Skip to main content
The /api/v1/iocs/stats endpoint returns aggregate counts of all IOCs in the SOC Defenders feed, broken down by indicator type, source category, and named feed. Use it to build monitoring dashboards, track feed health over time, or verify that your ingestion pipeline is receiving the expected volume of indicators.

​
Request

Method: GET
URL: https://socdefenders.ai/api/v1/iocs/stats
Auth: Required — Authorization: Bearer sk_live_YOUR_KEY
Tier: Pro
This endpoint requires a Pro subscription. Requests made with a Free-tier key will receive a 403 Forbidden response.

​
Example request

curl -H "Authorization: Bearer sk_live_YOUR_KEY" \
  "https://socdefenders.ai/api/v1/iocs/stats"

​
Response

{
  "totals": {
    "by_type": {
      "ipv4": 48210,
      "ipv6": 3120,
      "domain": 29845,
      "url": 11503,
      "md5": 8760,
      "sha1": 6340,
      "sha256": 9210,
      "cve": 4120,
      "mitre-attack": 890,
      "email": 2100
    },
    "by_category": {
      "government": 32100,
      "commercial": 51200,
      "community": 40798
    },
    "by_source": {
      "CISA Alerts": 12400,
      "Emerging Threats": 23100,
      "Abuse.ch": 18600
    }
  },
  "last_updated": "2024-01-15T10:00:00Z"
}

​
Response fields

​
totals
object
Aggregate IOC counts broken down across multiple dimensions.
​
last_updated
string
ISO 8601 timestamp of the most recent feed update (e.g. 2024-01-15T10:00:00Z).

​
Error responses

If your API key is missing, invalid, or from a Free-tier account, the API returns an error response: 
{
  "error": {
    "code": "missing_api_key",
    "message": "API key is required. Include it in the Authorization header as \"Bearer sk_live_...\" or in the X-API-Key header.",
    "request_id": "req_..."
  }
}
See Authentication for the full error code reference.