Rapid7

Rapid7 Community Threats API

An API used to add and replace indicators for Community Threats. See https://insightidr.help.rapid7.com/docs/threats#section-threat-api for further information on how to generate threat keys.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 4

POST /idr/v1/customthreats Create a Community Threat #
POST /idr/v1/customthreats/key/{key}/indicators/replace Replace indicators for a Community Threat #
POST /idr/v1/customthreats/key/{key}/indicators/add Add indicators to a Community Threat #
POST /idr/v1/customthreats/key/{key}/delete Delete a Community Threat #

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/rapid7/refs/heads/main/openapi/rapid7-community-threats-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/rapid7:rapid7-community-threats-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

rapid7-community-threats-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: InsightIDR Community Threats API
  version: v1
  description: 'Introduction


    Welcome to the reference documentation for the InsightIDR public APIs.


    Here are a few resources to help you learn how to start using our APIs:


    Learn about basic concepts and capabilities


    Get an Insight platform API key to set up authentication


    See available Insight product APIs


    Learn more about InsightIDR


    After you''ve got the basics down, you can use this API guide to find examples of requests and responses.'
servers:
- url: https://{region}.api.insight.rapid7.com/
  variables:
    region:
      default: us
      description: Insight API region
security: []
tags:
- name: Community Threats
  description: An API used to add and replace indicators for Community Threats. See https://insightidr.help.rapid7.com/docs/threats#section-threat-api for further information on how to generate threat keys.
paths:
  /idr/v1/customthreats:
    post:
      tags:
      - Community Threats
      summary: Create a Community Threat
      description: 'Create a private InsightIDR Community Threat and add indicators to this Community Threat. The following Community Threat indicators are supported in the request body, formatted as JSON:


        communityThreatName


        notetext


        indicators


        IP addresses (non-CIDR notation)


        Process hashes


        Domain names


        URLs


        The request content type must be to in JSON (see request samples).

        The maximum file size is 50 MB.'
      operationId: createCommunityThreat
      requestBody:
        description: "The request body format must be in JSON. \nThe maximum payload size is 50 MB."
        content:
          application/json:
            schema:
              type: string
            example:
              threat: threatName
              note: notetext
              indicators:
                ips:
                - 192.168.0.1
                hashes:
                - b95663ec7339033cf1fde459a34b6606
                domain_names:
                - rapid7.com
                - mailxpy.com
                urls:
                - http://example.com/index
                - ' http://www.mailxpy.com/login/index.php'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatUpdateResult'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Insufficient Permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Entity Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '405':
          description: Method Not Allowed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '413':
          description: Payload Is Too Large
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '502':
          description: Bad Gateway
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '504':
          description: Gateway Timeout
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /idr/v1/customthreats/key/{key}/indicators/replace:
    post:
      tags:
      - Community Threats
      summary: Replace indicators for a Community Threat
      description: 'Replace InsightIDR Community Threat indicators for a Community Threat with the given Community Threat key. The following Community Threat indicators are supported in the request body formatted as JSON, STIX XML, or CSV:


        IP addresses


        Process hashes


        Domain names


        URLs


        The request content type is expected to match the specified format: "application/json" for "json" format, "text/xml" for "stix_xml" format and "text/csv" for "csv" format. See request samples on the right.

