Threat intelligence API / Reference / Feeds

Feeds endpoints

Saved feeds built from typed entities or keywords, with the personal-feed keywords behind feed_type=my_feed. Create, list, update, delete. Starter and up. Starter and up.

GET /feeds · POST /feeds · GET /feeds/{feed_id}/entities · POST /feeds/{feed_id}/entities · GET /feed · PATCH /feeds/{feed_id} · DELETE /feeds/{feed_id} · DELETE /feeds/{feed_id}/entities/{keyword} · GET /keywords · POST /keywords · DELETE /keywords/{keyword}

GET /feeds

List your custom feeds · 1 credit per call

List your custom feeds in the requested slice (defaults to personal).

Pass `?mssp_customer_id=N` to scope the read to a specific managed customer.

Parameters

Name	In	Type	Required	Meaning
mssp_customer_id	query	integer or null

Response 200 · FeedsListResponse

Field	Type	Meaning
feeds *	array of FeedSummary
count *	integer

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/feeds"

POST /feeds

Create a custom feed on your account · 1 credit per call

Create a personal custom feed seeded with keywords. Returns the feed_id you read back via GET /feeds. (For a managed customer: use /mssp/customers/{id}/feed.)

Request body · FeedCreate

Field	Type	Meaning
name *	string	Feed name (required).
keywords	array or null	Untyped keywords to seed the feed — matched against the entity values extracted from articles.
entities	array or null	Typed entities to seed the feed, e.g. {"keyword": "FortiOS", "entity_type": "platform"}. Use this for a stack or supply-chain feed.
description	string or null	Optional feed description.
mssp_customer_id	integer or null	Create the feed on one of your managed customers (MSSP). Omit for a personal feed.

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/feeds"

GET /feeds/{feed_id}/entities

Entities tracked by a feed · 1 credit per call

Get entities tracked in a custom feed.

Pass `?mssp_customer_id=N` to read a customer-scoped feed (default: personal).

Parameters

Name	In	Type	Required	Meaning
feed_id	path	string	yes
mssp_customer_id	query	integer or null

Response 200 · FeedEntitiesResponse

Field	Type	Meaning
feed_id *	string
entities *	array of FeedEntity
count *	integer

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/feeds/{feed_id}/entities"

POST /feeds/{feed_id}/entities

Add typed entities or keywords to a feed · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
feed_id	path	string	yes

Request body · FeedEntitiesAdd

Field	Type	Meaning
entities	array or null
keyword	string or null	Shorthand for a single entity.
entity_type	string or null
is_custom	boolean
mssp_customer_id	integer or null

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/feeds/{feed_id}/entities"

GET /feed

Threats matching your feed filters · 1 credit per call

Query the threat feed with full filtering.

Query parameters

limit: Max results (default: 50, max: 100)
offset: Pagination offset (default: 0)
time_filter: 1h, 24h, 7d, 30d (default: 7d)
sort_by: trending, latest, popular, threat_score (default: trending)
content_type: all, threats, articles (default: all)
feed_type: trending, popular, latest, my_feed, custom (default: trending)
feed_id: UUID of custom feed (required when feed_type=custom)
keyword: Optional keyword filter
urgency: "hot" for high-velocity only (optional)

Use feed_type=my_feed to query your personal keyword feed. Use feed_type=custom with feed_id to query a specific custom feed.

Parameters

Name	In	Type
limit	query	integer
offset	query	integer
time_filter	query	string
sort_by	query	string
content_type	query	string
feed_type	query	string
feed_id	query	string
keyword	query	string
urgency	query	string
mssp_customer_id	query	integer or null
since	query	string

Response 200 · FeedResponse

Field	Type	Meaning
items *	array of ThreatListItem
count	integer or null
total	integer or null
limit	integer or null
offset	integer or null
time_filter	string or null
sort_by	string or null
content_type	string or null
feed_type	string or null

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/feed"

PATCH /feeds/{feed_id}

Rename or describe a feed · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
feed_id	path	string	yes

Request body · FeedUpdate

Field	Type	Meaning
name	string or null
description	string or null
mssp_customer_id	integer or null	The managed customer the feed belongs to, if not personal.

curl -H "X-API-Key: $TC_KEY" -X PATCH \
  "https://threatcluster.io/api/public/v1/feeds/{feed_id}"

DELETE /feeds/{feed_id}

Delete a feed · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
feed_id	path	string	yes
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" -X DELETE \
  "https://threatcluster.io/api/public/v1/feeds/{feed_id}"

DELETE /feeds/{feed_id}/entities/{keyword}

Remove an entity or keyword from a feed · 1 credit per call

Parameters

Name	In	Type	Required
feed_id	path	string	yes
keyword	path	string	yes
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" -X DELETE \
  "https://threatcluster.io/api/public/v1/feeds/{feed_id}/entities/{keyword}"

GET /keywords

List the keywords behind your personal feed · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/keywords"

POST /keywords

Track a keyword or entity on your personal feed · 1 credit per call

Request body · KeywordCreate

Field	Type	Meaning
keyword *	string
entity_type	string or null
is_custom	boolean
mssp_customer_id	integer or null

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/keywords"

DELETE /keywords/{keyword}

Stop tracking a keyword · 1 credit per call

Parameters

Name	In	Type	Required	Meaning
keyword	path	string	yes
mssp_customer_id	query	integer or null

curl -H "X-API-Key: $TC_KEY" -X DELETE \
  "https://threatcluster.io/api/public/v1/keywords/{keyword}"