find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/securonix-incident-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: ThreatQ Incident API
  description: '© 2025


    The API doc you are viewing is a BETA version that provides an early look at ThreatQ’s new API documentation format.'
  license:
    name: null
    url: null
  version: 1.0.0
  x-logo:
    url: null
    backgroundColor: null
    altText: ThreatQuotient
servers:
- description: SwaggerHub API Auto Mocking
  url: https://virtserver.swaggerhub.com/securonix-b7a/ThreatQ/1.0.0
- url: https://threatq.com/api
  description: ThreatQ Server
security:
- BearerAuth: []
tags:
- name: Incident
paths:
  /incident:
    get:
      tags:
      - Incident
      summary: List Incident
      parameters:
      - $ref: '#/components/parameters/CommonObjectWith'
      - $ref: '#/components/parameters/Sort'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Offset'
      responses:
        '200':
          description: Request Successful
          content:
            application/json:
              schema:
                allOf:
                - properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/Incident'
                  type: object
                - $ref: '#/components/schemas/TotalResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-visibility: public
      operationId: getIncident
      x-operation-id-source: derived
    post:
      tags:
      - Incident
      summary: Create a(n) Incident
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                allOf:
                - properties:
                    attributes:
                      type: array
                      items:
                        $ref: '#/components/schemas/AttributeBasics'
                    sources:
                      type: array
                      items:
                        $ref: '#/components/schemas/SourceBasics'
                  type: object
                - $ref: '#/components/schemas/IncidentFillable'
      responses:
        '200':
          description: Request Successful
          content:
            application/json:
              schema:
                allOf:
                - properties:
                    data:
                      type: array
                      items:
                        allOf:
                        - properties:
                            attributes:
                              type: array
                              items:
                                $ref: '#/components/schemas/AttributeBasics'
                            sources:
                              type: array
                              items:
                                $ref: '#/components/schemas/SourceBasics'
                          type: object
                        - $ref: '#/components/schemas/Incident'
                  type: object
                - $ref: '#/components/schemas/TotalResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-visibility: public
      operationId: postIncident
      x-operation-id-source: derived
  /incident/consume:
    post:
      tags:
      - Incident
      summary: Incident Consume
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                allOf:
                - properties:
                    incident:
                      description: Related Incident
                      type: array
                      items:
                        $ref: '#/components/schemas/IncidentFillable'
                  type: object
                - $ref: '#/components/schemas/IncidentFillable'
                - $ref: '#/components/schemas/CommonObjectConsumeRequest'
      responses:
        '201':
          description: Ingestion Completed Successfully
          content:
            application/json:
              schema:
                allOf:
                - properties:
                    data:
                      type: array
                      items:
                        allOf:
                        - properties:
                            id:
                              description: Incident ID
                              type: integer
                              default: 1
                          type: object
                        - $ref: '#/components/schemas/IncidentFillable'
                  type: object
                - $ref: '#/components/schemas/TotalResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-visibility: public
      operationId: postIncidentConsume
      x-operation-id-source: derived
  /incident/{incident_id}:
    get:
      tags:
      - Incident
      summary: Get Single Incident
      parameters:
      - $ref: '#/components/parameters/IncidentId'
      - $ref: '#/components/parameters/CommonObjectWith'
      responses:
        '200':
          description: Request Successful
          content:
            application/json:
              schema:
                properties:
                  data:
                    $ref: '#/components/schemas/Incident'
                type: object
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-visibility: public
      operationId: getIncidentByIncidentId
      x-operation-id-source: derived
    put:
      tags:
      - Incident
      summary: Update a(n) Incident
      parameters:
      - $ref: '#/components/parameters/IncidentId'
      - $ref: '#/components/parameters/CommonObjectWith'
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                allOf:
                - properties:
                    attributes:
                      type: array
                      items:
                        $ref: '#/components/schemas/AttributeBasics'
                    sources:
                      type: array
                      items:
                        $ref: '#/components/schemas/SourceBasics'
                  type: object
                - $ref: '#/components/schemas/IncidentFillable'
      responses:
        '200':
          description: Request Successful
          content:
            application/json:
              schema:
                allOf:
                - properties:
                    data:
                      type: array
                      items:
                        allOf:
                        - properties:
                            attributes:
                              type: array
                              items:
                                $ref: '#/components/schemas/AttributeBasics'
                            sources:
                              type: array
                              items:
                                $ref: '#/components/schemas/SourceBasics'
                          type: object
                        - $ref: '#/components/schemas/Incident'
                  type: object
                - $ref: '#/components/schemas/TotalResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-visibility: public
      operationId: putIncidentByIncidentId
      x-operation-id-source: derived
    delete:
      tags:
      - Incident
      summary: Delete Incident
      parameters:
      - $ref: '#/components/parameters/IncidentId'
      responses:
        '204':
          $ref: '#/components/responses/NoContent'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-visibility: public
      operationId: deleteIncidentByIncidentId
      x-operation-id-source: derived
components:
  parameters:
    Limit:
      name: limit
      in: query
      description: <br>The number of objects included in the response.
      required: false
      style: form
      explode: false
      schema:
        type: integer
        example: 10
    CommonObjectWith:
      name: with
      in: query
      description: '<br>Object Relationships that can be included in the response.<br><br>Options include: adversaries, asset,

