Threat intelligence API / Reference / Feeds

Feeds endpoints

Saved feeds built from a sentence. Researcher and up. Researcher and up.

GET /feeds · POST /feeds · GET /feeds/{feed_id}/entities · GET /feed

GET /feeds

List your custom feeds · 1 credit per call

List your custom feeds in the requested slice (defaults to personal).

Pass `?mssp_customer_id=N` to scope the read to a specific managed customer.

Parameters

Name	In	Type	Required	Meaning
mssp_customer_id	query	integer or null

Response 200 · FeedsListResponse

Field	Type	Meaning
feeds *	array of FeedSummary
count *	integer

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/feeds"

POST /feeds

Create a custom feed on your account · 1 credit per call

Create a personal custom feed seeded with keywords. Returns the feed_id you read back via GET /feeds. (For a managed customer: use /mssp/customers/{id}/feed.)

Request body · FeedCreate

Field	Type	Meaning
name *	string	Feed name (required).
keywords	array or null	Keywords to seed the feed — vendors, products, actors, sectors. Matched against news clusters.
description	string or null	Optional feed description.

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/feeds"

GET /feeds/{feed_id}/entities

Entities tracked by a feed · 1 credit per call

Get entities tracked in a custom feed.

Pass `?mssp_customer_id=N` to read a customer-scoped feed (default: personal).

Parameters

Name	In	Type	Required	Meaning
feed_id	path	string	yes
mssp_customer_id	query	integer or null

Response 200 · FeedEntitiesResponse

Field	Type	Meaning
feed_id *	string
entities *	array of FeedEntity
count *	integer

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/feeds/{feed_id}/entities"

GET /feed

Threats matching your feed filters · 1 credit per call

Query the threat feed with full filtering.

Query parameters

limit: Max results (default: 50, max: 100)
offset: Pagination offset (default: 0)
time_filter: 1h, 24h, 7d, 30d (default: 7d)
sort_by: trending, latest, popular, threat_score (default: trending)
content_type: all, threats, articles (default: all)
feed_type: trending, popular, latest, my_feed, custom (default: trending)
feed_id: UUID of custom feed (required when feed_type=custom)
keyword: Optional keyword filter
urgency: "hot" for high-velocity only (optional)

Use feed_type=my_feed to query your personal keyword feed. Use feed_type=custom with feed_id to query a specific custom feed.

Parameters

Name	In	Type
limit	query	integer
offset	query	integer
time_filter	query	string
sort_by	query	string
content_type	query	string
feed_type	query	string
feed_id	query	string
keyword	query	string
urgency	query	string
mssp_customer_id	query	integer or null

Response 200 · FeedResponse

Field	Type	Meaning
items *	array of ThreatListItem
count	integer or null
total	integer or null
limit	integer or null
offset	integer or null
time_filter	string or null
sort_by	string or null
content_type	string or null
feed_type	string or null

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/feed"