API Reference
All endpoints accept JSON and return JSON. Auth is a bearer token in the Authorization header. Base URL: https://api.threatmap.io
Credit costs: Most calls = 1 credit ($0.01). Scan = 5 credits. Detonate = 25 credits. Commercial-feed calls = 2 credits (or 0 if BYOK). Failed calls = 0 credits.
Aggregation & Enrichment
POST /v1/ioc — 1 credit
Enrich an IP, domain, URL, hash (MD5/SHA1/SHA256), or email address across every source.
curl https://api.threatmap.io/v1/ioc -H "Authorization: Bearer $KEY" -d value="8.8.8.8" -d sources="abuseipdb,greynoise,otx"
| Parameter | Type | Required | Description |
|---|---|---|---|
value | string | Yes | The IOC value to enrich |
sources | string | No | Comma-separated filter (default: all) |
Supports batch mode — pass up to 100 values per call (100 credits).
POST /v1/cve — 1 credit
Get CVSS + EPSS + CISA KEV + exploitation evidence for any CVE.
curl https://api.threatmap.io/v1/cve -H "Authorization: Bearer $KEY" -d id="CVE-2024-3094"
Supports batch mode — up to 100 CVEs per call.
POST /v1/actor — 1 credit
Threat-actor profile with MITRE ATT&CK technique mapping, campaigns, known IOCs.
curl https://api.threatmap.io/v1/actor -H "Authorization: Bearer $KEY" -d name="APT29"
GET /v1/profiles/:type/:id — 1 credit
Curated writeup for actors, malware families, or vulnerabilities. Type: actors, malware, vulns.
POST /v1/feed — 1 credit
Pull the latest IOCs from a named feed. Output: JSON, STIX 2.1, or CSV.
curl https://api.threatmap.io/v1/feed -H "Authorization: Bearer $KEY" -d name="abuse-ch-feodo" -d since="24h"
POST /v1/detonate — 25 credits
Submit a file or URL for multi-sandbox reputation (VT, Joe Sandbox, Hybrid Analysis, ANY.RUN).
curl https://api.threatmap.io/v1/detonate -H "Authorization: Bearer $KEY" -F file=@suspicious.exe
Pivots
POST /v1/dns — 1 credit
Passive DNS history (aggregated across Farsight, VT, SecurityTrails).
curl https://api.threatmap.io/v1/dns -H "Authorization: Bearer $KEY" -d domain="example.com" -d type="A"
POST /v1/certificates — 1 credit
SSL certificate search + reverse pivot (find all domains sharing a cert).
# Pivot by fingerprint to find sibling domains curl https://api.threatmap.io/v1/certificates -H "Authorization: Bearer $KEY" -d fingerprint="ab:cd:ef:..."
POST /v1/whois — 1 credit
Historical WHOIS records.
POST /v1/trackers — 1 credit
Web component fingerprints (Google Analytics ID, Tag Manager, JS libs). Reverse pivot: tracker → all sites.
POST /v1/host-pairs — 1 credit
Referer / redirect / link relationships between hosts.
POST /v1/graph — 1 credit per hop
Traverse the cross-source relationship graph: IP → ASN → certificate → campaign → actor.
curl https://api.threatmap.io/v1/graph -H "Authorization: Bearer $KEY" -d start="203.0.113.50" -d hops=3
Detection & Scanning
POST /v1/scan — 5 credits per /24
Banner-read scan of an IP, range, or domain. External observation only.
curl https://api.threatmap.io/v1/scan -H "Authorization: Bearer $KEY" -d target="203.0.113.0/24" -d ports="top-1000"
POST /v1/asm/* — included in Teams/Enterprise
Continuous EASM agent registration + delta alerts.
POST /v1/detect — 5 credits per 1K events
Evaluate detection rules against a batch of events (JSON or OCSF).
curl https://api.threatmap.io/v1/detect -H "Authorization: Bearer $KEY" -d rule_id="c2-beaconing" -d events=@events.json
GET /v1/rules — 1 credit per 100 results
Search the community rule library (3,000+ rules).
POST /v1/convert — 1 credit
Convert a rule to Splunk SPL, KQL, Lucene, JSON, or ECS.
AI Layer (Teams+)
| Endpoint | Credits | Description |
|---|---|---|
POST /v1/ai/threat-hunter/run | 5 | Agentic hunt across registered assets |
POST /v1/ai/triage/:alert_id | 1 | LLM triage summary for an alert |
POST /v1/ai/remediation/:finding_id | 2 | AI-generated remediation (Terraform, CLI) |
POST /v1/ai/detection-rules/generate | 3 | AI-authored detection rules |
GET /v1/ai/briefings/daily | 1 | Tailored daily briefing |
GET /v1/ai/exposure-score/:asset_id | 1 | Predictive exposure score |
Collaboration & Monitoring
POST /v1/projects — 1 credit (lifecycle ops)
Collaborative investigation workbench. Create, update, share Projects.
POST /v1/monitors — 1 credit (lifecycle ops)
Saved queries that push webhook/email/Slack alerts when something changes.
curl https://api.threatmap.io/v1/monitors -H "Authorization: Bearer $KEY" -d type="dns_change" -d domain="suspicious.example" -d webhook="https://hooks.slack.com/..."
Account & Billing
POST /v1/account/byok — free
Register a provider API key for 0-credit routing.
GET /v1/account/credits — free
Current credit balance + usage history.
Response format
Every response follows the unified ThreatMap schema:
{
"query": {
"value": "8.8.8.8",
"type": "ipv4",
"requested_at": "2026-07-28T12:00:00Z"
},
"threatmap_score": 12,
"threatmap_verdict": "clean",
"sources": { "abuseipdb": {...}, "greynoise": {...} },
"enrichment": { "asn": {...}, "location": {...}, "first_seen": "..." },
"metadata": {
"cache_hit": true,
"cache_age_seconds": 142,
"providers_queried": 8,
"providers_succeeded": 7,
"latency_ms": 340,
"credits_used": 1
}
}Errors (RFC 7807)
All errors follow RFC 7807 Problem Details:
{
"type": "https://docs.threatmap.io/errors/insufficient-credits",
"title": "Insufficient credits",
"status": 402,
"detail": "Credit balance exhausted. Current balance: 0.",
"instance": "/v1/ioc",
"threatmap_error_code": "INSUFFICIENT_CREDITS",
"request_id": "req_abc123"
}