Threat intelligence API / integrations

VS Code

Query the ThreatCluster threat-intelligence API from a .http file inside VS Code using the REST Client extension, with the key kept out of the file. Thunder Client works as a point-and-click alternative.

Prerequisites

1. A free API key. Sign in and mint one under Settings → API. Free keys carry 100 credits a day, 30 requests a minute and a 7-day data window.
2. Every request sends the key in the X-API-Key header.
3. Base URL: https://threatcluster.io/api/public/v1
4. VS Code with the REST Client extension (humao.rest-client).

Setup

1. Install the extension: open the Extensions view and search for "REST Client" by Huachao Mao, or run:

   code --install-extension humao.rest-client

2. Put the key in VS Code settings so it never lands in the request file. In settings.json:

   "rest-client.environmentVariables": {
     "threatcluster": {
       "tcKey": "tc_live_your_key_here"
     }
   }

   Then activate it: press Ctrl+Alt+E (Cmd+Alt+E on macOS), or F1 and "Rest Client: Switch Environment", and pick threatcluster. The active environment shows in the status bar.

3. Create a file named threatcluster.http and paste:

   @baseUrl = https://threatcluster.io/api/public/v1
   
   ### Search clusters, entities and the dark web (5 credits)
   GET {{baseUrl}}/search?q=fortigate
   X-API-Key: {{tcKey}}
   
   ### Threat clusters from the last 24 hours (1 credit)
   GET {{baseUrl}}/threats?time_filter=24h&limit=5
   X-API-Key: {{tcKey}}
   
   ### IOC feed with confidence and reasons (3 credits)
   GET {{baseUrl}}/iocs/feed?format=json&types=domain
   X-API-Key: {{tcKey}}

4. Click the Send Request link that appears above each request, or press Ctrl+Alt+R (Cmd+Alt+R on macOS). The response opens in a split pane with the status line, the headers (including X-Request-Cost and X-RateLimit-Remaining) and the body.

Prefer a file-based secret? Put TC_KEY=tc_live_your_key_here in a .env file next to the .http file and write {{$dotenv TC_KEY}} in place of {{tcKey}}; {{$processEnv TC_KEY}} reads a machine environment variable instead. Keep .env in .gitignore.

Thunder Client alternative

Thunder Client (rangav.vscode-thunder-client) gives the same requests a UI. Install it, open its sidebar icon and create a New Request with the URL https://threatcluster.io/api/public/v1/search?q=fortigate. Add X-API-Key under the Headers tab. To keep the key out of saved requests, create an environment under the Env tab, add a tcKey variable there and reference it as {{tcKey}} in the header value; a local environment keeps secrets out of anything you commit.

Worked example

The first request in the file, with each bucket trimmed to 1 hit (the live call returned 19):

GET {{baseUrl}}/search?q=fortigate
X-API-Key: {{tcKey}}

{
  "query": "fortigate",
  "clusters": [
    {
      "short_id": "b4c3b813",
      "cluster_id": "d210e6b1-58d9-40aa-8d82-8b7eb4c3b813",
      "slug": "hackers-breached-a-small-polish-energy-plant-via-private-apn-b4c3b813",
      "ai_title": "Cyberattack on Polish Energy Sector Exploits Private APN Vulnerability",
      "ai_summary": "In December 2025, hackers breached a Polish combined heat and power (CHP) plant using a private Access Point Name (APN) to access the operational tec…",
      "urgency_level": "medium",
      "keywords": ["hackers", "private"],
      "threat_score": 77.0,
      "severity_score": 80.0,
      "article_count": 8,
      "date_range_latest": "2026-08-10T23:07:21+00:00",
      "is_new": false,
      "is_trending": false,
      "entities": {}
    }
  ],
  "entities": [
    {
      "entity_type": "platform",
      "entity_value": "Fortigate",
      "cluster_count": 35,
      "article_count": 71
    }
  ],
  "darkweb": [],
  "limit": 10,
  "total": 19
}

Chain the short_id into a follow-up request: GET {{baseUrl}}/threats/b4c3b813.

Costs and limits

Endpoint reference: /api/public/v1/docs. Bigger windows and budgets: /pricing.