        The multipart file upload (with multipart/form-data content type) is also supported by the endpoint. The maximum file size is 50 MB.'
      operationId: replaceIndicators
      parameters:
      - name: key
        in: path
        description: The key of a Community Threat for which the indicators are going to be added.
        required: true
        schema:
          type: string
        example: 156c9e48-64da-4bba-939e-e1c329be591b
      - name: format
        in: query
        description: The input format.
        required: true
        schema:
          type: string
          enum:
          - json
          - csv
          - stix_xml
        example: json
      requestBody:
        description: "The request body format should be one of JSON, STIX XML, CSV, or multi-part file data. \nThe maximum payload size is 50 MB."
        content:
          application/json:
            schema:
              type: string
            example:
              ips:
              - 192.168.0.1
              hashes:
              - b95663ec7339033cf1fde459a34b6606
              domain_names:
              - rapid7.com
              urls:
              - http://example.com
          text/csv:
            schema:
              type: string
            example: 192.168.0.1,b95663ec7339033cf1fde459a34b6606,rapid7.com,http://example.com
          text/xml:
            schema:
              type: string
            example: "\n<stix:STIX_Package xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n                   xmlns:stix=\"http://stix.mitre.org/stix-1\"\n                   xmlns:indicator=\"http://stix.mitre.org/Indicator-2\"\n                   xmlns:cybox=\"http://cybox.mitre.org/cybox-2\"\n                   xmlns:DomainNameObj=\"http://cybox.mitre.org/objects#DomainNameObject-1\"\n                   xmlns:cyboxVocabs=\"http://cybox.mitre.org/default_vocabularies-2\"\n                   xmlns:stixVocabs=\"http://stix.mitre.org/default_vocabularies-1\"\n                   xmlns:example=\"http://example.com/\"\n                   xsi:schemaLocation=\n                           \"http://stix.mitre.org/stix-1 ../stix_core.xsd\n                            http://stix.mitre.org/Indicator-2 ../indicator.xsd\n                            http://cybox.mitre.org/default_vocabularies-2 ../cybox/cybox_default_vocabularies.xsd\n                            http://stix.mitre.org/default_vocabularies-1 ../stix_default_vocabularies.xsd\n                            http://cybox.mitre.org/objects#DomainNameObject-1 ../cybox/objects/Domain_Name_Object.xsd\"\n                   id=\"example:STIXPackage-f61cd874-494d-4194-a3e6-6b487dbb6d6e\"\n                   timestamp=\"2014-05-08T09:00:00.000000Z\"\n                   version=\"1.1.1\">\n    <stix:STIX_Header>\n        <stix:Title>Example watchlist that contains domain information.</stix:Title>\n        <stix:Package_Intent xsi:type=\"stixVocabs:PackageIntentVocab-1.0\">Indicators - Watchlist</stix:Package_Intent>\n    </stix:STIX_Header>\n    <stix:Indicators>\n        <stix:Indicator xsi:type=\"indicator:IndicatorType\" id=\"example:Indicator-2e20c5b2-56fa-46cd-9662-8f199c69d2c9\" timestamp=\"2014-05-08T09:00:00.000000Z\">\n            <indicator:Type xsi:type=\"stixVocabs:IndicatorTypeVocab-1.1\">Domain Watchlist</indicator:Type>\n            <indicator:Description>Sample domain Indicator for this watchlist</indicator:Description>\n            <indicator:Observable id=\"example:Observable-87c9a5bb-d005-4b3e-8081-99f720fad62b\">\n                <cybox:Object id=\"example:Object-12c760ba-cd2c-4f5d-a37d-18212eac7928\">\n                    <cybox:Properties xsi:type=\"DomainNameObj:DomainNameObjectType\" type=\"FQDN\">\n                        <DomainNameObj:Value condition=\"Equals\" apply_condition=\"ANY\">malicious1.example.com##comma##malicious2.example.com##comma##malicious3.example.com</DomainNameObj:Value>\n                    </cybox:Properties>\n                </cybox:Object>\n            </indicator:Observable>\n            <indicator:Observable id=\"NCCIC:Observable-fb5606ea-23f0-472d-babf-8b7e89571881\">\n                <cybox:Object id=\"NCCIC:Object-a105a51a-c324-11e7-b25d-64006a91c899\">\n                    <cybox:Properties xsi:type=\"AddressObj:AddressObjectType\" category=\"ipv4-addr\" is_spoofed=\"false\">\n                        <AddressObj:Address_Value condition=\"Equals\">185.134.98.141</AddressObj:Address_Value>\n                    </cybox:Properties>\n                </cybox:Object>\n            </indicator:Observable>\n        </stix:Indicator>\n    </stix:Indicators>\n</stix:STIX_Package>"
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatUpdateResult'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Insufficient Permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Entity Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '405':
          description: Method Not Allowed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '413':
          description: Payload Is Too Large
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '502':
          description: Bad Gateway
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '504':
          description: Gateway Timeout
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /idr/v1/customthreats/key/{key}/indicators/add:
    post:
      tags:
      - Community Threats
      summary: Add indicators to a Community Threat
      description: 'Add InsightIDR Community Threat indicators to a Community Threat with the given Community Threat key. The following Community Threat indicators are supported in the request body formatted as JSON, STIX XML, or CSV:


