Overview KPIs

Everything on the dashboard's Overview page, endpoint by endpoint. All endpoints are free tier, read-only, and accept the standard range / start / end params.

Headline tiles

The top KPI tiles and executive header in one object: volume, engagement, intel pipeline, tiered counts, and money.

Query: range (default 7d), start, end.

curl -H "Authorization: Bearer $BBO_API_KEY" \
  "https://dashboard.martha-honeypot.com/api/kpis/summary?range=7d"

{
  "range": { "start_utc": "...", "end_utc": "...", "label": "Last 7 days" },
  "calls_received": 1840, "cleanly_closed": 1620, "hooked_calls": 512,
  "hook_rate": 0.278,
  "avg_call_duration_sec": 143.2, "median_call_duration_sec": 92.0, "max_call_duration_sec": 1580.0,
  "insights_produced": 1780, "high_confidence_insights": 990, "avg_auditor_confidence": 0.71,
  "tier1_calls": 74, "tier2_calls": 260, "tier3_calls": 1310,
  "total_dollars_asked": 84250.0, "median_dollar_ask": 500.0, "max_single_ask": 12000.0,
  "total_dollars_dangled": 415000.0
}

Field	Meaning
calls_received	Calls in the window.
hooked_calls / hook_rate	Calls that engaged (≥15s and ≥1 intel field) and the ratio (0–1).
avg/median/max_call_duration_sec	Call-length distribution.
insights_produced / high_confidence_insights	Extractions, and those with confidence ≥ 0.7.
tier1_calls	Calls with mule bank / crypto / gift-card data.
tier2_calls	Calls with payment method / phishing URL / RDP tool / agency.
tier3_calls	Calls with impersonated brand / lure only.
total_dollars_asked	Grounded payment demands (Σ of what victims were told to send).
median_dollar_ask / max_single_ask	Ask distribution.

Trend charts (time series)

A single metric bucketed over time — powers the trend lines.

Path: {metric} — one of calls, hooked_calls, hook_rate, tier1_calls, total_dollars_asked, avg_duration_sec, high_confidence_insights.
Query: bucket = 15min | hour | day (default) | week; plus range/start/end.

curl -H "Authorization: Bearer $BBO_API_KEY" \
  "https://dashboard.martha-honeypot.com/api/kpis/timeseries/calls?range=30d&bucket=day"

{ "metric": "calls", "bucket": "day", "range": {...},
  "points": [ { "timestamp": "2026-06-01T00:00:00Z", "value": 240 }, ... ] }

Top-N breakdowns

Ranked values of a field — the "top brands / lures / payment methods…" panels.

Path: {field} — one of impersonated_brand, lure_category, payment_method, impersonated_government_agency, mule_bank_name, mule_bank_routing, crypto_chain, gift_card_brand, remote_desktop_app, synthetic_org, fake_agent_name.
Query: n (1–50, default 10); plus range params.

curl -H "Authorization: Bearer $BBO_API_KEY" \
  "https://dashboard.martha-honeypot.com/api/kpis/topn/impersonated_brand?range=7d&n=10"

{ "field": "impersonated_brand", "range": {...},
  "items": [ { "label": "Medicare", "count": 210, "pct_of_total": 0.18 }, ... ] }

Intraday traffic

15-minute arrival buckets — the intraday traffic shape. Defaults to a 1-day window.

curl -H "Authorization: Bearer $BBO_API_KEY" \
  "https://dashboard.martha-honeypot.com/api/kpis/arrivals?range=24h"

{ "range": {...}, "granularity": "15min",
  "buckets": [ { "bucket_start_utc": "2026-07-27T14:00:00Z", "count": 12 }, ... ] }

Distributions

Call-duration distribution buckets.

Dollar-ask distribution buckets.

curl -H "Authorization: Bearer $BBO_API_KEY" \
  "https://dashboard.martha-honeypot.com/api/kpis/ask-histogram?range=30d"
# → { "buckets": [ { "label": "$1–$100", "count": 88 }, ... ] }

Tier-1 financial extractions

The Tier-1 table — one row per call carrying mule-bank / crypto / gift-card data.

Query: limit (1–1000); plus range params.

curl -H "Authorization: Bearer $BBO_API_KEY" \
  "https://dashboard.martha-honeypot.com/api/kpis/tier1?range=30d&limit=200"

{ "range": {...}, "total": 74, "items": [
  { "call_sid": "CA…", "call_started_at": "...", "auditor_confidence": 0.82,
    "mule_bank_name": "…", "mule_bank_routing_number": "…",
    "mule_bank_account_number": "…", "mule_account_holder_name": "…",
    "crypto_wallet_address": null, "crypto_chain": null,
    "gift_card_brand": null, "physical_mule_drop_address": null }, ... ] }

Attacker geography (US map)

Calls rolled up to US states (from caller-ID area codes) — powers the map.

{ "range": {...}, "items": [
  { "state": "CA", "count": 180, "area_codes": ["213","310","408"] }, ... ] }

Disconnect attribution

Why calls ended, in four categories.

{ "range": {...}, "caller_hung_up_normal": 1500,
  "websocket_issue_our_side": 40, "jolly_roger_issue": 12,
  "gemini_session_capped": 30 }

Live calls in progress

Currently-engaged honeypot sessions (live; sourced from the session store — not affected by the range param).

{ "active_count": 3, "calls": [
  { "call_sid": "CA…", "persona": "Renee", "caller_id": "…",
    "impersonated_brand": "Medicare", "lure_category": "HEALTHCARE_BENEFITS",
    "state": "Extracting", "started_at": "...", "last_heartbeat": "..." }, ... ] }