GET /iocs/export
Bulk IOC export (txt/csv/json) · 3 credits per call
Export all IOCs across clusters, with confidence filtering.
Query parameters
- types: IOC types to include (ip, domain, hash, email, all) - default: all
- format: Output format (txt, csv, json) - default: txt
- confidence: Filter level - "all", "high", "medium", "low", "confirmed" (excludes false positives), "false_positive" - default: confirmed
- hours: Time window in hours (default 720 = 30 days)
Returns IOCs in requested format.
Parameters
| Name | In | Type | Required | Meaning |
|---|
| types | query | string | | |
| format | query | string | | |
| confidence | query | string | | |
| hours | query | integer | | |
curl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/iocs/export"
GET /iocs/feed
Live IOC feed for SIEM polling · 3 credits per call
Live IOC feed for automated polling by SIEMs, firewalls, and TIPs.
Returns data inline (no download) with caching headers for efficient polling.
Query parameters
- types: IOC types (all, ip, domain, hash, email) - default: all
- format: txt, csv, json, stix - default: txt
- confidence: confirmed, high, medium, low, false_positive, all - default: confirmed
- hours: Time window in hours (default 720 = 30 days)
- enrich: (json only) attach the clusters + sources each IOC was seen in (up to 5 each)
- threat_score: (requires enrich) include each cluster's threat-score breakdown
- related_entities: (requires enrich) attach co-occurring attribution entities per IOC
Parameters
| Name | In | Type | Required | Meaning |
|---|
| types | query | string | | |
| format | query | string | | |
| confidence | query | string | | |
| hours | query | integer | | |
| enrich | query | boolean | | |
| threat_score | query | boolean | | |
| related_entities | query | boolean | | |
curl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/iocs/feed"