Signals via API

Public sample from today's flagship detail endpoint. Public payloads can be limited or redacted. The backend exposes read endpoints for signals, storylines, and briefings.

GET /v1/narratives/47f6a138-634f-4e25-b89c-5d36818a69e3?tenant=cybersecurity

{
  "id": "47f6a138-634f-4e25-b89c-5d36818a69e3",
  "title": "Charter Communications data breach affects 4.9 million accounts",
  "summary": "The ShinyHunters extortion gang stole personal information from 4.9 million accounts after hacking the U.S. telecom giant Charter Communications in early April, according to data breach notification service Have I Been Pwned. [...]",
  "first_seen_at": "2026-05-29T08:29:40Z",
  "last_seen_at": "2026-05-29T14:49:58Z",
  "created_at": "2026-05-29T17:00:35.256052Z",
  "updated_at": "2026-05-30T05:07:25.057547Z",
  "timeframe": "24h",
  "run_id": "94816446-3ebb-4a11-b6e6-500732f84867",
  "metrics": {
    "divergence": 7.0711,
    "post_count": 2,
    "momentum_1h": 0,
    "momentum_7d": 2,
    "score_total": 0.964999,
    "shill_score": 15,
    "momentum_24h": 2,
    "market_movers": [],
    "evidence_score": 0.5,
    "unique_authors": 2,
    "coherence_score": 0.7646,
    "diversity_bonus": 0.125,
    "duplicate_ratio": 0,
    "platforms_count": 1,
    "social_momentum": 2,
    "divergence_label": "pricing_before_chatter",
    "market_conviction": 0,
    "origin_share_top1": 0.5,
    "unique_publishers": 2,
    "origin_layer_posts": 0,
    "source_types_count": 1,
    "unique_authors_24h": 2,
    "unique_origin_urls": 2,
    "amplifier_share_top1": 0.5,
    "author_concentration": 0.5,
    "publisher_share_top1": 0.5,
    "amplifier_layer_posts": 2,
    "concentration_penalty": 0,
    "unique_origin_domains": 2,
    "source_diversity_bonus": 0,
    "unique_publisher_types": 1,
    "unique_origin_publishers": 2
  },
  "platforms": [
    "rss"
  ],
  "top_tickers": [],
  "why_now": [],
  "display_title": "Charter Communications data breach exposes nearly 5 million accounts",
  "display_summary": "In early April, the ShinyHunters extortion group hacked U.S. telecom giant Charter Communications, stealing personal information from approximately 4.9 million accounts. Over 42 million records were leaked, highlighting a significant security incident affecting millions of customers.",
  "narrative_frame_display": "The ShinyHunters extortion gang compromised Charter Communications in early April, resulting in the theft of personal data from nearly 5 million accounts. This breach led to the leak of over 42 million records, underscoring the scale and impact of the incident on the telecom provider's customer base. The event has been confirmed by multiple sources, including data breach notification services and cybersecurity news outlets.",
  "entities": {
    "companies": [
      "Charter Communications",
      "ShinyHunters"
    ]
  },
  "recurring_claims": [
    {
      "claim": "ShinyHunters extortion gang stole personal information from approximately 4.9 million Charter Communications accounts in early April",
      "evidence_urls": [
        "https://bleepingcomputer.com/news/security/charter-communications-data-breach-affects-49-million-accounts",
        "https://securityweek.com/charter-communications-data-breach-could-impact-nearly-5-million"
      ]
    },
    {
      "claim": "Over 42 million records stolen from Charter Communications were leaked by ShinyHunters",
      "evidence_urls": [
        "https://securityweek.com/charter-communications-data-breach-could-impact-nearly-5-million"
      ]
    }
  ],
  "stance_map": [
    {
      "stance": "neutral",
      "who": "BleepingComputer",
      "evidence_urls": [
        "https://bleepingcomputer.com/news/security/charter-communications-data-breach-affects-49-million-accounts"
      ]
    },
    {
      "stance": "neutral",
      "who": "SecurityWeek",
