ThreatConnect

ThreatConnect Indicators API

The Indicators API from ThreatConnect — 12 operation(s) for indicators.

Documentation GitHub OpenAPI

Operations 16

GET /api/v2/indicators GET /api/v2/indicators #

GET /api/v3/indicators GET /api/v3/indicators #

GET /v2/indicators/addresses/192.168.0.1/dnsResolutions Retrieving Address DNS Resolutions #

GET /v2/indicators/hosts/example.com/dnsResolutions Retrieving Host DNS Resolutions #

GET /v2/indicators/{indicatorid} Retrieve Indicators #

POST /v2/indicators/{indicatorid} Create Address Indicators #

DELETE /v2/indicators/{indicatortype}/{indicator} Delete Indicators #

GET /v2/indicators/{indicatortype}/{indicator} Retrieve a Single Indicator #

GET /v2/indicators/{indicatortype}/{indicator}/attributes Attributes are key/value data sets that can be added to any Group, Indicator… #

POST /v2/indicators/{indicatortype}/{indicator}/attributes Attributes are key/value data sets that can be added to any Group, Indicator… #

DELETE /v2/indicators/{indicatortype}/{indicator}/attributes/{attributeid} Deleting Attributes #

PUT /v2/indicators/{indicatortype}/{indicator}/attributes/{attributeid} Attributes are key/value data sets that can be added to any Group, Indicator… #

POST /v3/indicators/enrich Enrich Multiple Indicators #

PUT /v3/indicators/ultrabadguy.com Update an Object’s Metadata #

GET /v3/indicators/{indicatorid} Include Additional Fields in API Responses #

POST /v3/indicators/{indicatorid}/enrich Enrich a Specific Indicator #

Specifications

⚙

OpenAPI

https://artifacts.apis.io/threatconnect/openapi/threatconnect-indicators-api-openapi.yml

Schemas & Data

📊

JSONSchema

https://artifacts.apis.io/threatconnect/json-schema/threatconnect-post-v3-groups-response-schema.json

📊

JSONSchema

https://artifacts.apis.io/threatconnect/json-schema/threatconnect-post-v2-notifications-request-schema.json

📊

JSONSchema

https://artifacts.apis.io/threatconnect/json-schema/threatconnect-post-v2-custommetrics-taskscompleted-data-request-schema.json

📊

JSONSchema

https://artifacts.apis.io/threatconnect/json-schema/threatconnect-get-tc-taxii-collections-collectionid-or-ownername-response-schema.json

📊

JSONSchema

https://artifacts.apis.io/threatconnect/json-schema/threatconnect-put-v3-indicators-ultrabadguy-com-request-schema.json

