POST /threats/{identifier}/ask
Ask AI about one incident · 25 credits per call
A grounded, cited answer about one cluster. 25 credits.
`action` picks a canned analysis (executive_summary, extract_iocs, threat_actor, related_campaigns, vulnerability, recommended_actions) or `custom` with your own `question`. The context is the cluster's own reporting: article bodies, sub-articles, IOCs, enriched CVEs and actors, related clusters. Answers cite sources with inline tags that map to `sources`. Identical canned asks are cached for an hour and cost the same either way; model failures refund the credits.
Parameters
| Name | In | Type | Required | Meaning |
|---|---|---|---|---|
| identifier | path | string | yes |
Request body · AskThreatRequest
| Field | Type | Meaning |
|---|---|---|
| action | string | executive_summary · extract_iocs · threat_actor · related_campaigns · vulnerability · recommended_actions · custom |
| question | string or null | Required when action is custom |
Response 200 · AskResponse
| Field | Type | Meaning |
|---|---|---|
| answer * | string | Markdown, with inline citation tags like [A1] that map to `sources` |
| sources | array of object | Citation tags → article/cluster they point at |
| references | Clusters and articles the answer drew on: {clusters: [...], articles: [...]} | |
| context_used | object | |
| cost * | integer | Credits charged for this call |
| cached | boolean |
curl -H "X-API-Key: $TC_KEY" -X POST \
"https://threatcluster.io/api/public/v1/threats/{identifier}/ask"