Yes. Every account, Free included, can mint a read-only key for threats, IOCs, entities, vulnerabilities and dark web. Free keys spend 100 credits a day (search 5, exports and other bulk pulls 3, dark-web enrichment 10, everything else 1), read the last seven days and get trimmed records. Paid plans remove the window and the trimming and move to per-minute limits.

Threat intelligence API

Q: What does a free key not get?

Anything older than seven days. On a cluster, the enhanced summary, sub-scores, severity reasoning and article text. On an entity, the recent-events history. The feeds and alert scopes. Secondary lists are cut to ten rows.

Incidents, CVEs, threat actors, IOCs and leak-site victims over REST. Every account gets a key. Free is 100 credits a day, no card.

OpenAPI reference

Quick start

Create a key

Settings, then API & Feeds, then Generate API key. Scopes come from your plan: a free key gets the five read scopes. The key is shown once, so copy it into your environment. New here? Get started walks the first call in your own stack.
```
export TC_KEY=tc_live_...
```

Make a call

Send the key as X-API-Key. Base URL https://threatcluster.io/api/public/v1. No OAuth, nothing to install.

curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/search?q=lockbit"

Search answers in three buckets. Every response says what the call cost, and keys with a daily budget also get what is left and when it resets.

HTTP/1.1 200
X-Request-Cost: 5
X-RateLimit-Remaining: 95

{
  "query": "lockbit",
  "total": 14,
  "clusters": [ { "cluster_id": "…", "ai_title": "…", "threat_score": 78.5, "urgency_level": "high" } ],
  "entities": [ { "entity_type": "ransomware_group", "entity_value": "LockBit", "cluster_count": 212 } ],
  "darkweb":  [ { "type": "victim", "name": "…", "date": "2026-09-01" } ],
  "tier": "free", "lookback_days": 7
}

Pick the endpoint for the job

A cluster id from search goes straight into the detail, IOC and STIX endpoints. The rest of the surface is below.

Try it

The same request, sent from this page. Signed in, it runs on your own key and budget across every GET endpoint in the spec. Not signed in, a demo key covers the threats endpoints. The snippets use $THREATCLUSTER_API_KEY; your key is never put in a URL or in this browser's storage. For a guided first call in your own stack, curl, Python, Node, an MCP client, an editor, a SIEM or the CLI, use Get started.

What to call

70+ endpoints, every one in the reference. A free key reads the first five groups; feeds, alerts, webhooks and Ask AI need Researcher; company monitoring needs Analyst. Every account-state endpoint has list, update, delete and test, so a SIEM or SOAR can run its monitoring end to end without the web UI. Costs are in credits.

You want	Call	Cost
Everything about a name	GET /search?q=	5
What is trending now	GET /threats?time_filter=24h	1
One incident, its IOCs, as STIX	GET /threats/{id} · /iocs · /stix	1 · 1 · 3
A blocklist for the firewall or SIEM	GET /iocs/feed · /iocs/export	3
An actor, malware family, vendor or CVE	GET /entities/{type}/{value}	1
Exploited CVEs, by vendor or severity	GET /vulnerabilities	1
Who a ransomware group hit	GET /darkweb/ransomware/victims	1
A victim record with screenshots	GET /darkweb/ransomware/victim/{id}	10
A cited answer about one incident	POST /threats/{id}/ask	25
A cited answer across the whole corpus	POST /ask	50
How many credits you have left	GET /me	0
A feed built from your stack, typed	POST /feeds · /feeds/{id}/entities	1, Starter and up
Only what is new since your last poll	GET /threats?since= · /feed?since=	1
A rule that fires when your vendors are named	/alert-rules · /cve-alerts · /webhooks	1, Starter and up
What fired, and a dry run before it does	GET /alerts?since= · POST /alert-rules/{id}/test	1
Your domains and suppliers on the leak sites	/monitoring/company · /monitoring/company/threats	1 · 3, Analyst and up
The attack flow behind an incident or CVE	GET /threats/{id}/attack-flow · /vulnerabilities/{cve}/attack-flow	3, Starter and up
A countermeasure, an exploit, an entity's profile	GET /d3fend/{id} · /vulnerabilities/{cve}/exploits · /entities/{type}/{value}/summary	1
Managed customers and per-client feeds	/mssp/customers	1, Business

Ask AI answers are grounded in the cluster's own reporting and carry inline citation tags that map to the returned sources; a failed model call refunds the credits. GET /me returns your tier, credits used and left today, pack balance and the reset time, and costs nothing. A request that finds nothing costs nothing either: empty searches and 404 lookups refund their credits. Credits do not unlock scopes. A free key calling /feeds gets 403 insufficient_scope, however many credits it has.