        IP addresses


        Process hashes


        Domain names


        URLs


        The request content type is expected to match the specified format: "application/json" for "json" format, "text/xml" for "stix_xml" format and "text/csv" for "csv" format. See request samples on the right.

        The multipart file upload (with multipart/form-data content type) is also supported by the endpoint. The maximum file size is 50 MB.'
      operationId: addIndicators
      parameters:
      - name: key
        in: path
        description: The key of a Community Threat for which the indicators are going to be added.
        required: true
        schema:
          type: string
        example: 156c9e48-64da-4bba-939e-e1c329be591b
      - name: format
        in: query
        description: The input format.
        required: true
        schema:
          type: string
          enum:
          - json
          - csv
          - stix_xml
        example: json
      requestBody:
        description: "The request body format should be one of JSON, STIX XML, CSV, or multi-part file data. \nThe maximum payload size is 50 MB."
        content:
          application/json:
            schema:
              type: string
            example:
              ips:
              - 192.168.0.1
              hashes:
              - b95663ec7339033cf1fde459a34b6606
              domain_names:
              - rapid7.com
              urls:
              - http://example.com
          text/csv:
            schema:
              type: string
            example: 192.168.0.1,b95663ec7339033cf1fde459a34b6606,rapid7.com,http://example.com
          text/xml:
            schema:
              type: string
            example: "\n<stix:STIX_Package xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n                   xmlns:stix=\"http://stix.mitre.org/stix-1\"\n                   xmlns:indicator=\"http://stix.mitre.org/Indicator-2\"\n                   xmlns:cybox=\"http://cybox.mitre.org/cybox-2\"\n                   xmlns:DomainNameObj=\"http://cybox.mitre.org/objects#DomainNameObject-1\"\n                   xmlns:cyboxVocabs=\"http://cybox.mitre.org/default_vocabularies-2\"\n                   xmlns:stixVocabs=\"http://stix.mitre.org/default_vocabularies-1\"\n                   xmlns:example=\"http://example.com/\"\n                   xsi:schemaLocation=\n                           \"http://stix.mitre.org/stix-1 ../stix_core.xsd\n                            http://stix.mitre.org/Indicator-2 ../indicator.xsd\n                            http://cybox.mitre.org/default_vocabularies-2 ../cybox/cybox_default_vocabularies.xsd\n                            http://stix.mitre.org/default_vocabularies-1 ../stix_default_vocabularies.xsd\n                            http://cybox.mitre.org/objects#DomainNameObject-1 ../cybox/objects/Domain_Name_Object.xsd\"\n                   id=\"example:STIXPackage-f61cd874-494d-4194-a3e6-6b487dbb6d6e\"\n                   timestamp=\"2014-05-08T09:00:00.000000Z\"\n                   version=\"1.1.1\">\n    <stix:STIX_Header>\n        <stix:Title>Example watchlist that contains domain information.</stix:Title>\n        <stix:Package_Intent xsi:type=\"stixVocabs:PackageIntentVocab-1.0\">Indicators - Watchlist</stix:Package_Intent>\n    </stix:STIX_Header>\n    <stix:Indicators>\n        <stix:Indicator xsi:type=\"indicator:IndicatorType\" id=\"example:Indicator-2e20c5b2-56fa-46cd-9662-8f199c69d2c9\" timestamp=\"2014-05-08T09:00:00.000000Z\">\n            <indicator:Type xsi:type=\"stixVocabs:IndicatorTypeVocab-1.1\">Domain Watchlist</indicator:Type>\n            <indicator:Description>Sample domain Indicator for this watchlist</indicator:Description>\n            <indicator:Observable id=\"example:Observable-87c9a5bb-d005-4b3e-8081-99f720fad62b\">\n                <cybox:Object id=\"example:Object-12c760ba-cd2c-4f5d-a37d-18212eac7928\">\n                    <cybox:Properties xsi:type=\"DomainNameObj:DomainNameObjectType\" type=\"FQDN\">\n                        <DomainNameObj:Value