Threat intelligence API / IOC API
IOC API
Indicators of compromise extracted from the reporting behind each incident, validated before they are stored, and served per incident or as a rolling feed. JSON for code, text and CSV for a blocklist, STIX 2.1 for a TIP.
Why the list is short
Extraction from prose produces junk: documentation hostnames, example IPs, vendor domains quoted in an advisory. ThreatCluster runs every candidate through a validator and an anti-join against a list of known false positives before it is stored, and applies the same guard on every export path, including the public feed. A quiet feed you can block on is the point.
Each indicator keeps its provenance: the incident it came from, the articles that mention it, and when it was first and last seen.
Endpoints
| Call | Returns | Cost |
|---|---|---|
| GET /threats/{identifier}/iocs | Threat cluster IOCs | 1 |
| GET /iocs/export | Bulk IOC export (txt/csv/json) | 3 |
| GET /iocs/feed | Live IOC feed for SIEM polling | 3 |
| GET /threats/{identifier}/stix | Threat cluster as STIX 2.1 bundle | 3 |
One request
The rolling feed of the last seven days, for a firewall or a SIEM lookup table:
curl -H "X-API-Key: $TC_KEY" \ "https://threatcluster.io/api/public/v1/iocs/feed"
Per incident, GET /threats/{id}/iocs returns the indicators for one cluster and GET /threats/{id}/stix the same as a STIX 2.1 bundle with the report, indicators and inferred relationships, TLP-marked.
Formats and the free feed
JSON on every endpoint; text and CSV on the IOC endpoints with no parsing needed; STIX 2.1 per incident. The format matrix shows which tools take which. The public IOC feed publishes the last 30 days of high-confidence domains, IPs and hashes with no key at all, refreshed hourly, and the Public-Feeds-IOCs repository mirrors it.
The rest of the API
Free threat intelligence API · Dark web API · CVE API · Threat actor API · Full reference
IOC API FAQ
What indicator types are included?
Domains, IPv4 and IPv6 addresses, URLs, and MD5, SHA-1 and SHA-256 hashes. Email addresses and CVE ids are entities, not IOCs, and come from the entity endpoints.
How are false positives handled?
A validator rejects malformed and reserved values, a maintained false-positive list is applied as an anti-join on ingest, and the same guard runs on every export. Report a bad indicator from its incident page and it is removed from all paths.
Can I get STIX or MISP?
STIX 2.1 per incident from the API. The MISP feed is one of the public feeds and needs no key.
How far back does it go?
A free key reads the last seven days. Researcher reads the full history, which is what a retro-hunt needs.
Can I redistribute the indicators?
The public feed is TLP:CLEAR with attribution. Keyed responses are for your own tooling.
Get a key and make a request
Free account, read-only key, 100 credits a day. Upgrade when you need the history.