GreyNoise Intelligence

GreyNoise Intelligence Tags API

Endpoints for retrieving tag information, metadata, and associated activity data.

Documentation GitHub OpenAPI

Operations 1

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/greynoise-tags-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: GreyNoise Callback Tags API
  version: 3.0.0
  description: GreyNoise is a cybersecurity company that collects and analyzes Internet-wide scan and attack traffic. Use GreyNoise to contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats.
  contact:
    email: hello@greynoise.io
  license:
    name: Proprietary
    url: https://www.greynoise.io/terms
servers:
- url: https://api.greynoise.io
  description: Production
security:
- APIKeyHeaderAuth: []
tags:
- name: Tags
  description: 'Endpoints for retrieving tag information, metadata, and associated activity data.

    '
paths:
  /v3/tags:
    get:
      operationId: listTags
      tags:
      - Tags
      summary: List Tags
      description: 'Retrieve a list of tags with their metadata. Supports filtering by name, slug, and CVE.


        This endpoint returns tag information including ID, name, slug, category, intention,

        description, references, CVEs, and related tags.

        '
      parameters:
      - in: query
        name: name
        description: Filter tags by name (partial match)
        required: false
        schema:
          type: string
          example: Mirai
      - in: query
        name: slug
        description: Filter tags by slug (exact match)
        required: false
        schema:
          type: string
          example: mirai
      - in: query
        name: cve
        description: Filter tags by associated CVE
        required: false
        schema:
          type: string
          example: CVE-2020-1234
      responses:
        '200':
          description: OK - request successful.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TagsMetadata'
              examples:
                ListTags200Example:
                  summary: Default listTags 200 response
                  x-microcks-default: true
                  value:
                    tags:
                    - id: ef0cc90d-d80c-436f-92c5-3d8f8665c9ac
                      label: MIRAI
                      slug: mirai
                      name: Mirai
                      category: worm
                      intention: malicious
                      description: This IP address exhibits behavior that indicates it is infected with Mirai or a Mirai-like variant of malware.
                      references:
                      - string
                      recommend_block: false
                      cves:
                      - CVE-2021-44228
                      created_at: '2020-04-07'
                      related_tags:
                      - id: da78f2eb-fe6b-4e84-913c-cdab4ff067c2
                        name: Oracle WebLogic RCE CVE-2020-14882
                        intention: malicious
                        category: activity
                        slug: oracle-weblogic-rce-cve-2020-14882
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/UnexpectedError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Unauthorized:
      description: Unauthorized. Please check your API key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            message: Unauthorized
    UnexpectedError:
      description: Unexpected error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            message: Encountered error while performing request
  schemas:
    TagsMetadata:
      type: object
      properties:
        tags:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
                example: ef0cc90d-d80c-436f-92c5-3d8f8665c9ac
              label:
                type: string
                example: MIRAI
              slug:
                type: string
                example: mirai
              name:
                type: string
                example: Mirai
              category:
                type: string
                example: worm
              intention:
                type: string
                example: malicious
              description:
                type: string
                example: This IP address exhibits behavior that indicates it is infected with Mirai or a Mirai-like variant of malware.
              references:
                type: array
                items:
                  type: string
                  example: https://en.wikipedia.org/wiki/Mirai_(malware)
                example:
                - string
              recommend_block:
                type: boolean
                example: false
              cves:
                type: array
                items:
                  type: string
                  example: CVE-2020-1234
                example:
                - CVE-2021-44228
              created_at:
                type: string
                example: '2020-04-07'
              related_tags:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: string
                      example: da78f2eb-fe6b-4e84-913c-cdab4ff067c2
                    name:
                      type: string
                      example: Oracle WebLogic RCE CVE-2020-14882
                    intention:
                      type: string
                      example: malicious
                    category:
                      type: string
                      example: activity
                    slug:
                      type: string
                      example: oracle-weblogic-rce-cve-2020-14882
    Error:
      type: object
      properties:
        message:
          type: string
          example: Success
      required:
      - message
  securitySchemes:
    APIKeyHeaderAuth:
      type: apiKey
      in: header
      name: key
      description: GreyNoise API key passed via the 'key' HTTP header.