get_bgp_events
Returns the routing anomalies the bgp-monitor has observed against TunnelMind's BGP watchlist — the witnessability layer's routing dimension. The monitor polls RIPEstat (RIPE NCC) on a cron, self-baselines each watched prefix's origin set on first sight, then records an event whenever a later poll deviates from that baseline.
Use this to check whether a prefix or ASN you depend on (an SSP's egress,
a publisher's network, your own infrastructure) has shown a hijack-shaped
routing event. event_type is one of:
origin_change— an origin AS not in the baseline is announcing the prefix (severitycriticalif that announcement also fails RPKI, elsehigh).rpki_invalid— a current announcement fails RPKI ROA validation.withdrawn— a previously-announced prefix is no longer visible.new_more_specific/visibility_drop— reserved for a later monitor pass.
prev_origins is the baseline the event deviated from. count is the
full filtered set; events is bounded by limit, newest first. An empty
events array means no anomalies in the window — the honest "all clear".
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max events returned (default 100, hard cap 500). | |
| resource | No | Filter to one watched resource — a CIDR prefix (e.g. 45.32.0.0/24) or an ASN (e.g. AS13335). Omit for all. | |
| since_ms | No | Unix epoch milliseconds lower bound on observed_at. |