📊

JSONSchema

https://artifacts.apis.io/threatconnect/json-schema/threatconnect-post-v2-groups-grouptype-groupid-attributes-request-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/threatconnect:threatconnect-indicators-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: ThreatConnect Indicators API
  version: '2026-10-14'
  description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-10-14: 55 operation(s) read from 31 public documentation page(s) (each operation names its page in x-source). This is not the provider''s published contract; ThreatConnect has published no machine-readable contract that the pipeline could find. Engine: local.'
  x-evidence-tiers:
    code-example: 8
    documentation: 47
    pages-with-code: 5
    pages-read: 31
  x-generated-from: documentation
  x-provenance: generated
  x-authored-by: API Evangelist
  x-generated: '2026-10-14'
  x-generator: generate-contract-from-docs.py
  x-engine: local
  x-sources:
  - https://docs.threatconnect.com/en/latest/rest_api/v2/tasks/tasks.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/groups/groups.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/victims/victims.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/batch_api/batch_api.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/playbooks/playbooks.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/attributes/attributes.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/indicators/indicators.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/notifications/notifications.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/custom_metrics/custom_metrics.html
  - https://docs.threatconnect.com/en/latest/rest_api/v2/security_labels/security_labels.html
  - https://docs.threatconnect.com/en/latest/rest_api/overview.html
  - https://docs.threatconnect.com/en/latest/rest_api/quick_start.html
  - https://docs.threatconnect.com/en/latest/rest_api/taxii/taxii_2.1.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/tc_exchange_administration/tc_exchange_administration.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/associations.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/bulk_delete.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/enable_pagination.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/filter_results.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/additional_fields.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/return_count.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/sort_results.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/specify_owner.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/update_metadata.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/case_management/artifacts/artifacts.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/case_management/case_attributes/case_attributes.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/case_management/cases/cases.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/case_management/workflow_templates/workflow_templates.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/group_attributes/group_attributes.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/groups/groups.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/indicator_attributes/indicator_attributes.html
  - https://docs.threatconnect.com/en/latest/rest_api/v3/indicator_enrichment/indicator_enrichment.html
servers:
- url: https://companyabc.threatconnect.com
security:
- TC-Token: []
tags:
- name: Indicators
paths:
  /api/v2/indicators:
    get:
      operationId: get_api_v2_indicators
      tags:
      - Indicators
      summary: GET /api/v2/indicators
      x-source: https://docs.threatconnect.com/en/latest/rest_api/quick_start.html
      parameters:
      - name: owner
        in: query
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetApiV2IndicatorsResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -- location -- request GET 'https://app.threatconnect.com/api/v2/indicators?owner=Common%20Community'  -- header 'Timestamp: 1513703787'  -- header 'Authorization: TC 12345678901234567890:PthSlXIA7rNMow1h8wShfvOnTOhxHd+7njUe4MT4ZSs='  -- header 'Accept: application/json' \n Timestamp  \n The required Timestamp header is a nonce in Unix epoch time (generated by Unix shell with the command: date"
  /api/v3/indicators:
    get:
      operationId: get_api_v3_indicators
      tags:
      - Indicators
      summary: GET /api/v3/indicators
      x-source: https://docs.threatconnect.com/en/latest/rest_api/quick_start.html
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -- location -- request GET 'https://app.threatconnect.com/api/v3/indicators'  -- header 'Authorization: TC-Token APIV2:430:c8mTcH:1234567890123:7mbiy0OnuSIq0ujNbkrqEB3RlpplzNL3CcQsYGso8ZQ='  -- header 'Accept: application/json' \n Generate an API Token  \n New API User \n Follow these steps to generate an API token for a new API user account in ThreatConnect: \n Log into ThreatConnect with an Or"
  /v2/indicators/addresses/192.168.0.1/dnsResolutions:
    get:
      operationId: get_v2_indicators_addresses_192_168_0_1_dnsResolutions
      tags:
      - Indicators
      summary: Retrieving Address DNS Resolutions
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/indicators/indicators.html
      parameters:
      - name: owner
        in: query
        required: false
        schema:
          type: string
        description: Owner name for community queries
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV2IndicatorsAddresses19216801DnsresolutionsResponse'
      x-evidence:
        kind: documentation
  /v2/indicators/hosts/example.com/dnsResolutions:
    get:
      operationId: get_v2_indicators_hosts_example_com_dnsResolutions
      tags:
      - Indicators
      summary: Retrieving Host DNS Resolutions
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/indicators/indicators.html
      parameters:
      - name: owner
        in: query
        required: false
        schema:
          type: string
        description: Owner name for community queries
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV2IndicatorsHostsExampleComDnsresolutionsResponse'
      x-evidence:
        kind: documentation
  /v2/indicators/{indicatorid}:
    get:
      operationId: get_v2_indicators_indicatorid
      tags:
      - Indicators
      summary: Retrieve Indicators
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/indicators/indicators.html
      parameters:
      - name: indicatorid
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
        collapsed_from: 6 example path(s) differing only at indicatorId
    post:
      operationId: post_v2_indicators_indicatorid
      tags:
      - Indicators
      summary: Create Address Indicators
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/indicators/indicators.html
      parameters:
      - name: indicatorid