condition=\"Equals\" apply_condition=\"ANY\">malicious1.example.com##comma##malicious2.example.com##comma##malicious3.example.com</DomainNameObj:Value>\n                    </cybox:Properties>\n                </cybox:Object>\n            </indicator:Observable>\n            <indicator:Observable id=\"NCCIC:Observable-fb5606ea-23f0-472d-babf-8b7e89571881\">\n                <cybox:Object id=\"NCCIC:Object-a105a51a-c324-11e7-b25d-64006a91c899\">\n                    <cybox:Properties xsi:type=\"AddressObj:AddressObjectType\" category=\"ipv4-addr\" is_spoofed=\"false\">\n                        <AddressObj:Address_Value condition=\"Equals\">185.134.98.141</AddressObj:Address_Value>\n                    </cybox:Properties>\n                </cybox:Object>\n            </indicator:Observable>\n        </stix:Indicator>\n    </stix:Indicators>\n</stix:STIX_Package>"
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatUpdateResult'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Insufficient Permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Entity Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '405':
          description: Method Not Allowed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '413':
          description: Payload Is Too Large
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '502':
          description: Bad Gateway
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '504':
          description: Gateway Timeout
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /idr/v1/customthreats/key/{key}/delete:
    post:
      tags:
      - Community Threats
      summary: Delete a Community Threat
      description: Delete an owned InsightIDR Community Threat.
      operationId: deleteCommunityThreat
      parameters:
      - name: key
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteThreatEvent'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Threat'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Insufficient Permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Threat with key threatKey was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '405':
          description: Method Not Allowed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '502':
          description: Bad Gateway
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '504':
          description: Gateway Timeout
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    ErrorResponse:
      required:
      - message
      type: object
      properties:
        message:
          type: string
          description: A human-readable message describing the error that occurred.
          example: A human-readable message describing the error that occurred.
        correlation_id:
          type: string
          description: An identifier that uniquely identifies the failed request.
          example: 6b6503c8-2da9-41c0-94cb-2f34069e00cd
    ThreatUpdateResult:
      required:
      - threat
      type: object
      properties:
        threat:
          $ref: '#/components/schemas/Threat'
        rejected_indicators:
          type: array
          description: The list of indicators that have been rejected during the update.
          example:
          - blacklisted
          - invalid
          items:
            type: string
    Threat:
      required:
      - indicator_count
      - name
      - published
      type: object
      properties:
        name:
          type: string
          description: The name of the threat.
          example: Threat
        note:
          type: string
          description: Notes about this threat.
          example: Notes
        published:
          type: boolean
          description: Indicates whether this threat has been published.
          example: true
        indicator_count:
          minimum: 0
          type: integer
          description: The number of indicators in this threat.
          format: int64
          example: 1
      description: The information about the threat.
    DeleteThreatEvent:
      type: object
      properties:
        reason:
          type: string
externalDocs:
  description: Product docs
  url: https://insightidr.help.rapid7.com/docs