Alert format

When an on-chain event matches a rule, Aicscan creates an alert (a match), then one notification per channel of the rule. You find the same alert in three forms:

Where	Form	Page
`GET /v1/matches`	Structured alert: rule, full on-chain event, acknowledgement.	List alerts
Webhook, real time	Ready-to-display message: type, stage, severity, title and text.	Webhooks, Real time
`GET /v1/notifications`	One delivery on one channel, with its status and attempts.	List notifications

Alert stages#

`stage`	When
`unconfirmed`	The transaction is in a block that is not confirmed yet. Only sent when the rule makes an immediate alert.
`confirmed`	The block reached the chain's number of confirmations.
`cancelled`	A reorganization removed the block: the unconfirmed alert is cancelled, no action is needed.
`escalation`	Critical alert still not acknowledged 5 minutes after it was sent: a reminder goes to the workspace's escalation channels (`role: "escalation"`), or to the original channel if there is none. The text starts with `⏰ ESCALADE`.

One alert can therefore produce two messages (unconfirmed then confirmed, or unconfirmed then cancelled). In GET /v1/matches, phase is immediate (seen before confirmation) or confirmed.

Channels also receive other messages than alerts, told apart by type: digest (summary of grouped alerts), test (test message), security (sensitive change in the workspace, such as a deleted rule or channel), summary (daily or weekly summary) and service (notice of a service interruption or recovery). Ignore the types you do not handle.

Severity and priority#

`severity`	`priority`
`critical`	30 and above
`warning`	20 to 29
`info`	below 20

Message sent to channels#

The message is plain text, written in the channel's language (locale). Its first line is the title (title); the full text is in text. Example in English for a large_transfer rule:

Text

🔴 CRITICAL · Treasury: large USDT outflows · outgoing
✅ Confirmed · 15 confirmations
Chain: BNB Chain
Address: Treasury (0x8894…d4e3)
Amount: 250,000 USDT (≈ $250,000)
To: 0x77cd…01e2 (unknown)
Block 45,123,456
Details: https://aicscan.io/e/0193a1c9-3e02-7f3a-9b4c-5d6e7f8091a2

The same message in French:

Text

🔴 CRITIQUE · Treasury: large USDT outflows · sortant
✅ Confirmée · 15 confirmations
Chaîne : BNB Chain
Adresse : Treasury (0x8894…d4e3)
Montant : 250 000 USDT (≈ 250 000 $ · ≈ 148 millions FCFA)
Vers : 0x77cd…01e2 (inconnue)
Bloc 45 123 456
Détails : https://aicscan.io/e/0193a1c9-3e02-7f3a-9b4c-5d6e7f8091a2

The first line starts with the severity (CRITICAL, WARNING, INFO) or with CANCELLED for a cancellation, followed by the rule name and the direction.
The second line gives the stage: UNCONFIRMED · waiting for 15 confirmations, Confirmed · 15 confirmations.
The dollar equivalent (and CFA francs in French) only appears for stablecoins.
The "Details" link always points to the aicscan.io domain. No message contains a link to another domain, nor a request to log in, sign or send funds.

Do not parse the text

The text is meant to be read by a person and can change. For automated processing, use the structured fields (type, stage, severity), then read the full alert with GET /v1/matches (raw amount, addresses, transaction hash, block number).

Structured alert#

JSON

{
  "id": "0193a1c9-3f10-7d42-8a1b-2c3d4e5f6a7b",
  "phase": "confirmed",
  "created_at": "2026-11-14T09:30:13.590Z",
  "rule": { "id": "0193a1b4-2e7f-7a10-9b3c-4d5e6f708192", "name": "Treasury: large USDT outflows", "severity": "critical" },
  "event": {
    "id": "0193a1c9-3e02-7f3a-9b4c-5d6e7f8091a2",
    "chain_id": 56,
    "block_number": 45123456,
    "block_hash": "0x5f1c0a7e9d3b2c4a6e8f0d1b3c5a7e9f1d3b5c7a9e1f3d5b7c9a1e3f5d7b9c1a",
    "block_timestamp": "2026-11-14T09:30:12Z",
    "tx_hash": "0x9a8b7c6d5e4f30211203f4e5d6c7b8a99a8b7c6d5e4f30211203f4e5d6c7b8a9",
    "source": "log",
    "source_index": 211,
    "type": "erc20_transfer",
    "contract": "0x55d398326f99059ff775485246999027b3197955",
    "from": "0x8894e0a0c962cb723c1976a4421c95949be2d4e3",
    "to": "0x77cd0000000000000000000000000000000001e2",
    "token": "0x55d398326f99059ff775485246999027b3197955",
    "amount": "250000000000000000000000",
    "status": "confirmed",
    "payload": {},
    "created_at": "2026-11-14T09:30:13.402Z"
  },
  "acknowledged": null
}

acknowledged tells whether a workspace member acknowledged the alert (by, at); null until someone does. The event status is pending, confirmed or orphaned (block removed by a reorganization).