Intelligence API

Intelligence API

Query indicators and risk context, submit reviewed contributions, and withdraw incorrect intelligence.

Intelligence reads preserve provenance and evaluation time. Sharing requires reviewed, non-sensitive contribution data.

Use the shared API contract for authentication, pagination, request headers, idempotency, and error responses.

List indicators

GET/organizations/{organization_id}/indicators
Scope
intelligence:read
Auth
Bearer API key

Returns indicator ID, type, value, confidence, source version, validity, and withdrawal status. Standard limit and cursor apply. Unknown filters return 422.

Query parameters
typestringoptional

Indicator type.

one ofip, domain, url, sha256
valuestringoptional

Exact normalized indicator value.

sourcestringoptional

Source identifier.

activebooleanoptional

Whether to return valid indicators. true selects valid, nonwithdrawn indicators; false selects expired, withdrawn, or future-dated indicators. Omission includes both.

200Result

Returns a data array and pagination.next_cursor. Entries include stable IDs and the resource fields described for this collection.

Read indicator context

GET/organizations/{organization_id}/indicators/{indicator_id}
Scope
intelligence:read
Auth
Bearer API key

Returns provenance, first/last observation, campaign references, validity, and linked visible detections. Attribution might change in later source versions.

200Result

Returns data and request_id.

Read asset risk

GET/organizations/{organization_id}/assets/{asset_id}/risk
Scope
assets:read
Auth
Bearer API key

Returns current band, calculation time, contributing findings and exposure, and missing coverage. Unknown is distinct from low risk.

200Result

Returns data and request_id.

Submit an indicator

POST/organizations/{organization_id}/indicator-submissions
Scope
intelligence:write
Auth
Bearer API key

Submits an indicator for review. Requires the intelligence contribution grant and enabled sharing participation. Raw artifacts and personal data are not accepted.

Request body
typestringrequired

Indicator category.

one ofip, domain, url, sha256
valuestringrequired

Valid address, DNS name, HTTPS URL, or 64-character SHA-256 hex digest for the selected type.

confidencestringrequired

Proposed confidence for reviewer evaluation.

one oflow, medium, high
expires_attimestamprequired

Future validity end.

provenancestringrequired

Non-sensitive supporting context.

rule1–2000 characters
201Created

Returns submission ID and pending review state. It does not distribute the indicator immediately.

Request withdrawal

POST/organizations/{organization_id}/indicator-submissions/{submission_id}/withdraw
Scope
intelligence:write
Auth
Bearer API key

Requests withdrawal of a contribution. Requires If-Match and authority over the contribution. Historical detections and previously exported copies remain.

Request body
reasonstringrequired

Audited justification. Empty values are invalid.

rule1–2000 characters
202Accepted

Returns the submission and review operation. Check source-version adoption before concluding enforcement ended.