> ## Documentation Index > Fetch the complete documentation index at: https://developers.everflow.io/llms.txt > Use this file to discover all available pages before exploring further. # Find Domain Blacklist Incidents > **Traffic Health Premium.** Domain blocklist incidents on your premium-monitored domains, with the provider and vendor that flagged each one and when. To see who flagged a domain, filter on its `url` with `status` `active`. Returns an empty list when the network lacks `has_blacklist_monitoring`. > [!NOTE] > > Requires **Traffic Health Premium** (`has_blacklist_monitoring`). Domain blocklist incidents on your premium-monitored domains, with the provider and vendor that flagged each one and when. To see who flagged a domain, filter on its `url` with `status` `active`. Pagination is controlled through the `page` and `page_size` **query parameters**, not the JSON request body. ## OpenAPI ````yaml openapi/traffic-health.yaml post /networks/traffic/tables/domains/blacklistincidents openapi: 3.0.3 info: title: Everflow Network API - Traffic Health description: > Read endpoints for Traffic Health — the operational health of the domains and hosting IPs behind your tracking and conversion links. Surfaces uptime / SSL / DNS / expiry incidents, blocklist reputation, the remediation tasks that need your attention, and per-domain assignment summaries. Traffic Health has two tiers. The capabilities available to a network are reported by `GET /networks/traffic/access`. Endpoints marked **Traffic Health Premium** (domain and IP blocklist reputation) require the premium package; on a network without it they return an authorization error rather than data. For how these incidents and reputation flags work, see [Traffic Health: Incidents & Reputation Management](https://helpdesk.everflow.io/customer/traffic-health-incidents-and-reputation-management). version: 1.0.0 servers: - url: https://api.eflow.team/v1 security: [] tags: - name: Traffic Health paths: /networks/traffic/tables/domains/blacklistincidents: post: tags: - Traffic Health summary: Find Domain Blacklist Incidents description: > **Traffic Health Premium.** Domain blocklist incidents on your premium-monitored domains, with the provider and vendor that flagged each one and when. To see who flagged a domain, filter on its `url` with `status` `active`. Returns an empty list when the network lacks `has_blacklist_monitoring`. parameters: - in: query name: page required: false schema: type: integer minimum: 1 default: 1 description: The page of results to retrieve. - in: query name: page_size required: false schema: type: integer minimum: 1 default: 50 description: The number of results to return per page. - in: query name: order_field required: false schema: type: string default: time_created description: >- `time_created`, `time_saved`, `time_last_observed`, `time_resolved`, `identifier`, `url`, or `provider`. - in: query name: order_direction required: false schema: type: string default: desc description: '`asc` or `desc`.' requestBody: required: true content: application/json: example: filters: url: track.acme.com status: active schema: type: object properties: search_terms: type: array description: Text search on the domain, vendor, or incident identifier. items: type: object properties: search_type: type: string description: Only `name` is supported. value: type: string filters: type: object properties: url: type: string description: The domain (e.g. `track.acme.com`). status: type: string description: '`active` or `resolved`.' providers: type: array description: >- `easylist`, `hetrix_tools`, or `google_threat_intelligence`. items: type: string vendors: type: array description: Vendor identifiers (e.g. `EASYLIST`). items: type: string identifier: type: string description: An incident identifier. from_timestamp: type: integer description: >- Keep incidents still open, or resolved, on or after this time (unix seconds). to_timestamp: type: integer description: >- Keep incidents created on or before this time (unix seconds). responses: '200': description: '' content: application/json: example: blacklist_incidents: - network_id: 1 url: track.acme.com domain_type: tracking identifier: N5T2KL7CUPYYNBY0 status: active provider: easylist vendor: EASYLIST time_created: 1778549980 time_saved: 1782437980 time_last_observed: 1782437980 time_resolved: 0 relationship: vendor: provider: EasyList category: Advertiser Block List name: EasyList identifier: EASYLIST website_url: https://easylist.to/ impact_level: high paging: page: 1 page_size: 50 total_count: 1 schema: type: object properties: blacklist_incidents: type: array items: $ref: '#/components/schemas/DomainBlacklistIncident' paging: type: object properties: page: type: integer page_size: type: integer total_count: type: integer security: - API Key: [] components: schemas: DomainBlacklistIncident: type: object properties: network_id: type: integer url: type: string domain_type: type: string identifier: type: string status: type: string provider: type: string description: Blocklist source (e.g. `easylist`, `google_threat_intelligence`). vendor: type: string time_created: type: integer time_saved: type: integer time_last_observed: type: integer time_resolved: type: integer relationship: type: object properties: vendor: $ref: '#/components/schemas/BlacklistVendor' BlacklistVendor: type: object description: Listing details for the flagging vendor. properties: provider: type: string category: type: string name: type: string identifier: type: string website_url: type: string impact_level: type: string description: '`low`, `medium`, or `high`.' impact_details: type: string listing_criteria: type: string securitySchemes: API Key: type: apiKey in: header name: X-Eflow-Api-Key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.