# ThreatConnect API

**Canonical:** https://apis.io/apis/threatconnect/threatconnect-api/  
**Provider:** ThreatConnect — https://apis.io/providers/threatconnect/  
**Base URL:** https://companyabc.threatconnect.com  
**Documentation:** https://docs.threatconnect.com/en/latest/rest_api/v2/tasks/tasks.html

ThreatConnect API is published by [ThreatConnect](https://apis.io/providers/threatconnect/) on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. This API exposes 6 JSON Schema definitions. The published artifact set on APIs.io includes an OpenAPI specification and 6 JSON Schemas.

ThreatConnect API as documented publicly: 55 operations. Contract generated from the documentation by API Evangelist (2026-10-14); not the provider's own document.

## Operations (55)

| Method | Path | Summary |
|---|---|---|
| GET | `/api/services/taxii/v1/tc_taxii` | GET /api/services/taxii/v1/tc_taxii |
| GET | `/api/v2/batch/{batchid}` | GET /api/v2/batch/{batchId} |
| GET | `/api/v2/indicators` | GET /api/v2/indicators |
| GET | `/api/v3/apps/exchange/install` | GET /api/v3/apps/exchange/install |
| GET | `/api/v3/groups/{groupid}/upload` | GET /api/v3/groups/{groupId}/upload |
| GET | `/api/v3/indicators` | GET /api/v3/indicators |
| GET | `/api/v3/token/{tokenid}` | GET /api/v3/token/api |
| GET | `/tc_taxii/collections` | Retrieve information about all collections available on the ThreatConnect TAXII 2.1 server |
| GET | `/tc_taxii/collections/{collectionId or ownerName}` | Retrieve information about a specific collection available on the ThreatConnect TAXII 2.1 server |
| POST | `/v2/customMetrics/tasksCompleted/data` | Add content to the non‑keyed metric "tasksCompleted". |
| GET | `/v2/groups/incidents/{incidentid}` | Retrieve Incident status (includeAdditional) |
| GET | `/v2/groups/{groupid}` | Retrieve Multiple Groups of type campaigns |
| GET | `/v2/groups/{grouptype}/{groupid}/attributes` | Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. |
| POST | `/v2/groups/{grouptype}/{groupid}/attributes` | Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. |
| DELETE | `/v2/groups/{grouptype}/{groupid}/attributes/{attributeid}` | Deleting Attributes |
| PUT | `/v2/groups/{grouptype}/{groupid}/attributes/{attributeid}` | Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. |
| GET | `/v2/indicators/addresses/192.168.0.1/dnsResolutions` | Retrieving Address DNS Resolutions |
| GET | `/v2/indicators/hosts/example.com/dnsResolutions` | Retrieving Host DNS Resolutions |
| GET | `/v2/indicators/{indicatorid}` | Retrieve Indicators |
| POST | `/v2/indicators/{indicatorid}` | Create Address Indicators |
| DELETE | `/v2/indicators/{indicatortype}/{indicator}` | Delete Indicators |
| GET | `/v2/indicators/{indicatortype}/{indicator}` | Retrieve a Single Indicator |
| GET | `/v2/indicators/{indicatortype}/{indicator}/attributes` | Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. |
| POST | `/v2/indicators/{indicatortype}/{indicator}/attributes` | Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. |
| DELETE | `/v2/indicators/{indicatortype}/{indicator}/attributes/{attributeid}` | Deleting Attributes |
| PUT | `/v2/indicators/{indicatortype}/{indicator}/attributes/{attributeid}` | Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. |
| POST | `/v2/notifications` | Create and send a notification. |
| GET | `/v2/tasks/{taskid}/attributes` | Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. |
| POST | `/v2/tasks/{taskid}/attributes` | Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. |
| DELETE | `/v2/tasks/{taskid}/attributes/{attributeid}` | Deleting Attributes |
| PUT | `/v2/tasks/{taskid}/attributes/{attributeid}` | Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. |
| GET | `/v2/types/indicatorTypes` | Retrieve Available Indicator Types |
| GET | `/v2/types/indicatorTypes/{indicatortype}` | Retrieve Available Indicator Types |
| GET | `/v2/victims/{victimid}/attributes` | Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. |
| POST | `/v2/victims/{victimid}/attributes` | Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. |
| DELETE | `/v2/victims/{victimid}/attributes/{attributeid}` | Deleting Attributes |
| PUT | `/v2/victims/{victimid}/attributes/{attributeid}` | Attributes are key/value data sets that can be added to any Group, Indicator, Task, or Victim. |
| GET | `/v2/{v2id}` | Retrieve All Groups |
| GET | `/v3/cases/{caseid}` | Case Attributes — ThreatConnect Developer Docs latest documentation |
| POST | `/v3/groups` | Create an Object in a Community or Source |
| DELETE | `/v3/groups/{groupxid}` | Groups — ThreatConnect Developer Docs latest documentation |
| PUT | `/v3/groups/{groupxid}` | Groups — ThreatConnect Developer Docs latest documentation |
| POST | `/v3/groups/{groupxid}/upload` | Groups — ThreatConnect Developer Docs latest documentation |
| PUT | `/v3/groups/{groupxid}/upload` | Groups — ThreatConnect Developer Docs latest documentation |
| GET | `/v3/groups/{groupxid}/{id}` | Groups — ThreatConnect Developer Docs latest documentation |
| POST | `/v3/indicators/enrich` | Enrich Multiple Indicators |
| PUT | `/v3/indicators/ultrabadguy.com` | Update an Object’s Metadata |
| GET | `/v3/indicators/{indicatorid}` | Include Additional Fields in API Responses |
| POST | `/v3/indicators/{indicatorid}/enrich` | Enrich a Specific Indicator |
| DELETE | `/v3/notes` | Delete Case Objects in Bulk |
| GET | `/v3/tasks/{taskid}` | Artifacts — ThreatConnect Developer Docs latest documentation |
| GET | `/v3/{objecttype}` | Enable Pagination |
| DELETE | `/{id}` | Deletes the single object specified by the given ID |
| GET | `/{id}` | Retrieves a single object specified by the given ID |
| PUT | `/{id}` | Updates the object specified by the given ID |

## Machine-readable artifacts (8)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/threatconnect/refs/heads/main/openapi/_ae-authored/threatconnect-openapi-generated.yml
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/threatconnect/refs/heads/main/json-schema/threatconnect-post-v3-groups-response-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/threatconnect/refs/heads/main/json-schema/threatconnect-post-v2-notifications-request-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/threatconnect/refs/heads/main/json-schema/threatconnect-post-v2-custommetrics-taskscompleted-data-request-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/threatconnect/refs/heads/main/json-schema/threatconnect-get-tc-taxii-collections-collectionid-or-ownername-response-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/threatconnect/refs/heads/main/json-schema/threatconnect-put-v3-indicators-ultrabadguy-com-request-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/threatconnect/refs/heads/main/json-schema/threatconnect-post-v2-groups-grouptype-groupid-attributes-request-schema.json
- **APIsJSON** — https://raw.githubusercontent.com/api-evangelist/threatconnect/refs/heads/main/apis.yml

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/threatconnect/threatconnect-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/threatconnect/.