Threat Intelligence API

Ask for what happened to a vendor this week, which CVEs are being exploited, who a ransomware group hit last month, or whether a domain is in the blocklist. 46 endpoints in seven scope groups. The free tier covers the first five.

• Search threats:read. One term across clusters, entities and the dark web in a single call: /search?q=acme returns matching clusters, the entities with that name, and any leak-site victims, groups, markets, breaches or underground sites that match. Articles on request.
• Threats threats:read. Trending or newest clusters with a time window and keyword filter. One cluster by id, its indicators, the cluster as a STIX 2.1 bundle, and corpus counts.
• IOCs iocs:read. A polling feed and a bulk export, filtered by type, confidence and window, as text, CSV or JSON. Runs through the same validation and false-positive checks as the public blocklist.
• Entities entities:read. Search across actors, malware, tools, companies, countries, industries and CVEs. An entity record with its recent clusters, the entities it co-occurs with, the CVEs seen alongside it, and what is trending this week.
• Vulnerabilities vulns:read. CVEs with CVSS, EPSS, KEV status and exploit availability, filtered by vendor, product, severity and date. One CVE with the clusters that mention it.
• Dark web darkweb:read. Leak-site victims with sector and country facets, group profiles and infrastructure, breach disclosures, market listings, keyword matches and weekly trends.
• Feeds and alerts feeds:* alerts:*, Researcher and up. Clusters matching your saved feeds. Create and manage feeds, alert rules and CVE watch rules, and record dispositions.
• Inventory, MSSP, compliance inventory:* mssp:* compliance:read, Business and MSSP. Upload a software inventory and get back the clusters and CVEs that touch it. Create and manage MSSP customers. Pull the control attestation for a tenant.

Every path, parameter and response model is in the reference. The public feeds (RSS, MISP, the IOC blocklist) and the schema itself need no key.

Every account gets one, no card. A free key makes 100 requests a day across all five read scopes, dark web included, and can read the last seven days. Records come back trimmed. On a cluster that means the short summary, threat score and urgency, keywords, source links, the first three timeline events and up to ten articles with title, source and URL. The enhanced summary, sub-scores, severity reasoning and article text are left out. On an entity the recent-events history is left out and the cluster and article lists are cut to ten. Secondary lists stop at ten rows.

That is enough for a morning dashboard or a SIEM lookup against this week's activity. It is not enough to copy the database. Researcher keys have no window and no trimming, and add the feeds and alert scopes. Business and MSSP keys add inventory, MSSP and compliance.

Free responses carry "tier": "free" and "lookback_days": 7. A request for a record older than seven days returns 403 with "error": "lookback_exceeded" in the body.

Create a key in Settings and send it as X-API-Key. There is no OAuth flow and nothing to install. The base URL is https://threatcluster.io/api/public/v1.

Search returns buckets: clusters, entities and dark web hits. Each cluster has a title and summary, a threat score, keywords, the URLs of the articles it was built from, and an id you can pass to the detail, IOC and STIX endpoints.

JSON on every endpoint. Also:

• STIX 2.1 per cluster. A report, its indicators and the inferred entity-to-entity relationships, TLP-marked, for OpenCTI or any STIX-aware TIP
• Text and CSV on the IOC endpoints, for a firewall blocklist or a SIEM lookup table with no parsing step
• MISP and RSS on the public feeds, no key needed
• Markdown of any cluster or entity page at the same URL with .md appended, for LLM context

The tc command line wraps the same API with keyring auth and JSON output, and an agent can call it as a tool. How the CLI works.

Because the pages are built from the same records, and the API is the one that is versioned.

Cluster and entity pages render the objects behind /threats and /entities. Scraping them gets you the same fields wrapped in markup, scores drawn as bars instead of numbers, no STIX, and a layout that changes whenever the site does. /v1 stays as it is. Breaking changes go to /v2.

Error codes: 401 for a bad key, 403 with the scope or window you have hit, 429 with Retry-After when you are over budget.

The threatcluster-api repository on GitHub has a daily snapshot of the OpenAPI document, a short Python client that handles retries and paging, and runnable examples in curl, Python and Node. File API bugs there.

Postman and Insomnia import the OpenAPI document directly. An OpenAPI generator will give you a typed client in whatever language you are working in.

• CLI and agent toolsThe same API from a terminal or an LLM loop
• IOCs and ExportsSTIX, MISP, SIEM ingestion
• Custom FeedsSaved filters, delivered where your team reads
• Real-Time ClusteringHow the records are built
• Dark WebOur own leak-site collection
• Entity IntelligenceProfile pages for every actor, malware, CVE and tool