Threat intelligence API / Reference / Alerts

Alerts endpoints

Alert rules, CVE alert rules and the webhooks they deliver to, with dry-run and send-test, plus what fired. Starter and up. Starter and up.

POST /alert-rules · GET /alert-rules · POST /cve-alerts · GET /cve-alerts · GET /webhooks · POST /webhooks · PATCH /webhooks/{webhook_id} · DELETE /webhooks/{webhook_id} · POST /webhooks/{webhook_id}/test · GET /alert-rules/{rule_uuid} · PATCH /alert-rules/{rule_uuid} · DELETE /alert-rules/{rule_uuid} · POST /alert-rules/{rule_uuid}/test · POST /alert-rules/{rule_uuid}/send-test · GET /cve-alerts/{rule_uuid} · PATCH /cve-alerts/{rule_uuid} · DELETE /cve-alerts/{rule_uuid} · POST /cve-alerts/{rule_uuid}/test

POST /alert-rules

Create an alert rule (personal or managed-customer scoped) · 1 credit per call

Create a personal alert rule that fires when its conditions match a new threat cluster. Tier-capped conditions (5 most tiers, 50 Business). Delivery via your webhook(s) and/or email. Omit `mssp_customer_id` for a personal rule, or set it to scope the rule to one of your managed customers (Business plan).

Request body · AlertRuleCreate

Field	Type	Meaning
name *	string	Rule name (required).
description	string or null	Optional description.
logic_operator	string	'AND' (all conditions) or 'OR' (any).
conditions *	array of AlertCondition	1+ conditions. Tier-capped (5 for most, 50 for Business).
notify_webhook	boolean	Deliver matches to your webhook(s).
notify_email	boolean	Deliver matches by email.
notify_email_address	string or null	Custom email (must be your domain). Defaults to your account email.
webhook_id	integer or null	Specific webhook id to route to (must be yours). Omit to use all.
mssp_customer_id	integer or null	Scope this rule to one of your managed customers (Business). Omit for a personal rule. If set, any webhook_id must be scoped to the same customer or be unscoped

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/alert-rules"

GET /alert-rules

List your alert rules · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/alert-rules"

POST /cve-alerts

Create a CVE alert rule (personal or managed-customer scoped) · 1 credit per call

Create a personal CVE alert rule. Fires when a CVE matches the filters (vendor/product/CWE/severity/CVSS/EPSS/KEV/exploit/ransomware/keywords), combined by match_logic. Shares the alert-rule tier quota.

Request body · CveAlertRuleCreate

Field	Type	Meaning
name *	string	Rule name (required).
description	string or null
match_logic	string or null	'AND' or 'OR' across the filters set.
vendors	array or null	Affected vendor names to match.
products	array or null	Affected product names.
cwe_ids	array or null	CWE ids, e.g. 'CWE-79'.
severity	array or null	CVSS severities: CRITICAL/HIGH/MEDIUM/LOW.
cvss_min	number or null	Minimum CVSS v3 base score.
cvss_max	number or null	Maximum CVSS v3 base score.
epss_min	number or null	Minimum EPSS probability (0-1).
epss_percentile_min	number or null	Minimum EPSS percentile (0-1).
require_kev	boolean or null	Only CVEs on CISA KEV.
require_exploit	boolean or null	Only CVEs with a public exploit/PoC.
ransomware_use	array or null	CISA ransomware-use flag values (e.g. ['Known']).
keywords	array or null	Free-text keyword filters on the CVE.
notify_webhook	boolean
notify_email	boolean
webhook_id	integer or null	Specific webhook id (must be yours).
mssp_customer_id	integer or null	Scope this CVE rule to one of your managed customers (Business). Omit for a personal rule.

