Threat intelligence API / Reference / Stats

Stats endpoints

Corpus counts and status.

GET /stats/overview · GET /stats/entities/timeline

GET /stats/overview

Global counts + 24h deltas · 1 credit per call

Get threat database statistics.

Returns total clusters, articles, average threat score, and last update time.

Response 200 · StatsOverviewResponse

FieldTypeMeaning
total_clusters *integer
total_articles *integer
total_entities *integer
clusters_24h *integer
articles_24h *integer
curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/stats/overview"

GET /stats/entities/timeline

Entity timeline (daily counts) · 1 credit per call

Get timeline data for top entities of a specific type.

Query parameters

  • entity_type: Type of entity (malware, apt_group, ransomware_group, etc.)
  • days: Number of days to include (default: 7, max: 30)
  • limit: Number of top entities to track (default: 5, max: 10)

Returns daily mention counts for top entities.

Parameters

NameInTypeRequiredMeaning
entity_typequerystring
daysqueryinteger
limitqueryinteger

Response 200 · EntityTimelineResponse

FieldTypeMeaning
entity_type *string
days *integer
timeline *Shape TBD: dict of entity_value → daily counts
curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/stats/entities/timeline"