AT&T Threat Detection API
The Threat Detection API from AT&T — 1 operation(s) for threat detection.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/att-threat-detection-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Att Threat Detection API
termsOfService: https://www.att.com/gen/general?pid=11561
x-refined-note:
- x-generated-from differs across the merged source definitions and was not carried
- x-last-validated differs across the merged source definitions and was not carried
version: '1.0'
description: 'Operations tagged Threat Detection across 2 of this provider''s published API definitions: att-mobility-threat-anomaly-detection-api.yaml, att-network-apis.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.att.com/network/threat-detection/v1
description: AT&T Mobility Threat and Anomaly Detection API endpoint
- url: https://api.att.com/camara
description: AT&T CAMARA Network API Server
tags:
- name: Threat Detection
paths:
/threats:
post:
operationId: getDeviceThreats
summary: AT&T Get Device Threat Assessment
description: Retrieve a threat and anomaly assessment for a specific mobile device based on AT&T's machine learning network analysis. Returns threat indicators, anomaly scores, and risk levels detected for the device.
tags:
- Threat Detection
security:
- oauth2: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ThreatAssessmentRequest'
examples:
GetDeviceThreatsRequestExample:
summary: Default getDeviceThreats request
x-microcks-default: true
value:
device:
phoneNumber: '+12125551234'
responses:
'200':
description: Threat assessment retrieved
content:
application/json:
schema:
$ref: '#/components/schemas/ThreatAssessment'
examples:
GetDeviceThreats200Example:
summary: Default getDeviceThreats 200 response
x-microcks-default: true
value:
riskLevel: LOW
anomalyScore: 0.05
threats: []
assessedAt: '2026-04-19T14:30:00Z'
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorInfo'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorInfo'
'404':
description: Device not found
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorInfo'
'429':
description: Too many requests
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorInfo'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
servers:
- url: https://api.att.com/network/threat-detection/v1
description: AT&T Mobility Threat and Anomaly Detection API endpoint
/network/threat-detection/v1/threats:
post:
operationId: getThreatAssessment
summary: Get AT&T Mobility Threat Assessment
description: Retrieve ML-based threat assessment for a device including risk level, anomaly score, and detected threat types.
tags:
- Threat Detection
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/DeviceStatusRequest'
examples:
assess:
summary: Assess Device Threats
value:
phoneNumber: '+12125551234'
responses:
'200':
description: Threat assessment retrieved
content:
application/json:
schema:
$ref: '#/components/schemas/ThreatAssessment_2'
examples:
lowRisk:
summary: Low Risk Device
value:
riskLevel: LOW
anomalyScore: 0.05
threats: []
highRisk:
summary: High Risk Device
value:
riskLevel: HIGH
anomalyScore: 0.87
threats:
- UNUSUAL_LOCATION
- SIM_CLONING
'400':
description: Invalid request
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
security:
- oauth2: []
servers:
- url: https://api.att.com/camara
description: AT&T CAMARA Network API Server
components:
schemas:
ThreatAssessmentRequest:
type: object
required:
- device
properties:
device:
$ref: '#/components/schemas/Device'
Device:
type: object
properties:
phoneNumber:
type: string
description: Mobile phone number in E.164 format
example: '+12125551234'
ThreatIndicator:
type: object
properties:
type:
type: string
description: Type of threat detected
enum:
- UNUSUAL_LOCATION
- ABNORMAL_DATA_USAGE
- KNOWN_MALWARE_TRAFFIC
- SIM_CLONING
- ROAMING_ANOMALY
- CALL_PATTERN_ANOMALY
example: UNUSUAL_LOCATION
severity:
type: string
description: Severity of the threat indicator
enum:
- LOW
- MEDIUM
- HIGH
- CRITICAL
example: MEDIUM
description:
type: string
description: Human-readable description of the threat
example: Device location changed rapidly from expected home area
detectedAt:
type: string
format: date-time
description: When the threat indicator was detected
example: '2026-04-19T14:30:00Z'
ThreatAssessment:
type: object
properties:
riskLevel:
type: string
description: Overall risk level for the device
enum:
- LOW
- MEDIUM
- HIGH
- CRITICAL
example: LOW
anomalyScore:
type: number
format: double
description: Normalized anomaly score from 0.0 (normal) to 1.0 (highly anomalous)
minimum: 0.0
maximum: 1.0
example: 0.05
threats:
type: array
description: List of detected threat indicators
items:
$ref: '#/components/schemas/ThreatIndicator'
assessedAt:
type: string
format: date-time
description: Timestamp of the threat assessment
example: '2026-04-19T14:30:00Z'
ErrorInfo:
type: object
properties:
status:
type: integer
description: HTTP status code
example: 400
code:
type: string
description: Error code
example: INVALID_ARGUMENT
message:
type: string
description: Human-readable error message
example: Invalid device identifier
ThreatAssessment_2:
type: object
properties:
riskLevel:
type: string
enum:
- LOW
- MEDIUM
- HIGH
- CRITICAL
description: Overall risk level for the device
anomalyScore:
type: number
format: float
minimum: 0
maximum: 1
description: ML-generated anomaly score between 0 and 1
threats:
type: array
items:
type: string
enum:
- UNUSUAL_LOCATION
- ABNORMAL_DATA_USAGE
- KNOWN_MALWARE_TRAFFIC
- SIM_CLONING
- ROAMING_ANOMALY
- CALL_PATTERN_ANOMALY
description: List of detected threat types
DeviceStatusRequest:
type: object
required:
- phoneNumber
properties:
phoneNumber:
type: string
description: E.164 format phone number
pattern: ^\+[1-9]\d{1,14}$
ErrorResponse:
type: object
properties:
status:
type: integer
description: HTTP status code
code:
type: string
description: CAMARA error code
message:
type: string
description: Error description
securitySchemes:
oauth2:
type: oauth2
description: AT&T OAuth 2.0 for network security APIs
flows:
clientCredentials:
tokenUrl: https://api.att.com/oauth/v4/token
scopes: {}
x-refined-from:
- att-mobility-threat-anomaly-detection-api.yaml
- att-network-apis.yaml