Skip to main content
The SOC Defenders REST API gives you programmatic access to aggregated threat intelligence from 30+ cybersecurity sources. You can retrieve IOCs, query enriched articles, export data in industry-standard formats (STIX 2.1, MISP, CEF, OpenIOC, Sigma), and poll a TAXII 2.1 server — all over HTTPS using JSON responses.

​
Base URL

All API requests go to:
Version 1 endpoints are available under the /api/v1/ path prefix. For example:

​
Response format

All endpoints return JSON by default. Some endpoints support alternative output formats (such as STIX 2.1 bundles, MISP events, or Sigma YAML) — these are noted in the individual endpoint references.

​
Authentication

Every request requires an API key. Pass it as a Bearer token in the Authorization header or in the X-API-Key header. See Authentication for details.

​
Available endpoints

For limits on results per request, lookback periods, and request quotas by tier, see Rate limits.

​
OpenAPI specification

The machine-readable OpenAPI spec is available at:
You can import it into Postman, Insomnia, or any OpenAPI-compatible tooling to explore and test the API interactively.