find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/att-threat-subscriptions-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: AT&T Mobility Threat and Anomaly Detection Threat Subscriptions API
  description: Uses machine learning to identify threats and unusual activity on mobile devices on the AT&T network. Provides real-time threat detection signals to applications for enhanced security, fraud prevention, and anomaly detection across subscriber devices. Part of the AT&T Network API Accelerator Program.
  version: '1.0'
  contact:
    url: https://devex-web.att.com/developer-hub/docs/network-api-accelerator-program
  termsOfService: https://www.att.com/gen/general?pid=11561
  x-generated-from: documentation
  x-last-validated: '2026-04-19'
servers:
- url: https://api.att.com/network/threat-detection/v1
  description: AT&T Mobility Threat and Anomaly Detection API endpoint
tags:
- name: Threat Subscriptions
paths:
  /threats/subscribe:
    post:
      operationId: subscribeToThreatAlerts
      summary: AT&T Subscribe to Threat Alerts
      description: Subscribe to real-time threat and anomaly detection alerts for a device or set of devices. Notifications are delivered to the specified webhook URL when threat conditions are detected.
      tags:
      - Threat Subscriptions
      security:
      - oauth2: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ThreatSubscriptionRequest'
            examples:
              SubscribeToThreatAlertsRequestExample:
                summary: Default subscribeToThreatAlerts request
                x-microcks-default: true
                value:
                  device:
                    phoneNumber: '+12125551234'
                  notificationUrl: https://webhook.example.com/threats
                  minRiskLevel: MEDIUM
      responses:
        '201':
          description: Threat alert subscription created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatSubscription'
              examples:
                SubscribeToThreatAlerts201Example:
                  summary: Default subscribeToThreatAlerts 201 response
                  x-microcks-default: true
                  value:
                    subscriptionId: sub-threat-500123
                    device:
                      phoneNumber: '+12125551234'
                    minRiskLevel: MEDIUM
                    status: ACTIVE
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorInfo'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorInfo'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ThreatSubscriptionRequest:
      type: object
      required:
      - device
      - notificationUrl
      properties:
        device:
          $ref: '#/components/schemas/Device'
        notificationUrl:
          type: string
          format: uri
          description: Webhook URL for threat alert notifications
          example: https://webhook.example.com/threats
        minRiskLevel:
          type: string
          description: Minimum risk level to trigger notifications
          enum:
          - LOW
          - MEDIUM
          - HIGH
          - CRITICAL
          example: MEDIUM
        notificationAuthToken:
          type: string
          description: Bearer token for webhook authentication
          example: webhook-token-abc123
    ErrorInfo:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
          example: 400
        code:
          type: string
          description: Error code
          example: INVALID_ARGUMENT
        message:
          type: string
          description: Human-readable error message
          example: Invalid device identifier
    ThreatSubscription:
      type: object
      properties:
        subscriptionId:
          type: string
          description: Unique subscription identifier
          example: sub-threat-500123
        device:
          $ref: '#/components/schemas/Device'
        minRiskLevel:
          type: string
          description: Minimum risk level triggering notifications
          example: MEDIUM
        status:
          type: string
          description: Subscription status
          enum:
          - ACTIVE
          - INACTIVE
          example: ACTIVE
    Device:
      type: object
      properties:
        phoneNumber:
          type: string
          description: Mobile phone number in E.164 format
          example: '+12125551234'
  securitySchemes:
    oauth2:
      type: oauth2
      description: AT&T OAuth 2.0 for network security APIs
      flows:
        clientCredentials:
          tokenUrl: https://api.att.com/oauth/v4/token
          scopes: {}