Follow what matters to you
Choose vendors and products, industries and service providers. ICHI matches them against its whole retained history, shows you the matches before you save, and then delivers what is new or updated: a daily e-mail summary, CSV / JSON downloads, or a daily API retrieval with a generated script. Nothing here changes the ICHI score.
Subscribing is free. There is no account, password or payment: saving gives you a private management token to edit, pause or delete your selection later. Prefer a guided, step-by-step version? Build Your Export.
Privacy
ICHI stores your choices and, only if you give one, an e-mail address. The address is used only for the daily summary after you confirm it from the message ICHI sends, is masked everywhere it is shown, and is never shared. Management tokens and API keys are stored only as hashes and are sent only in an Authorization header, never in a URL. There is no tracking cookie. Deleting a selection deletes its address and its keys.
How selections combine, and what a match means
- Within one field, choices are combined with OR (for example Microsoft OR Cisco; healthcare OR education).
- Within one category, the fields you set are combined with AND (for example vendor AND severity AND known exploitation).
- The categories you enable are combined as a union: a record appears when it matches ANY enabled category.
- An industry subscription needs no product match, and a provider subscription needs no product or industry match.
- A product match means the record names that product: potential relevance, never confirmed exposure.
- An outage is the provider's own statement of a service disruption; it is never evidence of a cyberattack.
- Vendors and CVE identifiers are two ways of naming the vulnerabilities to follow: a record matches when it names any chosen vendor or product or is any chosen CVE; severity, CISA KEV status and known exploitation then narrow it. CVE identifiers, KEV status and a historical period are set on Build Your Export and kept when you edit here.
- Edge Pressure and Patch Pressure are global snapshots: the same for every subscriber, never filtered or recalculated by your selections. They lead every summary and export, and a daily summary always carries them, so "suppress empty updates" applies only when you follow neither.
Managing saved selection
Already saved a selection?
Keep these — they are shown only once
ICHI stores only their hashes. Send them only in an Authorization: Bearer header, never in a URL or a shared file.
API and daily retrieval
| Export | GET /api/v1/export[?since=<checkpoint>][&cursor=<cursor>][&limit=1..500][&format=json|csv]Without since: the full historical extract of your selection. With since: records new, updated or withdrawn after that checkpoint. Follow next_cursor; the last page has complete: true and the checkpoint to store after every page is saved. |
|---|---|
| Summary | GET /api/v1/summary[?since=…][&format=concise|detailed][&output=text] |
| Selection | GET /api/v1/selection |
| Authentication | Authorization: Bearer ichi_ak_…. A key reaches exactly one saved selection. Revoke or rotate it from the management panel; a revoked key stops working within about a minute. |
| Limits | 120 requests an hour per key (429 with Retry-After), 500 records a page. A changed selection makes old checkpoints answer 409 SELECTION_CHANGED: run a new initial extract, or add selection_policy=continue. |
| Records | Each has a stable record_id, record_type, revision, ICHI's first_seen_at / changed_at, the source's own dates, source names and links, the match reasons, and what is unknown. Coverage and freshness are in every response. |