        attachments, attack_pattern, attributes, campaign, comments, course_of_action, events, exploit_target, identity,

        incident, indicators, intrusion_set, malware, recipient, report, plugins, pluginActions, signatures, sources, tags,

        tool, ttp, and watchlist.'
      required: false
      style: form
      explode: false
      schema:
        type: array
        items:
          type: string
          example: adversaries,comments,sources
    Sort:
      name: sort
      in: query
      description: "<br>Designate the field(s) you want to use to sort the retrieved list. You can prepend each field \n        with a minus sign (-) to reverse the sorting order. This string can be a list of comma-separated values."
      required: false
      style: form
      explode: false
      schema:
        type: string
        example: id,created_at
    IncidentId:
      name: incident_id
      in: path
      description: Incident ID
      required: true
      schema:
        type: integer
    Offset:
      name: offset
      in: query
      description: <br>The number of result set records that should be ignored.
      required: false
      style: form
      explode: false
      schema:
        type: integer
        example: 50
  schemas:
    TLPName:
      properties:
        name:
          description: TLP Name
          type: string
          example: WHITE
      type: object
    ObjectAttributeValue:
      properties:
        value:
          description: Attribute Value
          type: string
          example: High
      type: object
    ObjectLinkAttributeFillable:
      allOf:
      - $ref: '#/components/schemas/AttributeFillable'
      - $ref: '#/components/schemas/ObjectAttributeValue'
    TotalResponse:
      properties:
        total:
          description: Total Number of Objects Processed
          type: integer
          example: 1
      type: object
    AttributeBasics:
      allOf:
      - properties:
          sources:
            type: array
            items:
              $ref: '#/components/schemas/SourceBasics'
        type: object
      - $ref: '#/components/schemas/ObjectLinkAttributeFillable'
    AttributeFillable:
      properties:
        name:
          description: Attribute Name
          type: string
          example: Confidence
      type: object
    Incident:
      allOf:
      - properties:
          id:
            description: Incident ID
            type: integer
            example: 67
        type: object
      - $ref: '#/components/schemas/IncidentFillable'
      - $ref: '#/components/schemas/ThreatQTimestamps'
      - $ref: '#/components/schemas/TouchedAtTimestamp'
    ThreatQTimestamps:
      properties:
        created_at:
          description: Creation Date
          type: string
          example: '2021-07-29 13:58:03'
        updated_at:
          description: Update Date
          type: string
          example: '2022-04-12 08:32:16'
      type: object
    IncidentFillable:
      properties:
        value:
          description: Incident Value
          type: string
          example: Malware on Systems 3,4,7
        description:
          description: Description for the Incident
          type: string
          example: Systems 3,4,7 owned by ACME, Inc. have malware. APT31 is suspected.
        started_at:
          description: Incident First Seen Date
          type: string
          example: '2019-02-28 15:59:24'
        ended_at:
          description: Incident Last Seen Date
          type: string
          example: '2020-05-13 05:46:13'
      type: object
    SourceName:
      properties:
        name:
          description: Source Name
          type: string
          example: ThreatQ
      type: object
    TouchedAtTimestamp:
      properties:
        touched_at:
          description: Update Date for Object Context (Attributes, Comments, Sources, Relationships)
          type: string
          example: '2021-11-13 15:28:17'
      type: object
    CommonObjectConsumeRequest:
      properties:
        attributes:
          type: array
          items:
            $ref: '#/components/schemas/AttributeBasics'
        sources:
          type: array
          items:
            $ref: '#/components/schemas/SourceBasics'
        tlp:
          $ref: '#/components/schemas/TLPName'
        <object_code>:
          description: 'Relate objects of other types by providing a list of IDs. Replace the `<object_code>` property key with

            one of the options to relate objects of that type. <br><br> NOTE: Objects must be created separately before IDs can be

            used in request. <br><br>Options include: adversaries, attachments, attack_pattern, campaign, course_of_action, events,

            exploit_target, identity, incident, indicators, intrusion_set, malware, recipient, report, signatures, tool, ttp.'
          type: array
          items:
            type: integer
            example: 2
      type: object
    SourceBasics:
      oneOf:
      - allOf:
        - properties:
            tlp_id:
              description: Source TLP ID
              type: integer
              example: 3
          type: object
        - $ref: '#/components/schemas/SourceName'
      - allOf:
        - properties:
            tlp:
              $ref: '#/components/schemas/TLPName'
          type: object
        - $ref: '#/components/schemas/SourceName'
  responses:
    Unauthorized:
      description: Unauthorized
    NotFound:
      description: Object Not Found
    NoContent:
      description: Object(s) were successfully deleted.
  securitySchemes:
    BearerAuth:
      type: http
      description: "Once authorized, all subsequent requests must include an `Authorization` header\n with the granted `access_token`. See the OAuth2 Authentication path for more information on how to authorize a User.<br><br>\n Example Header: `Authorization: Bearer <access_token>`"
      name: Authorization
      in: header
      bearerFormat: Bearer `<access_token>`
      scheme: bearer