Threat intelligence API / Reference

API reference

42 endpoints under https://threatcluster.io/api/public/v1, grouped by what they return. Every page is generated from the OpenAPI document; the interactive view runs the same calls in the browser.

Quick startopenapi.json

Endpoint groups

Threats5 endpoints. Incident clusters: the deduplicated, scored record per story, with its articles, entities, IOCs and STIX export.Entities5 endpoints. Threat actors, malware, tools, companies, products, CVEs, countries and industries, with profiles and the incidents they appear in.IOCs2 endpoints. Validated indicators as a rolling feed or export, in JSON, text and CSV.Dark web8 endpoints. Ransomware leak-site listings, groups and victim records from ThreatCluster's own collection.Vulnerabilities3 endpoints. CVEs joined with EPSS, KEV and exploitation reporting.Ask AI2 endpoints · Researcher and up. Cited answers about one incident or across the corpus. Researcher and up.Feeds4 endpoints · Researcher and up. Saved feeds built from a sentence. Researcher and up.Alerts2 endpoints · Researcher and up. Alert rules and their matches. Researcher and up.Stats2 endpoints. Corpus counts and status.Account1 endpoint. Credits left, tier and scopes for the calling key. Free to call.Managed customers7 endpoints · Business. Per-customer scoping for teams that manage several client estates. Business.Compliance1 endpoint. Compliance-evidence endpoints.

Conventions

  • Authentication: send the key as X-API-Key. Keys carry scopes; a call outside the key's scopes returns 403 naming the scope.
  • Credits: each call costs the credits shown on its page; X-Request-Cost and X-RateLimit-Remaining on every response, GET /me to check the balance for free.
  • Free tier: the last seven days, 25 rows a page, trimmed records; older data returns 403 lookback_exceeded.
  • Versioning: /v1 does not change shape; breaking changes go to /v2.