Skip to main content
GET

Authorizations

X-API-Key
string
header
required

API key in X-API-Key header

Query Parameters

type
enum<string>

Filter by IOC type. Common: ipv4, domain, sha256. Less common: email, cve (use /api/v1/articles?cve_text_search= for CVE search), mitre_attack (technique IDs).

Available options:
ipv4,
ipv6,
domain,
url,
md5,
sha1,
sha256,
sha512,
email,
cve,
mitre_attack
Example:

"ipv4"

category
enum<string>

Filter by the originating source category. threat-intel = direct from threat feeds (URLhaus etc.). news/research/vendor/government = extracted from articles in that category.

Available options:
news,
research,
threat-intel,
vendor,
government
Example:

"threat-intel"

confidence
enum<string>

Filter by confidence level. high = both source and extraction high-confidence; use this for automated blocking. medium/low are for review/analyst surfacing.

Available options:
high,
medium,
low
Example:

"high"

industry
string

Filter to IOCs tagged with a target industry sector. Available: finance, healthcare, government, technology, manufacturing, retail, energy, education, telecom, transportation, defense, water.

Example:

"finance"

since
string<date-time>

Lower time bound on extracted_at (ISO 8601). Silently clamped to your tier lookback.

Example:

"2026-05-16T00:00:00Z"

until
string<date-time>

Upper time bound on extracted_at (ISO 8601).

Example:

"2026-05-17T00:00:00Z"

limit
integer
default:100

Max results per request. Tier-capped (Free=100, Pro=10000). Use the Articles endpoint with cursor pagination for unbounded scans.

Required range: 1 <= x <= 10000
Example:

500

offset
integer
default:0

Pagination offset. Cheap up to ~1000; for deeper walks narrow your time window instead.

Required range: x >= 0
Example:

0

format
enum<string>
default:json

json (full envelope), csv (10 columns), txt (bare values one per line — drop directly into firewall/EDR).

Available options:
json,
csv,
txt
Example:

"txt"

include_context
boolean
default:true

When false, the context field is omitted from each IOC (saves ~30% payload on average). Useful for SIEM ingestion that only needs the value.

Example:

false

Response

Successful response

meta
object
data
object[]