# TeleSint Preparation Attack Assessment

> TeleSint Preparation Attack Assessment is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.1/call, status unknown (last checked 2026-10-20).

Assesses whether a threat actor, sector, or country is in active pre-attack preparation, returning an escalate/watch/none verdict with Dempster-Shafer belief scores and EWMA velocity.

## Facts

- Endpoint: GET https://telesint-api.onrender.com/preparation?utm_source=zero.xyz
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/telesint-preparation-attack-assessment-4f222d04
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_kKk4nNau4NLqYBKGfgbDj

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability telesint-preparation-attack-assessment-4f222d04
```

Example prompt: Check if there are active pre-attack preparation signals targeting the energy sector in the UAE over the last 30 days — I need to know whether to escalate this to our incident response team right now.

## When to prefer this

Choose this endpoint when you need a structured, probabilistic verdict on whether a specific threat actor, country, or sector is in active attack preparation — especially before making escalation decisions. It is distinct from raw signal feeds because it synthesizes Dempster-Shafer belief aggregation and EWMA velocity into an actionable escalate/watch/none verdict. Prefer it over general threat feeds when you need a decision-ready output rather than raw intelligence items.

## Known failure modes

- Missing required query parameters (actor, sector, country, or organization must be provided) results in a 400 error
- Lookback window outside 7-90 days range may be rejected or defaulted
- No matching intelligence returns a verdict of none with low belief scores rather than an error
- Payment not received via x402 results in a 402 Payment Required response
- Rate limiting or service unavailability on Render free tier may produce 503 errors

## How this service works

Is someone preparing to attack this org, sector or country? Call before escalation decisions. Returns verdict escalate|watch|none, stage ladder with gaps, Dempster-Shafer belief/conflict, EWMA velocity, evidence IDs.

## Output

Returns a JSON object with a top-level verdict of escalate, watch, or none; a stage ladder showing which attack preparation phases have been observed and where gaps exist; Dempster-Shafer belief and conflict scores reflecting evidence quality; an EWMA velocity score indicating acceleration of threat activity; and a list of evidence IDs referencing the underlying Telegram intelligence records.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "actor": {
       "type": "string",
       "description": "Threat actor or group name"
      },
      "sector": {
       "type": "string",
       "description": "Target sector e.g. energy, healthcare, finance, government"
      },
      "vendor": {
       "type": "string",
       "description": "Technology vendor in the target's stack e.g. Fortinet, Siemens"
      },
      "window": {
       "type": "string",
       "description": "Lookback days 7-90, default 30"
      },
      "country": {
       "type": "string",
       "description": "Country or region e.g. UAE, KSA, US, GCC, MENA, Europe"
      },
      "organization": {
       "type": "string",
       "description": "Target organisation name (most specific)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "gaps": [
   "infrastructure",
   "recon"
  ],
  "query": {
   "sector": "energy",
   "country": "UAE",
   "organization": "Acme Energy"
  },
  "engine": "preparation-engine/1.0.0",
  "fusion": {
   "rule": "dempster",
   "conflict_k": 0.04,
   "pl_targeted": 0.84,
   "bel_targeted": 0.31,
   "conflict_flag": false,
   "bel_opportunistic": 0.16,
   "families_converging": 3
  },
  "source": "TeleSint",
  "reasons": [
   "Targeting cannot be ruled out: Bel(targeted)=0.31, evidence-backed Pl(targeted)=0.52"
  ],
  "verdict": "watch",
  "endpoint": "preparation",
  "evidence": [
   {
    "id": "8fdfdbf91592209c",
    "stages": [
     "access"
    ],
    "category": "darkweb",
    "specific": 1
   }
  ],
  "sub_scores": {
   "alpha_specificity": 0.42,
   "gamma_operational_context": 0.39
  },
  "window_days": 30,
  "stage_reached": 4,
  "stage_reached_key": "access"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-preparation-attack-assessment-4f222d04/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)