> ## Documentation Index
> Fetch the complete documentation index at: https://chainpatrol.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# threats command — list confirmed blocked threats

> List confirmed threats blocked by ChainPatrol from the CLI, filtered by content, date range, asset type, and sorted with cursor pagination.

```bash theme={null}
chainpatrol threats list [filters]
```

## threats list

List the threats ChainPatrol has blocked. The organization is derived from your API key,
so there is no `--org` flag. Defaults to the last day — widen it with `--from` and `--to`.

| Option | Description |
| - | - |
| `--query <text>` | Search threat content (substring match). |
| `--from <iso>` | Start date (`YYYY-MM-DD`). |
| `--to <iso>` | End date (`YYYY-MM-DD`). |
| `--asset-type <list>` | Comma list: `URL`, `TWITTER`, `TELEGRAM`, … |
| `--sort-by <key>` | Sort key, for example `blockedAt`. |
| `--sort-direction <dir>` | `asc` or `desc`. |
| `--per-page <n>` | Page size, 1–100. Defaults to 10. |
| `--next-page <cursor>` | Cursor returned by a previous response. |
| `--include-pending` | Also list threats confirmed while protection is not active (**Pending Blocked**). |

```bash theme={null}
chainpatrol threats list
chainpatrol threats list --from 2026-05-01 --asset-type URL
chainpatrol threats list --query "acme-" --sort-by blockedAt --sort-direction desc
CHAINPATROL_API_KEY=... chainpatrol threats list --json
chainpatrol threats list --from 2020-01-01 --include-pending
```

> [!NOTE]
>
> The date range filters on when each threat was blocked, and without `--from` it
> covers only the last day. Pass an early `--from` to list every confirmed threat.

Paginate by feeding the cursor from one response into the next call:

```bash theme={null}
cursor=$(chainpatrol --json threats list --per-page 100 | jq -r '.nextPage')
chainpatrol --json threats list --per-page 100 --next-page "$cursor"
```

Run `chainpatrol asset types` to see every value `--asset-type` accepts.

## Related

* [`POST /threats/list`](https://chainpatrol.com/docs/external-api/threats-list)
* [`takedowns list`](https://chainpatrol.com/docs/cli/commands/takedowns) for the takedown record behind a threat


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.