Threat intelligence API / Free threat intelligence API
Free threat intelligence API
Every ThreatCluster account, the Free plan included, can mint a read-only API key. 100 credits a day, no card, no trial clock, and the same endpoints paid plans use. Here is exactly what it returns and where the line is.
What a free key reads
Five read scopes: threats, entities, IOCs, vulnerabilities and dark web, plus the balance check. Every call below works on a free key. Costs are credits per request.
| Call | Returns | Cost |
|---|---|---|
| GET /search | Search clusters, entities and the dark web in one call | 5 |
| GET /threats | List threat clusters | 1 |
| GET /threats/{identifier} | Threat cluster detail | 1 |
| GET /threats/{identifier}/iocs | Threat cluster IOCs | 1 |
| GET /iocs/export | Bulk IOC export (txt/csv/json) | 3 |
| GET /iocs/feed | Live IOC feed for SIEM polling | 3 |
| GET /entities/search | Search entities | 1 |
| GET /entities/{entity_type}/{entity_value}/related | Related entities | 1 |
| GET /entities/{entity_type}/{entity_value}/cooccurring-cves | Co-occurring CVEs for an entity | 1 |
| GET /entities/{category}/{entity_value} | Entity detail | 1 |
| GET /entities/trending | Trending entities by type | 1 |
| GET /me | Your plan, credits left and key | 0 |
| GET /darkweb/stats | Dark-web counts + last-sync timestamp | 1 |
| GET /darkweb/ransomware/victims | List ransomware victims | 1 |
| GET /darkweb/ransomware/groups | List ransomware groups | 1 |
| GET /darkweb/ransomware/group/{group_name} | Ransomware group detail | 1 |
| GET /darkweb/ransomware/victim/{victim_id} | Victim detail | 10 |
| GET /darkweb/keyword-hits | Keyword match across ransomware victims and groups | 3 |
| GET /darkweb/ransomware/victims/facets | Victim filter facets (countries, sectors, groups) | 1 |
| GET /darkweb/trends | Dark-web trends: weekly victims, top industries, group heatmap | 3 |
| GET /vulnerabilities | List CVEs | 1 |
| GET /vulnerabilities/stats | CVE counts + severity breakdown | 1 |
| GET /vulnerabilities/{cve_id} | CVE detail | 1 |
| GET /threats/{identifier}/stix | Threat cluster as STIX 2.1 bundle | 3 |
Ask AI, saved feeds, alert rules and managed customers are on paid plans; the reference marks them.
The seven-day window
A free key reads reporting from the last seven days. Lists return 25 rows a page and records are trimmed: on a cluster you get the title, summary, score, urgency and entities, not the enhanced analysis or the sub-scores. Ask for anything older and the API answers 403 with "error": "lookback_exceeded" so a script can tell the window from a real error.
For a SOC watching what is happening now, that is the whole job. For history, correlation across months or the enhanced record, Researcher lifts the window and the trimming.
One request
Create a key in Settings, send it as X-API-Key. The newest incidents of the last day:
curl -H "X-API-Key: $TC_KEY" \ "https://threatcluster.io/api/public/v1/threats?limit=25&time_filter=24h"
Every response says what it cost and what is left today in the X-Request-Cost and X-RateLimit-Remaining headers. The top-level fields of that response:
| Field | Type | Meaning |
|---|---|---|
| threats | array | |
| count | integer or null | |
| total | integer or null | |
| limit | integer or null | |
| offset | integer or null |
Without a key at all
The public feeds need no account: the threat feed and ransomware feed as RSS, the public IOC feed as text, JSON and CSV, and the MISP feed. They list events without the record detail, which is what the key adds.
The rest of the API
Dark web API · IOC API · CVE API · Threat actor API · Full reference
Free API FAQ
Is it really free?
Yes. The Free plan has no expiry and the key does not stop working after a trial period. It spends 100 credits a day and reads the last seven days.
Do I need a card?
No. Sign up with an email or a Google account and generate the key in Settings.
Can I use it in production?
Yes, within the budget and the rate limit of 30 requests a minute. When a script needs more than 100 credits a day, a one-off credit pack covers the overage on any plan and never expires.
What does a free key not get?
Anything older than seven days, full-length records, Ask AI, saved feeds and alert rules. The API overview has the plan table.
Is there an OpenAPI document?
Yes: /api/public/v1/openapi.json, with a readable reference generated from it.
Get a key and make a request
Free account, read-only key, 100 credits a day. Upgrade when you need the history.