REST API, a tc CLI, an agent tool surface, and SIEM-ready feeds. Anything you can do in the UI, you can do from a script or a pipeline.
Same data, four interfaces. Use the API for backend integrations, the CLI for ad-hoc and CI work, the agent tools for AI workflows, and the feeds for SIEM and TIP ingestion.
JSON-first. OAuth2 + scoped agent keys. Every cluster, entity, IOC, exposure, report and workflow operation reachable from one base URL.
# Get today's top clusters curl -H "X-API-Key: $TC_KEY" \ https://threatcluster.io/api/public/v1/clusters?limit=10
pipx install threatcluster-cli. OS keyring auth, JSON-first output. Pipe results into jq, cron a hunt query, kick off a report from CI.
# Trending clusters in the last 24h, JSON to jq tc clusters list --hours 24 --sort score \ | jq '.[] | {title, score, sources}'
The tc CLI doubles as an agent tool: point an LLM loop at it and it can search clusters, fetch entity graphs, score CVEs and generate reports. Agents authenticate with a short-lived bearer token minted from your API key.
# Mint a short-lived agent token from your API key curl -X POST https://threatcluster.io/api/auth/agent/token \ -H "X-API-Key: YOUR_API_KEY" # then let the agent call the API with the bearer token tc search "ransomware UK manufacturing" --json
RSS for reading-list ingestion. MISP feed for sharing. STIX 2.1 bundles per cluster. Webhooks for real-time delivery into Splunk, Sentinel, Elastic, OpenSearch, or any HTTP listener.
# Public RSS, no key required curl https://threatcluster.io/feed.xml # MISP manifest (public, 10 events) curl https://threatcluster.io/misp/manifest.json # MISP manifest (authenticated, 50 events) curl "https://threatcluster.io/api/misp/manifest.json?token=YOUR_FEED_TOKEN"
The free tier of the feed is public. Sign up for an account if you want personalised filtering, higher item counts, or filters by entity, sector, or threat score.
| Endpoint | Auth | What you get |
|---|---|---|
| /feed.xml | public | RSS 2.0. Latest 10 clusters with title, summary, link, score, category. |
| /rss | public | Alias for /feed.xml. |
| /misp/manifest.json | public | MISP feed manifest. Drop the base URL into any MISP instance under Sync Actions → List Feeds. |
| /misp/hashes.csv | public | Hash list for MISP enrichment. SHA-256, SHA-1, MD5. |
| /misp/{event_uuid}.json | public | Individual MISP event in MISP JSON format, TLP-marked. |
| /api/public/v1/clusters | key | Paginated cluster index with filters: sector, threat score, freshness, entity overlap. |
| /api/public/v1/clusters/{id}/stix | key | STIX 2.1 bundle for the cluster: indicators, threat-actor, malware, attack-pattern, relationships. TLP-marked. (The session-authenticated app uses /api/threats/{id}/stix for the same object; a "threat" and a "cluster" are the same record.) |
| /api/public/v1/entities/{name} | key | Full entity intelligence record: profile, frequency, related entities, recent clusters. |
| /api/public/v1/iocs/export | key | Bulk IOC export. TXT, CSV, JSON. Filter by type, confidence, time window. |
| /api/public/v1/openapi.json | public | OpenAPI 3.1 spec for the entire public surface. Generate clients for any language. |
Wire the platform into the tools you already run. No custom adapter, no middleware shim.
Webhook ingestion into HEC, or scheduled pull via REST.
Webhook to Log Analytics, or hunt-query export in KQL.
RSS, JSON pull, or hunt-query export in Lucene.
Native MISP feed. TLP-marked events, automatic sync.
STIX 2.1 bundle ingestion via the public API.
Webhook actions in workflows. Inline cluster cards.
Webhook routing into Cortex XSOAR, Tines, Torq.
Jira, ServiceNow and Linear natively; PSA tools (ConnectWise, Autotask, HaloPSA) via webhook or API. Ask about yours.
RSS, JSON, RSS-with-filter URLs for embeddable feeds.
Two credentials, for two different jobs. Create both from your account settings once you are on a paid tier.
For the REST API. Send it as an X-API-Key header. Scoped to your tier. Create and revoke keys in Settings.
For feed URLs (MISP, IOC feeds) that live in another tool's config where a header isn't possible. Passed as ?token=. Separate from the API key so you can rotate one without breaking the other.
Short-lived JWT minted from your API key via /api/auth/agent/token, for LLM/agent loops that should not hold a long-lived secret.
# Where to get one: Settings → API keys # Then call the API: curl https://threatcluster.io/api/public/v1/threats \ -H "X-API-Key: YOUR_API_KEY" # Reverse-lookup a single indicator (triage integrations) curl "https://threatcluster.io/api/iocs/lookup?value=1.2.3.4" \ -H "X-API-Key: YOUR_API_KEY"
What happens when we change the API, so you know what you are building on.
The stable API lives under /api/public/v1/. Breaking changes ship under a new version, not on top of the old one.
An endpoint that is going away is announced in advance and keeps working through a notice period before removal.
Live service status at /api/status. Point your monitoring at it.
Standard HTTP status codes with a JSON body carrying a machine-readable code and a human message. 429 on rate-limit, with a retry hint.
Most teams never hit a limit. If you're building something high-volume, get in touch and we'll scope a tier with the headroom you need.
60 requests per minute, per IP. No key required.
120 requests per minute, double the public limit. Read-only scopes: threats, IOCs, entities, vulnerabilities, feeds.
600 requests per minute. Full scopes including dark web and inventory.
600 requests per minute, scoped per managed customer. Set during onboarding.
OpenAPI spec, CLI, agent tools, and SIEM-ready feeds. Start with the public endpoints; upgrade to keyed access when you need it.