By data

One page per data set, each with its endpoints, a request and what a free key gets:

Free threat intelligence API: what the free key reads, and where the seven-day line is
Dark web API: ransomware leak-site listings from ThreatCluster's own collection
IOC API: validated indicators per incident or as a feed, in JSON, CSV and STIX
CVE API: EPSS, KEV and exploitation reporting in one record
Threat actor API: APT groups, ransomware operators and malware profiles
API reference: every endpoint, generated from the OpenAPI document

Credits and limits

Plan	Budget	Rate	History	Records
Free	100 credits a day	30 a minute	Last 7 days	Trimmed, 25-row lists
Researcher	1,000 credits a day	120 a minute	All	Full, plus feeds and alerts
Business	No daily budget	600 a minute	All	Full, plus managed-customer scopes

Past the daily budget, one-off credit packs cover the overage on any plan: $10 for 2,000 credits, $50 for 12,000. They never expire and are spent only after the day's allowance. Packs and per-request costs.

What a free key leaves out

Anything older than seven days: a request for it returns 403 with "error": "lookback_exceeded". On a cluster, the enhanced summary, sub-scores, severity reasoning and article text. On an entity, the recent-events history. Secondary lists stop at ten rows. Free responses say so: "tier": "free", "lookback_days": 7.

Keys and upgrades

One personal key per account, and it does not expire. Generating a new one revokes the old. Scopes are fixed when the key is created, so after an upgrade generate a new key to pick up the feeds, alerts or managed-customer scopes. Need least privilege for an agent or a CI job? Agent keys under CLI and agents let you pick scopes and mint short-lived bearer tokens.

Formats

JSON on every endpoint. Also:

STIX 2.1 per cluster: report, indicators and inferred relationships, TLP-marked, for OpenCTI or any STIX-aware TIP
Text and CSV on the IOC endpoints, for a blocklist or a SIEM lookup table with no parsing
MISP and RSS on the public feeds, no key needed
Markdown of any cluster or entity page: append .md to its URL, for LLM context

Errors

Status	Meaning	Do
401	Missing or bad key	Check the X-API-Key header
403	Scope or window: the body names which	Mint a key with the scope, or upgrade for history
429	Over budget or rate	Wait for Retry-After; buy a pack if it is daily

/v1 does not change shape. Breaking changes go to /v2.

Clients and integrations

The Cyber-Threat-Intelligence-API repository has a daily snapshot of the OpenAPI document, a small Python client with retries and paging, and runnable examples in curl, Python and Node.

# Python, using the client from the repo
from tc_api import ThreatCluster
tc = ThreatCluster()                                # reads TC_KEY
for t in tc.threats(time_filter="24h", limit=10):
    print(t["threat_score"], t["ai_title"])

The tc command line wraps the same API with keyring auth and JSON output, and an agent can call it as a tool. The MCP server (npx -y threatcluster-mcp) puts the same API into Claude Desktop, Claude Code, Cursor and VS Code as ten tools. Step-by-step guides for Splunk, Sentinel, Elastic, Claude, OpenAI, Cursor and the terminal are under Integrations. Postman, Insomnia and any OpenAPI generator import the spec directly.

API on GitHub Integration guides

API FAQ

Is the API free?

Yes. Every account, Free included, can mint a read-only key for threats, IOCs, entities, vulnerabilities and dark web. Free keys spend 100 credits a day, read the last seven days and get trimmed records. Paid plans remove the window and the trimming and raise the budget.

How do I authenticate?

Create a key in Settings and send it as an X-API-Key header. Keys carry scopes. Each endpoint declares the scope it needs and returns 403 with the scope name if the key does not have it.

Is there an OpenAPI specification?

Yes, at /api/public/v1/openapi.json, with Swagger UI and ReDoc views, and a public Postman collection you can fork with the Run in Postman button above. A daily snapshot and client examples are in the Cyber-Threat-Intelligence-API repository.

How fresh is it?

Clusters form within minutes of the first credible report and indicators are validated on ingest, so time_filter=1h is usable. The dark web endpoints update as the leak sites post.

Why not scrape the site instead?

The pages render the same records as /threats and /entities, wrapped in markup that changes whenever the site does, with scores drawn as bars and no STIX. The API is the one that is versioned.

Can I redistribute the data?

The public feeds are TLP:CLEAR and can be redistributed with attribution. Keyed API responses are for your own tooling and internal use. Embedding them in a product you sell needs a Business agreement. Talk to us.

Get a key and make a request

Free account, read-only key, 100 credits a day. Upgrade when you need the history.