> ## Documentation Index
> Fetch the complete documentation index at: https://docs.socdefenders.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# GET /api/v1/iocs/stats — IOC feed statistics

> Retrieve total IOC counts broken down by type, category, and source feed for analytics dashboards and monitoring. Requires Pro subscription.

The `/api/v1/iocs/stats` endpoint returns aggregate counts of all IOCs in the SOC Defenders feed, broken down by indicator type, source category, and named feed. Use it to build monitoring dashboards, track feed health over time, or verify that your ingestion pipeline is receiving the expected volume of indicators.

## Request

**Method:** `GET`\
**URL:** `https://socdefenders.ai/api/v1/iocs/stats`\
**Auth:** Required — `Authorization: Bearer sk_live_YOUR_KEY`\
**Tier:** Pro

<Note>
  This endpoint requires a Pro subscription. Requests made with a Free-tier key will receive a `403 Forbidden` response.
</Note>

## Example request

```bash theme={null}
curl -H "Authorization: Bearer sk_live_YOUR_KEY" \
  "https://socdefenders.ai/api/v1/iocs/stats"
```

## Response

```json theme={null}
{
  "totals": {
    "by_type": {
      "ipv4": 48210,
      "ipv6": 3120,
      "domain": 29845,
      "url": 11503,
      "md5": 8760,
      "sha1": 6340,
      "sha256": 9210,
      "cve": 4120,
      "mitre-attack": 890,
      "email": 2100
    },
    "by_category": {
      "government": 32100,
      "commercial": 51200,
      "community": 40798
    },
    "by_source": {
      "CISA Alerts": 12400,
      "Emerging Threats": 23100,
      "Abuse.ch": 18600
    }
  },
  "last_updated": "2024-01-15T10:00:00Z"
}
```

### Response fields

<ResponseField name="totals" type="object">
  Aggregate IOC counts broken down across multiple dimensions.

  <Expandable title="properties">
    <ResponseField name="totals.by_type" type="object">
      Count of IOCs per indicator type. Keys correspond to IOC types: `ipv4`, `ipv6`, `domain`, `url`, `md5`, `sha1`, `sha256`, `cve`, `mitre-attack`, `email`. Values are integers.
    </ResponseField>

    <ResponseField name="totals.by_category" type="object">
      Count of IOCs per source category (e.g. `government`, `commercial`, `community`). Values are integers.
    </ResponseField>

    <ResponseField name="totals.by_source" type="object">
      Count of IOCs per named source feed (e.g. `CISA Alerts`, `Emerging Threats`). Values are integers.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="last_updated" type="string">
  ISO 8601 timestamp of the most recent feed update (e.g. `2024-01-15T10:00:00Z`).
</ResponseField>

## Error responses

If your API key is missing, invalid, or from a Free-tier account, the API returns an error response:

```json theme={null}
{
  "error": {
    "code": "missing_api_key",
    "message": "API key is required. Include it in the Authorization header as \"Bearer sk_live_...\" or in the X-API-Key header.",
    "request_id": "req_..."
  }
}
```

See [Authentication](/api-reference/authentication) for the full error code reference.