# TeleSint Source Record Lookup

> TeleSint Source Record Lookup is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-14).

Retrieves a single enriched cyber threat intelligence record by UUID from TeleSint's Telegram-sourced CTI feed, including AI-generated summary, MITRE ATT&CK tags, TLP classification, and original defanged raw text.

## Facts

- Endpoint: GET https://telesint-api.onrender.com/source
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/telesint-source-record-lookup-79ae7908
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_6VJu18GvTxHZimjek_Cpr

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability telesint-source-record-lookup-79ae7908
```

Example prompt: Pull up the full TeleSint record for UUID f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d, including the original defanged Telegram text — I want to see the MITRE ATT&CK tags, TLP classification, and the AI summary.

## When to prefer this

Use this endpoint when you have a specific TeleSint record UUID (obtained from another TeleSint endpoint such as the IOC, C2, or ransomware feed) and need the full enriched detail including raw source text, MITRE tags, and confidence scoring. This is a detail/hydration endpoint, not a search endpoint — prefer it after a search or feed query has returned item IDs.

## Known failure modes

- Invalid or unknown UUID returns 404 or empty result
- Malformed UUID format causes 400 bad request
- Record may not yet be ingested if queried immediately after a Telegram post
- Payment failure via x402/USDC prevents record retrieval
- include_raw parameter ignored if record has no raw_text stored
- Translated summary may diverge from original meaning for non-English channels

## How this service works

Raw source verification for a TeleSint record. Pass id (UUID from any items[].id). Returns original defanged message text and source language alongside the AI summary for provenance checks.

## Output

Returns a structured JSON object containing the record UUID, timestamp, source Telegram channel URL, AI-generated English summary, threat category, MITRE ATT&CK technique tags, TLP classification, confidence score (0–100), defanged original raw_text, translation flag, source language, ingestion timestamp, and a provenance note clarifying AI vs. verbatim content.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "id"
     ],
     "properties": {
      "id": {
       "type": "string",
       "description": "Record UUID from any TeleSint endpoint items[].id"
      },
      "include_raw": {
       "type": "string",
       "description": "Return original raw_text bytes (defanged). Default: true"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
  "ts": "2026-06-10T14:32:00Z",
  "source": "TeleSint",
  "channel": "hxxps://t[.]me/vxunderground",
  "summary": "New Cobalt Strike C2 beacon observed at 91.92.109.83 using malleable C2 profile mimicking Microsoft update traffic. Initial access via spear-phishing (T1566.001).",
  "category": "ioc",
  "endpoint": "source",
  "raw_text": "⚡️ Новый C2: 91[.]92[.]109[.]83 — Cobalt Strike маллируемый профиль. Вектор: spear-phishing -> T1566.001",
  "translated": true,
  "ingested_at": "2026-06-10T14:33:01Z",
  "provenance_note": "This record was translated from the original source language. The raw_text field contains the defanged original. The summary field is the AI-generated English interpretation — treat it as analyst-grade, not verbatim.",
  "source_language": "ru"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-source-record-lookup-79ae7908/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)