Threat intelligence API / Reference / Managed customers

Managed customers endpoints

Per-customer scoping for teams that manage several client estates. Business. Business.

GET /mssp/customers · POST /mssp/customers · PATCH /mssp/customers/{customer_id} · POST /mssp/customers/{customer_id}/feed · PATCH /mssp/customers/{customer_id}/feed/{feed_uuid} · GET /mssp/customers/{customer_id}/feed/{feed_uuid}/keywords · PUT /mssp/customers/{customer_id}/feed/{feed_uuid}/keywords

GET /mssp/customers

List your managed customers (to discover mssp_customer_id) · 1 credit per call

List the managed customers under your account (Business plan). The `id` field is the value to pass as `mssp_customer_id` on the feeds, alerts, inventory and compliance endpoints.

Parameters

Name	In	Type
search	query	string or null
limit	query	integer
offset	query	integer

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/mssp/customers"

POST /mssp/customers

Create a managed customer (programmatic onboarding) · 1 credit per call

Create a managed customer under your account (Business plan). Managed customers are enabled per account: the number of active customers you may hold is set for your account after a short call, and a 403 with `error: managed_customers_not_enabled` or `managed_customer_limit_reached` (plus `limit` and `contact_url`) tells you when to talk to us. The returned `id` is the `mssp_customer_id` you pass to the feeds / alerts / inventory / compliance endpoints. This is the write path that lets a platform sync its client roster without manual UI setup.

Request body · MsspCustomerCreate

Field	Type	Meaning
name *	string	Customer display name (required).
domain	string or null	Primary domain, e.g. acme.com. Used for matching/branding.
contact_email	string or null	Contact address for this customer (optional).
sector	string or null	Client industry/sector. When set, the dark-web trends widgets auto-scope to it for this client (use values from /darkweb/ransomware/victims/facets).
country	string or null	Client country/region (ISO-2 or name).
notes	string or null	Free-text notes (optional).

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/mssp/customers"

PATCH /mssp/customers/{customer_id}

Update or deactivate a managed customer · 1 credit per call

Update a managed customer (name / domain / contact_email / notes) or deactivate it (`"is_active": false`) for offboarding. `customer_id` is the integer id from the customers list. Ownership is validated against your account. Send only the fields you want to change.

Parameters

Name	In	Type	Required	Meaning
customer_id	path	integer	yes

Request body · MsspCustomerUpdate

Field	Type	Meaning
name	string or null	New display name.
domain	string or null	New primary domain.
contact_email	string or null	New contact address.
sector	string or null	New sector/industry (auto-scopes trends widgets).
country	string or null	New country/region.
notes	string or null	New notes.
is_active	boolean or null	Set false to deactivate/offboard the customer (soft-delete; cascades to its scoped feeds, alert rules, webhooks and digests — deactivated, not purged). Reactiva

curl -H "X-API-Key: $TC_KEY" -X PATCH \
  "https://threatcluster.io/api/public/v1/mssp/customers/{customer_id}"

POST /mssp/customers/{customer_id}/feed

Create a monitoring feed for a customer (with keywords) · 1 credit per call

Create a monitoring feed scoped to one managed customer, seeded with keywords in a single call. Keywords cover the client's world for NEWS/CLUSTER matching — company names, brands, domains, supplier names, sector terms.

(Product/CPE inventory for the exposure overlay is a separate concern — push it via POST /api/public/v1/inventory with the same mssp_customer_id.)

Parameters

Name	In	Type	Required	Meaning
customer_id	path	integer	yes

Request body · MsspCustomerFeedCreate

Field	Type	Meaning
name *	string	Feed name (required).
keywords	array or null	Keywords to seed the feed with — company names, brands, domains, supplier names, sector terms. Matched against news clusters.
description	string or null	Optional feed description.

curl -H "X-API-Key: $TC_KEY" -X POST \
  "https://threatcluster.io/api/public/v1/mssp/customers/{customer_id}/feed"

PATCH /mssp/customers/{customer_id}/feed/{feed_uuid}

Rename / update a customer's monitoring feed · 1 credit per call

Update a customer feed's name / description. Manage its keywords via the /keywords sub-resource. `feed_uuid` is the `feed_id` returned on create.

Parameters

Name	In	Type	Required	Meaning
customer_id	path	integer	yes
feed_uuid	path	string	yes

Request body · MsspFeedUpdate

Field	Type	Meaning
name	string or null	New feed name.
description	string or null	New description.

curl -H "X-API-Key: $TC_KEY" -X PATCH \
  "https://threatcluster.io/api/public/v1/mssp/customers/{customer_id}/feed/{feed_uuid}"

GET /mssp/customers/{customer_id}/feed/{feed_uuid}/keywords

List a customer feed's keywords · 1 credit per call

List the keywords currently on a customer feed.

Parameters

Name	In	Type	Required	Meaning
customer_id	path	integer	yes
feed_uuid	path	string	yes

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/mssp/customers/{customer_id}/feed/{feed_uuid}/keywords"

PUT /mssp/customers/{customer_id}/feed/{feed_uuid}/keywords

Set a customer feed's keywords (declarative sync) · 1 credit per call

Declaratively set a feed's keywords to EXACTLY the provided set — adds new ones, removes any not listed. This is the "re-sync when the client's world changes" endpoint (new supplier added, product retired). Send the full desired list each time; the diff is computed server-side.

Parameters

Name	In	Type	Required	Meaning
customer_id	path	integer	yes
feed_uuid	path	string	yes

Request body · MsspFeedKeywords

Field	Type	Meaning
keywords *	array of string	The complete desired keyword set for this feed. Missing keywords are removed; new ones are added.

curl -H "X-API-Key: $TC_KEY" -X PUT \
  "https://threatcluster.io/api/public/v1/mssp/customers/{customer_id}/feed/{feed_uuid}/keywords"