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/cve-alerts"

GET /cve-alerts

List your CVE alert rules · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/cve-alerts"

GET /webhooks

List your webhooks · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/webhooks"

POST /webhooks

Create a webhook (HTTPS, port 443, public host) · 1 credit per call

Request body · WebhookCreatePublic

Field	Type	Meaning
webhook_url *	string	HTTPS URL on port 443; internal and private hosts are rejected.
webhook_type	string	json \| slack \| discord \| teams
secret_key	string or null	Optional HMAC-SHA256 secret; json deliveries carry X-ThreatCluster-Signature.
name	string or null
mssp_customer_id	integer or null

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/webhooks"

PATCH /webhooks/{webhook_id}

Update a webhook · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
webhook_id	path	integer	yes

Request body · WebhookUpdatePublic

Field	Type	Meaning
webhook_url	string or null
webhook_type	string or null
secret_key	string or null
is_active	boolean or null
name	string or null
mssp_customer_id	integer or null

curl -H "X-API-Key: $TC_KEY" -X PATCH \
  "https://threatcluster.io/api/public/v1/webhooks/{webhook_id}"

DELETE /webhooks/{webhook_id}

Delete a webhook · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
webhook_id	path	integer	yes
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" -X DELETE \
  "https://threatcluster.io/api/public/v1/webhooks/{webhook_id}"

POST /webhooks/{webhook_id}/test

Send a test payload to a webhook · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
webhook_id	path	integer	yes
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/webhooks/{webhook_id}/test"

GET /alert-rules/{rule_uuid}

Get one alert rule · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
rule_uuid	path	string	yes
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/alert-rules/{rule_uuid}"

PATCH /alert-rules/{rule_uuid}

Update an alert rule · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
rule_uuid	path	string	yes

Request body · AlertRuleUpdate

Field	Type	Meaning
name	string or null
description	string or null
logic_operator	string or null	'AND' or 'OR'.
conditions	array or null
is_active	boolean or null
notify_webhook	boolean or null
notify_email	boolean or null
notify_email_address	string or null	Empty string clears it.
webhook_id	integer or null	0 clears it.
mssp_customer_id	integer or null	The managed customer the rule belongs to, if not personal.

curl -H "X-API-Key: $TC_KEY" -X PATCH \
  "https://threatcluster.io/api/public/v1/alert-rules/{rule_uuid}"

DELETE /alert-rules/{rule_uuid}

Delete an alert rule · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
rule_uuid	path	string	yes
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" -X DELETE \
  "https://threatcluster.io/api/public/v1/alert-rules/{rule_uuid}"

POST /alert-rules/{rule_uuid}/test

Dry-run a rule against the last 7 days (sends nothing) · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
rule_uuid	path	string	yes
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/alert-rules/{rule_uuid}/test"

POST /alert-rules/{rule_uuid}/send-test

Fire a test notification to the rule's webhooks · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
rule_uuid	path	string	yes
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/alert-rules/{rule_uuid}/send-test"

GET /cve-alerts/{rule_uuid}

Get one CVE alert rule · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
rule_uuid	path	string	yes
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/cve-alerts/{rule_uuid}"

PATCH /cve-alerts/{rule_uuid}

Update a CVE alert rule · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
rule_uuid	path	string	yes

Request body · CveAlertRuleUpdate

Field	Type	Meaning
name	string or null
description	string or null
is_active	boolean or null
match_logic	string or null
vendors	array or null
products	array or null
cwe_ids	array or null
severity	array or null
cvss_min	number or null
cvss_max	number or null
epss_min	number or null
epss_percentile_min	number or null
require_kev	boolean or null
require_exploit	boolean or null
ransomware_use	array or null
keywords	array or null
notify_email	boolean or null
notify_webhook	boolean or null
webhook_id	integer or null
mssp_customer_id	integer or null

curl -H "X-API-Key: $TC_KEY" -X PATCH \
  "https://threatcluster.io/api/public/v1/cve-alerts/{rule_uuid}"

DELETE /cve-alerts/{rule_uuid}

Delete a CVE alert rule · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
rule_uuid	path	string	yes
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" -X DELETE \
  "https://threatcluster.io/api/public/v1/cve-alerts/{rule_uuid}"

POST /cve-alerts/{rule_uuid}/test

Preview which CVEs from the last 30 days a rule matches · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
rule_uuid	path	string	yes
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/cve-alerts/{rule_uuid}/test"