> ## Documentation Index
> Fetch the complete documentation index at: https://docs.exorde.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Exorde Intel API

> Structured narrative intelligence from public web and social conversation. Trending, narrative, alerts, clusters, entities, evidence — one API.

## A real signal from yesterday

On 2026-05-18 at 04:00 UTC the term **"dark web"** crossed **6.67 standard deviations** above its 14-day baseline on the `cyber` topic. Spread across 14 domains and 8 languages, validated by our LLM gate, linked to an active cluster of fact-checker-verified breach disclosures.

```json theme={null}
{
  "alert_id": "c80fcfed-6818-44ed-a0b9-0eda91d1401c",
  "detected_at": "2026-05-18T04:00:30.148Z",
  "topic": "cyber",
  "signal_type": "volume_spike",
  "keyword": "dark web",
  "confidence": 0.72,
  "severity": { "deviation_sigma": 6.67, "current_value": 24.0, "baseline_value": 3.29 },
  "spread":   { "domain_count": 14, "language_count": 8 },
  "llm_validated": true,
  "description": "Multiple credible data breach disclosures (Turkish breach, FoxIT, gaming accounts) surfacing on dark web with fact-checker verification signals genuine cybersecurity incidents being reported and discussed across platforms.",
  "matched_cluster": { "cluster_id": 258, "cluster_title": "Dark-web breach disclosures, May 2026" }
}
```

That payload — typed, push-deliverable, IOC-extracted, cluster-linked — is what a SOC analyst, a newsroom desk, or a threat-intel team gets at the moment a story is forming. Not a dashboard screenshot. Not a CSV export. A structured event your code can route, dedupe, and act on.

This is the **Exorde Intel API**.

## What this is

The API turns roughly four billion public posts per month into structured intelligence: which terms spike, which storylines dominate, which platforms carry them, which entities co-occur, which posts are the evidence. The same pipeline powers internal newsroom dashboards, OSINT desks, and brand-risk teams across Europe.

Three things make it production-grade, not a demo:

* **One contract for two scopes.** Curated topics (`global`, `cyber`, `finance`, `disinfo`) and your own custom watchlists expose the **same** analytics surface. Code written for one works on the other.
* **Typed errors with `trace_id`.** Every non-2xx response carries a stable `error` enum and a 16-hex `trace_id` you can quote in support requests. No string-matching, no guessing. We resolve tickets in one round trip.
* **No surprise scope.** `GET /v1/me` and `GET /v1/keys/current` return your tier, topic scope, rate limit, and quotas. Build tier-aware UIs without polling billing.

## Three signals, one pipeline

<CardGroup cols={3}>
  <Card title="Trending" icon="chart-line" href="/trending">
    Top terms ranked by rolling z-score against a 14-day baseline. The state of the conversation in one call.
  </Card>

  <Card title="Narrative" icon="newspaper" href="/narrative">
    Editorial summary of the dominant storyline plus weighted sub-narratives. *(alpha — voice and tailoring evolving with design partners.)*
  </Card>

  <Card title="Alerts" icon="bell" href="/alerts">
    LLM-validated volume-spike events with severity, spread, IOCs, sample posts, and matched cluster context.
  </Card>
</CardGroup>

Trending is the **state of the words**, narrative is the **state of the story**, alerts are the **events that compose it**. Most production deployments use all three — trending and narrative as dashboard tiles, alerts as push-shaped routing into Slack, Teams, PagerDuty, or custom webhooks.

## Three tiers

<CardGroup cols={3}>
  <Card title="Watch" icon="binoculars" href="/tiers">
    Awareness layer. Trending, volume, narrative, alerts. **Trial: 7 days, free, scoped to `global`, no credit card.**
  </Card>

  <Card title="See" icon="eye" href="/tiers">
    Investigation layer. Adds clusters, entities, search, platforms, posts. Watchlists, webhooks.
  </Card>

  <Card title="Know" icon="brain" href="/tiers">
    Intelligence layer. Adds editorial reports, all topics, larger watchlists, dedicated support, custom voice tailoring.
  </Card>
</CardGroup>

Full matrix in [Tiers and quotas](/tiers).