      "evidence_urls": [
        "https://securityweek.com/charter-communications-data-breach-could-impact-nearly-5-million"
      ]
    }
  ],
  "quality_flags": {
    "mixed_topic_risk": "low",
    "promo_risk": "low",
    "source_quality": "medium"
  },
  "editor_note": null,
  "display_tags": [
    "cve",
    "breach",
    "threat_actors"
  ],
  "tags": [
    "cve",
    "breach",
    "threat_actors"
  ],
  "cscope_tags": [
    "cve",
    "breach",
    "threat_actors"
  ],
  "why_now_display": [
    "The breach occurred recently in early April and was publicly disclosed in late May 2026.",
    "Leaked data is already circulating, raising urgency for affected users to take protective actions.",
    "The incident underscores the evolving tactics of extortion gangs like ShinyHunters in targeting large enterprises."
  ],
  "why_it_matters_display": [
    "The breach exposes sensitive personal information of millions, increasing risks of identity theft and fraud.",
    "It highlights ongoing threats from extortion groups targeting major telecom providers.",
    "Understanding the breach helps improve incident response and security measures in the telecom sector."
  ],
  "show_why": true,
  "sources_display": [
    {
      "url": "https://www.bleepingcomputer.com/news/security/charter-communications-data-breach-affects-49-million-accounts/",
      "label": "bleepingcomputer.com: BleepingComputer report on Charter breach",
      "published_at": "2026-05-29T08:29:40+00:00"
    },
    {
      "url": "https://www.securityweek.com/charter-communications-data-breach-could-impact-nearly-5-million/",
      "label": "securityweek.com: SecurityWeek coverage of Charter data breach",
      "published_at": "2026-05-29T14:49:58+00:00"
    }
  ],
  "trend_status": "flat",
  "trend_sparkline": "▁▁",
  "trend_points_n": 0,
  "trend_window": {
    "lookback_days": 14,
    "max_points": 36,
    "value_key": null
  },
  "llm_status": "accepted",
  "llm_meta": {
    "model": "gpt-4.1-mini-2025-04-14",
    "prompt_version": "enrich_v3",
    "input_hash": "be799fed337c277e55def20d58b53be2888f9f014184ab4959fb23253353388b",
    "updated_at": "2026-05-30T05:08:27.579947+00:00",
    "llm_metadata": {
      "env": "prod",
      "host": "f36dd92d3880",
      "stage": "signals.enrich",
      "run_id": "94816446-3ebb-4a11-b6e6-500732f84867",
      "tenant": "cybersecurity",
      "service": "api",
      "pipeline": "pipeline_run",
      "correlation_id": "47f6a138-634f-4e25-b89c-5d36818a69e3"
    }
  },
  "story_id": "7e111226-a2b4-4618-8a63-efaa51d60207",
  "public_surface": {
    "eligible_for_flagship_sample": false,
    "eligible_for_top_public_brief": true,
    "eligible_for_public_index": false,
    "eligible_only_for_lower_or_internal_surfaces": false,
    "public_rank_score": 8,
    "structural_priority": true,
    "mostly_social": false,
    "community_chatter": false,
    "reader_label": "Limited evidence",
    "excluded_reasons": [
      "narrow_evidence"
    ],
    "source_signals": {
      "post_count": 2,
      "unique_origins": 2,
      "source_types_count": 1,
      "independent_non_social_count": 2,
      "social_source_count": 0,
      "non_social_source_count": 0,
      "why_now_count": 3,
      "why_it_matters_count": 3
    }
  },
  "current_cycle_open": true
}

• Signals and storylines feed endpoints with filtering and rate limits
• Briefing delivery endpoints for integrations
• Evidence link payloads for auditability

• Route top stories into Slack or Teams for morning and evening desk updates.
• Sync storyline evidence into Notion, Airtable, or internal research trackers.
• Feed metrics into BI dashboards for momentum, concentration, and source mix monitoring.

Quick start endpoints: /v1/feed/stories, /v1/signals, /v1/storylines/search, /v1/briefings/latest.

For product access, see Pricing.