# TeleSint Watch List

> TeleSint Watch List is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-20).

Retrieves the list of active watchlists configured in the user's TeleSint account for persistent threat monitoring.

## Facts

- Endpoint: GET https://telesint-api.onrender.com/watch/list?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/telesint-watch-list-bd5b867e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_7G5DA7o7VyAjdKUhQVXKe

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability telesint-watch-list-bd5b867e
```

Example prompt: Show me all my active TeleSint watchlists so I can see which threat actors, wallet addresses, and keywords I'm currently tracking.

## When to prefer this

Use this endpoint when you need to enumerate all existing persistent monitoring configurations before creating, updating, or acting on watchlist-driven alerts. It is the natural first call in any workflow that manages watchlists — e.g. checking if a threat actor is already being tracked before adding a duplicate, or auditing coverage before an incident response. Prefer this over the full threat feed or keyword search endpoints when you need watchlist metadata (IDs, structure) rather than raw intelligence records.

## Known failure modes

- No watchlists configured — returns empty array with total:0
- Payment not processed — 402 response blocking access
- Invalid or malformed properties filter — may return 400 or empty results
- Upstream Telegram channel data unavailable — may return partial or stale results
- Rate limiting or render cold-start delay on onrender.com — slow or timeout response

## How this service works

Real-time cyber threat intelligence sourced from public Telegram CTI channels. Pay-per-call endpoints covering IOC extraction (IPs, domains, hashes, CVEs), C2 infrastructure lookup, threat actor profiles, breach disclosures, pre-attack intent signals, vulnerability and exploitation-in-the-wild tracking, ransomware group activity, malware family intelligence, dark web monitoring, cross-category keyword search, a unified threat feed, and deterministic adversary-preparation scoring (pre-attack verdicts, activity velocity, organisation mentions, claim recycling checks and wallet-bound watchlists). All records are AI-enriched by DeepSeek with MITRE ATT&CK technique tagging, confidence scoring (0-100), TLP classification, and structured JSON output. No API key — USDC micropayments on Base mainnet via x402.

## Output

Returns a JSON object with a total count of watchlists, the source identifier ('TeleSint'), the endpoint name ('watch/list'), and an array of watchlist objects each containing a watch_id (UUID). This allows the caller to enumerate all active persistent monitoring configurations they have set up across threat categories.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "properties": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "total": 1,
  "source": "TeleSint",
  "endpoint": "watch/list",
  "watchlists": [
   {
    "watch_id": "6f1d2c3b-4a5e-4f60-8a7b-9c0d1e2f3a4b"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-watch-list-bd5b867e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)