Skip to main content
GET
Pull recent indicators

Authorizations

X-API-Key
string
header
required

API key in X-API-Key header

Path Parameters

collectionId
string
required

Collection ID from the list endpoint (e.g. soc-defenders-all, soc-defenders-network, soc-defenders-hashes).

Example:

"soc-defenders-network"

Query Parameters

added_after
string<date-time>

Return only objects added to the collection after this timestamp. Canonical delta-poll mechanism — save the response's X-TAXII-Date-Added-Last header value and pass it back here on the next request.

Example:

"2026-05-16T00:00:00Z"

limit
integer
default:100

Max objects per response (max 1000). For deep pulls, walk forward via added_after rather than skipping.

Required range: x <= 1000
Example:

500

type
string

Filter by STIX object type. indicator is the most common — narrows the bundle to just IOC indicators (no identity/marking-definition objects).

Example:

"indicator"

Response

STIX 2.1 bundle of objects in the collection. Use X-TAXII-Date-Added-Last for delta-poll continuation.

type
enum<string>
Available options:
bundle
id
string
Pattern: ^bundle--[0-9a-f-]+$
objects
object[]