Skip to main content
The /api/v1/iocs/search endpoint lets you look up a specific indicator value — such as an IP address, domain, or file hash — across the entire SOC Defenders feed. Unlike the list endpoint, which filters by attributes, this endpoint matches against the indicator value itself. Use it when you have a specific observable and want to know whether the feed has seen it, and if so, with what confidence and from which sources.

Request

Method: GET
URL: https://socdefenders.ai/api/v1/iocs/search
Auth: Required — Authorization: Bearer sk_live_YOUR_KEY
Tier: Free

Query parameters

string
required
The IOC value to search for. For example, an IP address (1.2.3.4), a domain (evil.com), or a file hash (abc123...).
string
Narrow the search to a specific IOC type. One of: ipv4, ipv6, domain, url, md5, sha1, sha256, cve, mitre-attack, email. Useful when a value could be interpreted as more than one type.

Example request

Response

The response uses the same structure as GET /api/v1/iocs, filtered to entries that match the queried value:

Response fields

object
Pagination metadata for the response.
array
Array of IOC objects matching the queried value.

Error responses

If your API key is missing or invalid, the API returns a 401 Unauthorized response:
See Authentication for the full error code reference.