GET /api/v1/iocs/search — search for a specific IOC

The /api/v1/iocs/search endpoint lets you look up a specific indicator value — such as an IP address, domain, or file hash — across the entire SOC Defenders feed. Unlike the list endpoint, which filters by attributes, this endpoint matches against the indicator value itself. Use it when you have a specific observable and want to know whether the feed has seen it, and if so, with what confidence and from which sources.

Request

Method: GET
URL: https://socdefenders.ai/api/v1/iocs/search
Auth: Required — Authorization: Bearer sk_live_YOUR_KEY
Tier: Free

Query parameters

string

required

The IOC value to search for. For example, an IP address (1.2.3.4), a domain (evil.com), or a file hash (abc123...).

string

Narrow the search to a specific IOC type. One of: ipv4, ipv6, domain, url, md5, sha1, sha256, cve, mitre-attack, email. Useful when a value could be interpreted as more than one type.

Example request

curl -H "Authorization: Bearer sk_live_YOUR_KEY" \
  "https://socdefenders.ai/api/v1/iocs/search?q=evil-domain.com"

Response

The response uses the same structure as GET /api/v1/iocs, filtered to entries that match the queried value:

{
  "meta": { "total": 1, "limit": 100, "offset": 0 },
  "data": [
    {
      "type": "domain",
      "value": "evil-domain.com",
      "confidence": "high",
      "source": {
        "feed_name": "CISA Alerts",
        "category": "government"
      }
    }
  ]
}

Response fields

object

Pagination metadata for the response.

Show properties

integer

Total number of matching IOC entries across all sources.

integer

The limit value applied to this response.

integer

The offset value applied to this response.

array

Array of IOC objects matching the queried value.

Show properties

string

IOC type. One of: ipv4, ipv6, domain, url, md5, sha1, sha256, cve, mitre-attack, email.

string

The indicator value that was matched.

string

Feed confidence rating: high, medium, or low.

string

Name of the source feed that reported this indicator.

string

Category of the source feed (e.g. government, commercial, community).

Error responses

If your API key is missing or invalid, the API returns a 401 Unauthorized response:

{
  "error": {
    "code": "missing_api_key",
    "message": "API key is required. Include it in the Authorization header as \"Bearer sk_live_...\" or in the X-API-Key header.",
    "request_id": "req_..."
  }
}

See Authentication for the full error code reference.

Overview

IOC Endpoints

Articles Endpoints

TAXII 2.1

IOCs

Statistics

Export Formats

Detection Rules

Lookup

API Keys

TAXII

Articles

GET /api/v1/iocs/search — search for a specific IOC

Request

Query parameters

Example request

Response

Response fields

Error responses