Open data · observation only

Data and exports

ICHI publishes what it has recorded, with the rules that produced it. Every export below comes from data ICHI already serves on its pages. Each one says where it came from, when it was generated and what it leaves out. Nothing here is a score input, and nothing is reconstructed: a day ICHI did not record is absent, never filled.

Rights and attribution

ICHI's owner has not yet declared a licence for ICHI's own data. Until one is declared, attribute ICHI — Internet Cyber Health Index (https://ichi.global) when you reuse it. ICHI does not redistribute third-party records. Incident rows name each source and link to the source's own page, and each source keeps its own terms (listed in every incidents export as source_terms).

Datasets

Daily index historyCSV · JSON
/api/export?dataset=index-history[&from=YYYY-MM-DD&to=YYYY-MM-DD][&format=csv]
The last 90 days by default; a range spans at most 400 days. One row per recorded day, with these fields:
  • the composite score and band;
  • the scoring model and methodology revision in force;
  • the seven scored dimensions: V, E, C, T, P (shown on the site as O, Actor Operations), R, S. An empty value means the dimension was unavailable that day;
  • whether the DShield probe answered;
  • how many feeds failed that day;
  • whether patch coverage was fresh enough to score.
7 / 30 / 90-day comparisonsCSV · JSON · also /api/history?view=compare[&days=7|30|90][&end=YYYY-MM-DD] and on Score history
For each series (the composite and each dimension) and each window length, the result is the mean over the window ending on the latest recorded day against the window before it. A change is stated only when:
  • both windows are at least half recorded;
  • no methodology change affecting that series falls inside them.
Otherwise the result is not enough history, or not comparable with the date it becomes comparable. Where DShield probe coverage differed between the windows, the comparison carries a caveat and a like-for-like change.
IncidentsCSV · JSON
/api/export?dataset=incidents[&from=…&to=…][&format=csv]
The last 30 days by default; a range spans at most 92 days, selected by last report, with at most 500 rows (the response says when the cap was reached). It covers ledger incidents whose status is CONFIRMED (a regulatory filing or the organisation's own disclosure, read first-hand) or REPORTED (newsroom reporting). Each row gives:
  • the organisation, family and type;
  • its first and last report;
  • its evidence bases (two outlets repeating one story count once);
  • its stated impact signals;
  • its source names and links;
  • its ICHI record and dossier.

What is not exported, and why

Methodology changes the history crosses

Recorded values are never recomputed under a later method. A comparison across one of these dates is marked not comparable for the series it affects.

API behaviour