curl -H "Authorization: Bearer sk_live_..." \
  "https://socdefenders.ai/api/v1/articles/e90ea8b7-8500-4a14-875c-1d64755c80ca"

{
  "meta": {
    "generated_at": "2026-05-17T10:30:00Z",
    "feed_version": "1.0",
    "source": "SOC Defenders"
  },
  "data": {
    "id": "c59a6bb4-f69a-4b90-babe-ca1afcda3514",
    "title": "Cryptomixer crypto laundering service taken down by law enforcement",
    "url": "https://www.bleepingcomputer.com/news/security/cryptomixer-takedown/",
    "canonical_url": "https://socdefenders.ai/item/c59a6bb4-f69a-4b90-babe-ca1afcda3514",
    "summary": "International law enforcement seized cryptomixer.io...",
    "ai_summary": "Joint operation by Europol, FBI, and German federal police seized the cryptomixer.io domain and arrested two operators. The service had laundered approximately $5.4 billion in cryptocurrency since 2018.",
    "image_url": null,
    "published_at": "2025-12-01T12:37:52Z",
    "fetched_at": "2025-12-01T12:40:15Z",
    "modified_at": "2025-12-01T13:00:00Z",
    "source_name": "BleepingComputer",
    "source_type": "rss",
    "source_tier": 1,
    "category": "attacks-breaches",
    "category_label": "Attacks & Breaches",
    "category_legacy": "Cybercrime",
    "content_type": "security",
    "severity_score": 6.5,
    "severity_label": "medium",
    "categorized_by": "ai",
    "categorized_at": "2025-12-01T12:42:00Z",
    "ai_classification": "law-enforcement-action",
    "ai_classification_confidence": 0.91,
    "tech_tags": [
      "cryptocurrency",
      "tor"
    ],
    "industry_tags": [
      "finance"
    ],
    "threat_actors": [],
    "has_iocs": true,
    "ioc_count": 1,
    "score": 12,
    "upvotes": 14,
    "downvotes": 2,
    "comment_count": 5,
    "vouch_count": 3,
    "rank_score": 23.4,
    "submission_type": "rss_auto",
    "submitted_by_username": null,
    "audio_url": null,
    "audio_duration_seconds": null,
    "audio_voice": null,
    "mitre_techniques": [
      {
        "id": "T1657",
        "name": "Financial Theft",
        "tactic": "impact",
        "confidence": "high"
      }
    ],
    "cve_ids": [],
    "iocs": [
      {
        "id": "6fc99fbc-2c24-4ce2-8b42-48065d4976e7",
        "type": "domain",
        "value": "cryptomixer.io",
        "confidence": "high",
        "first_seen": "2025-12-01T21:21:20Z"
      }
    ],
    "iocs_truncated": false,
    "cves": [],
    "threat_actors_detail": []
  }
}

Articles

Retrieve a single article with full expansions

Fetches one article by UUID with all expansions enabled by default (iocs, cves, threat_actors, mitre). Use ?expand=mitre to opt out of the heavy expansions if you just need the article body.

Common use cases

1. Article detail page (web UI)

Fetch everything in one request:

GET /api/v1/articles/e90ea8b7-8500-4a14-875c-1d64755c80ca

2. IOC enrichment workflow

Click-through from an IOC search to the source article’s full context:

GET /api/v1/articles/{id}?expand=iocs,threat_actors

3. Minimal lookup (just the body)

GET /api/v1/articles/{id}?expand=mitre&fields=id,title,url,ai_summary,severity_score

Errors

Status	Code	Meaning
400	`invalid_parameter`	id is not a valid UUID
403	`lookback_exceeded`	Article exists but published before your tier’s lookback window
404	`article_not_found`	No article with that UUID
410	`article_archived`	Article was archived. Pass `?include_archived=true` to retrieve it anyway

Responses are cached for 60 seconds (Cache-Control: public, s-maxage=60, stale-while-revalidate=120).

GET

api

articles

{id}

curl -H "Authorization: Bearer sk_live_..." \
  "https://socdefenders.ai/api/v1/articles/e90ea8b7-8500-4a14-875c-1d64755c80ca"

{
  "meta": {
    "generated_at": "2026-05-17T10:30:00Z",
    "feed_version": "1.0",
    "source": "SOC Defenders"
  },
  "data": {
    "id": "c59a6bb4-f69a-4b90-babe-ca1afcda3514",
    "title": "Cryptomixer crypto laundering service taken down by law enforcement",
    "url": "https://www.bleepingcomputer.com/news/security/cryptomixer-takedown/",
    "canonical_url": "https://socdefenders.ai/item/c59a6bb4-f69a-4b90-babe-ca1afcda3514",
    "summary": "International law enforcement seized cryptomixer.io...",
    "ai_summary": "Joint operation by Europol, FBI, and German federal police seized the cryptomixer.io domain and arrested two operators. The service had laundered approximately $5.4 billion in cryptocurrency since 2018.",
    "image_url": null,
    "published_at": "2025-12-01T12:37:52Z",
    "fetched_at": "2025-12-01T12:40:15Z",
    "modified_at": "2025-12-01T13:00:00Z",
    "source_name": "BleepingComputer",
    "source_type": "rss",
    "source_tier": 1,
    "category": "attacks-breaches",
    "category_label": "Attacks & Breaches",
    "category_legacy": "Cybercrime",
    "content_type": "security",
    "severity_score": 6.5,
    "severity_label": "medium",
    "categorized_by": "ai",
    "categorized_at": "2025-12-01T12:42:00Z",
    "ai_classification": "law-enforcement-action",
    "ai_classification_confidence": 0.91,
    "tech_tags": [
      "cryptocurrency",
      "tor"
    ],
    "industry_tags": [
      "finance"
    ],
    "threat_actors": [],
    "has_iocs": true,
    "ioc_count": 1,
    "score": 12,
    "upvotes": 14,
    "downvotes": 2,
    "comment_count": 5,
    "vouch_count": 3,
    "rank_score": 23.4,
    "submission_type": "rss_auto",
    "submitted_by_username": null,
    "audio_url": null,
    "audio_duration_seconds": null,
    "audio_voice": null,
    "mitre_techniques": [
      {
        "id": "T1657",
        "name": "Financial Theft",
        "tactic": "impact",
        "confidence": "high"
      }
    ],
    "cve_ids": [],
    "iocs": [
      {
        "id": "6fc99fbc-2c24-4ce2-8b42-48065d4976e7",
        "type": "domain",
        "value": "cryptomixer.io",
        "confidence": "high",
        "first_seen": "2025-12-01T21:21:20Z"
      }
    ],
    "iocs_truncated": false,
    "cves": [],
    "threat_actors_detail": []
  }
}

Authorizations

X-API-Key

string

header

required

API key in X-API-Key header

Path Parameters

string<uuid>

required

Article UUID (from a previous list response)

Example:

"e90ea8b7-8500-4a14-875c-1d64755c80ca"

Query Parameters

expand

string

Comma-separated expansions. Defaults to all four (mitre,iocs,cves,threat_actors) since callers fetching one article usually want the full picture.

Example:

"iocs,cves"

fields

string

Comma-separated field allowlist for sparse response.

Example:

"id,title,severity_score"

include_archived

boolean

default:false

Return the article even if it has been archived. Default false returns 410 article_archived.

Response

Article found.