API reference

Use https://threatmap.co/api/v1 with a Bearer API key./v1/* is a rewrite alias. JSON POST requests requireContent-Type: application/json. Account verification, scope, plan, credits, and provider configuration apply.

Enrichment and intelligence

  • POST /api/v1/ioc (alias /v1/ioc): JSON value, for example {"value":"8.8.8.8"}. One IOC only, up to 2,048 characters; no arrays or comma-separated lists.
  • POST /cve: JSON id, for example {"id":"CVE-2024-3094"}.
  • POST /actor: name, id, or query.
  • GET /profiles: type (actors, malware, vulns), q, tactic, product, limit, and offset. GET /profiles/{type}/{id} returns detail.
  • POST /feed: feed or name; limit defaults to 50 and is bounded to 1–500.

Relationships and pivots

POST /graph takes start and optional hops (1–5, default 3). It returns query, graph nodes/edges, and metadata. The portal can derive a graph from existing lookup sources. Standalone provider traversal reserves the hop count; derived execution has no base graph reservation.

Infrastructure routes include /dns, /certificates,/whois, /trackers, /host-pairs, and/pivots. Inputs differ by pivot; MCP discovery exposes schemas for DNS and certificate tools. Do not assume every pivot accepts identical fields.

Rules, detection, and scanning

  • GET/POST /rules: q/query, format, page, and limit.
  • POST /convert: rule or rule_id, source/from, target/to.
  • POST /detect: events with a supported rule/rule_id.
  • POST /yara/scan: supported YARA scan input; use the tool schema.
  • POST /scan: target, value, or ip; requires enabled scanning/provider configuration.
  • POST /detonate: url, hash, or value. Arbitrary multipart file upload is not supported.

Account resources and MCP

Projects and monitors have authenticated collection/item APIs. Portal APIs support UI operations. Manual portal monitor checks return 202 with a run ID; evaluation completes asynchronously. Settings password changes require a browser session, CSRF, current password, and valid replacement password.

/api/mcp accepts JSON-RPC POST. Initialize/ping may be public; tool discovery and execution require authorization. GET returns metadata, not an SSE subscription. See both MCP configurations.

Response and error interpretation

Responses are endpoint-specific. IOC responses include query, sources, enrichment, and metadata. Inspect failed/skipped providers and credits_used; a partial response does not mean every provider succeeded. Structured error paths use Problem Details. 401 indicates credentials, 403 authorization or verification, 402 exhausted credits, and 429 rate limits.

AI, ASM/posture, tenant provisioning/branding, and batch IOC/CVE APIs are not part of the implemented interface. Account export/deletion acknowledgement routes do not perform a complete export or persisted deletion.