Getting started

Your first API call

Query file hashes, IP addresses, domains, URLs, CVEs, emails and phone numbers over a token-authenticated REST API. Everything is a GET request, everything returns JSON, and indicators we have not seen yet are fetched live on request.

3Steps to first call
18Endpoints
JSONResponses
STEP 1

Get a key

Create an account to generate a key. Treat it like a password — it carries your plan's quota and it is the only credential the API needs.

Sign in to get a key
STEP 2

Authenticate

Send the key in the Authorization header on every request.

Header
Authorization: Token <your-api-key>
Base URLhttps://api.threatfusionai.com
MethodGET on every endpoint
Cost1 credit per request
STEP 3

Make a call

Every lookup takes a query parameter. This one asks what we know about a domain.

Request
curl -H "Authorization: Token $TFA_TOKEN" \
           "https://api.threatfusionai.com/domain-lookup/?query=google.com"
Response
{
        "value": "google.com",
        "indicator_type": "domain",
        "score": { "value": 5 },
        "detections": {
          "flagged": 1,
          "total_engines": 91,
          "risk": "Low"
        },
        "categories": [ "Information Technology", "AI/ML Applications" ],
        "corr": { "ips": [ "74.125.69.102", "…" ] }
      }

What you can query

Seven indicator types, one consistent response shape.

IndicatorEndpoint
File hash/hash-lookup/
IP address/ip/ · /ip-lookup/ · /ip-geo/
Domain/domain-lookup/ · /domain/
URL/url-lookup/ · /url/
CVE/cve/ · /cves-data/
Email/email-lookup/
Phone/phone-lookup/
Any indicator/ioc-crossref/ · /mitre-attribution/

Response codes

200Record returned
202Queued for a live fetch — retry, or add ?wait=N to block
400Missing or malformed parameter
401Missing or invalid token
404Our sources have no record of it
429Daily credit limit reached

Ready for the full reference?

Every endpoint, every parameter, and a real captured response for each one.

Open the API reference