## 60-second start

```bash theme={null}
# 1. Mint a free trial key
curl -X POST https://intel-v1.exorde.io/v1/keys/trial \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}'

# 2. Pull what's trending on the global conversation right now
curl https://intel-v1.exorde.io/v1/topics/global/trending \
  -H "X-API-Key: exd_trial_..."

# 3. Catch the latest event-shaped signals
curl "https://intel-v1.exorde.io/v1/topics/global/alerts?hours=24" \
  -H "X-API-Key: exd_trial_..."
```

Full walkthrough — Python, Node, PowerShell, response samples, error handling — in [Quickstart](/quickstart).

## What the data looks like

A real `trending` response on `global` returns ranked terms with rolling z-scores and 24-hour deltas:

```json theme={null}
{
  "topic": "global",
  "snapshot_id": "2026-05-19T13:00:00Z",
  "terms": [
    { "term": "Iran",       "score": 847.2, "rank": 1, "delta_24h": 6.6 },
    { "term": "Eurovision", "score": 412.0, "rank": 2, "delta_24h": 1.8 },
    { "term": "ECB",        "score": 289.4, "rank": 3, "delta_24h": 0.9 }
  ],
  "data_freshness": { "snapshot_age_seconds": 312, "level": "ok" }
}
```

A real `narrative` response composes those terms into a story:

```json theme={null}
{
  "topic": "global",
  "summary": "Regional escalation between Iran and Israel dominates global conversation, with overlapping ECB rate signal and Eurovision aftermath as secondary threads.",
  "sub_narratives": [
    { "title": "Iran-Israel exchange",   "weight": 0.61 },
    { "title": "ECB June pivot rumours", "weight": 0.22 },
    { "title": "Eurovision aftermath",   "weight": 0.17 }
  ]
}
```

Same envelope shape on watchlists. Same typed error path on every endpoint. Same `trace_id` correlation header on every response.

## Where to go next

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Mint a trial and run trending, narrative, and alerts in five minutes.
  </Card>

  <Card title="Use cases" icon="lightbulb" href="/use-cases">
    Newsroom, brand, threat-intel, disinfo, executive dashboard — five copy-paste recipes.
  </Card>

  <Card title="Topics & watchlists" icon="binoculars" href="/topics-and-watchlists">
    Curated topics out of the box, custom watchlists for anything else. Same analytics surface for both.
  </Card>

  <Card title="Tiers & quotas" icon="layer-group" href="/tiers">
    Watch / See / Know matrix, history caps, result-size caps, webhook quotas.
  </Card>

  <Card title="Authentication" icon="key" href="/authentication">
    Mint, rotate, revoke. Test-mode keys. The typed error envelope.
  </Card>

  <Card title="Rate limits" icon="gauge-high" href="/rate-limits">
    RPM, burst, headers, polling cadence, backoff patterns.
  </Card>

  <Card title="Errors" icon="triangle-exclamation" href="/errors">
    Every error code, what triggers it, what to do.
  </Card>

  <Card title="API reference" icon="code" href="/reference">
    Every endpoint, live try-it, generated from the OpenAPI spec.
  </Card>
</CardGroup>

## Status, support, contact

* **Live status** — [intel-v1.exorde.io/v1/status](https://intel-v1.exorde.io/v1/status). Per-stream freshness, never cached more than 30 seconds.
* **OpenAPI spec** — [intel-v1.exorde.io/v1/openapi.json](https://intel-v1.exorde.io/v1/openapi.json). Generate clients in any language.
* **Support** — [intel@exorde.io](mailto:intel@exorde.io). Include the `trace_id` from the error envelope; we resolve in one round trip.
* **Design partner program** — narrative is in alpha. If you want to shape the per-customer voice and brief format, email the same address.
* **Changelog** — [/changelog](/changelog).

<Note>Last reviewed: 2026-05-19. API version 1.2.8.</Note>