14:32:00Z",
    "tlp": "WHITE",
    "iocs": [
     {
      "type": "sha256",
      "value": "d4e5f6a7b8c9d0e1...",
      "context": "Ransomware dropper"
     }
    ],
    "tags": [
     "blackcat",
     "alphv",
     "ransomware"
    ],
    "ttps": [
     {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
     }
    ],
    "channel": "https://t[.]me/vxunderground",
    "summary": "New ransomware dropper IOCs from BlackCat/ALPHV campaign",
    "category": "ioc",
    "severity": "critical",
    "confidence": 88
   }
  ],
  "limit": 20,
  "total": 156,
  "offset": 0,
  "source": "TeleSint",
  "endpoint": "feed"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-api-onrender-com-12bc99e5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)