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV2IndicatorsIndicatoridRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostV2IndicatorsIndicatoridResponse'
      x-evidence:
        kind: documentation
        collapsed_from: 5 example path(s) differing only at indicatorId
  /v2/indicators/{indicatortype}/{indicator}:
    delete:
      operationId: delete_v2_indicators_indicatortype_indicator
      tags:
      - Indicators
      summary: Delete Indicators
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/indicators/indicators.html
      parameters:
      - name: indicatortype
        in: path
        required: true
        schema:
          type: string
      - name: indicator
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteV2IndicatorsIndicatortypeIndicatorResponse'
      x-evidence:
        kind: documentation
    get:
      operationId: get_v2_indicators_indicatortype_indicator
      tags:
      - Indicators
      summary: Retrieve a Single Indicator
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/indicators/indicators.html
      parameters:
      - name: indicatortype
        in: path
        required: true
        schema:
          type: string
      - name: indicator
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v2/indicators/{indicatortype}/{indicator}/attributes:
    get:
      operationId: get_v2_indicators_indicatortype_indicator_attributes
      tags:
      - Indicators
      summary: Attributes are key/value data sets that can be added to any Group, Indicator…
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/attributes/attributes.html
      parameters:
      - name: indicatortype
        in: path
        required: true
        schema:
          type: string
      - name: indicator
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    post:
      operationId: post_v2_indicators_indicatortype_indicator_attributes
      tags:
      - Indicators
      summary: Attributes are key/value data sets that can be added to any Group, Indicator…
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/attributes/attributes.html
      parameters:
      - name: indicatortype
        in: path
        required: true
        schema:
          type: string
      - name: indicator
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV2IndicatorsIndicatortypeIndicatorAttributesRequest'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v2/indicators/{indicatortype}/{indicator}/attributes/{attributeid}:
    delete:
      operationId: delete_v2_indicators_indicatortype_indicator_attributes_attributeid
      tags:
      - Indicators
      summary: Deleting Attributes
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/attributes/attributes.html
      parameters:
      - name: indicatortype
        in: path
        required: true
        schema:
          type: string
      - name: indicator
        in: path
        required: true
        schema:
          type: string
      - name: attributeid
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    put:
      operationId: put_v2_indicators_indicatortype_indicator_attributes_attributeid
      tags:
      - Indicators
      summary: Attributes are key/value data sets that can be added to any Group, Indicator…
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v2/attributes/attributes.html
      parameters:
      - name: indicatortype
        in: path
        required: true
        schema:
          type: string
      - name: indicator
        in: path
        required: true
        schema:
          type: string
      - name: attributeid
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutV2IndicatorsIndicatortypeIndicatorAttributesAttributeidRe'
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v3/indicators/enrich:
    post:
      operationId: post_v3_indicators_enrich
      tags:
      - Indicators
      summary: Enrich Multiple Indicators
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v3/indicator_enrichment/indicator_enrichment.html
      parameters:
      - name: type
        in: query
        required: true
        schema:
          type: string
        description: Enrichment service(s) to apply to each Indicator in the request body.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV3IndicatorsEnrichRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostV3IndicatorsEnrichResponse'
      x-evidence:
        kind: documentation
  /v3/indicators/ultrabadguy.com:
    put:
      operationId: put_v3_indicators_ultrabadguy_com
      tags:
      - Indicators
      summary: Update an Object’s Metadata
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v3/update_metadata.html
      parameters:
      - name: fields
        in: query
        required: false
        schema:
          type: string
        description: Include additional fields in the response; can be repeated for each field (e.g., associatedGroups, securityLabels, tags).
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutV3IndicatorsUltrabadguyComRequest'
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PutV3IndicatorsUltrabadguyComResponse'
      x-evidence:
        kind: documentation
  /v3/indicators/{indicatorid}:
    get:
      operationId: get_v3_indicators_indicatorid
      tags:
      - Indicators
      summary: Include Additional Fields in API Responses
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v3/additional_fields.html
      parameters:
      - name: indicatorid
        in: path
        required: true
        schema:
          type: string
      - name: fields
        in: query
        required: false
        schema:
          type: string
        description: 'Additional fields to include in the response (repeatable). Example: threatAssess'
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV3IndicatorsIndicatoridResponse'
      x-evidence:
        kind: documentation
        collapsed_from: 3 example path(s) differing only at indicatorId
  /v3/indicators/{indicatorid}/enrich:
    post:
      operationId: post_v3_indicators_indicatorid_enrich
      tags:
      - Indicators
      summary: Enrich a Specific Indicator
      x-source: https://docs.threatconnect.com/en/latest/rest_api/v3/indicator_enrichment/indicator_enrichment.html
      parameters:
      - name: indicatorid
        in: path
        required: true
        schema:
          type: string
      - name: type
        in: query
        required: true
        schema:
          type: string
        description: Enrichment service to use (URLScan).
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV3IndicatorsIndicatoridEnrichRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostV3IndicatorsIndicatoridEnrichResponse'
      x-evidence:
        kind: documentation
        collapsed_from: 7 example path(s) differing only at indicatorId
components:
  schemas:
    GetV2IndicatorsAddresses19216801DnsresolutionsResponse:
      type: object
      properties:
        status:
          type: string
        data.resultCount:
          type: integer
        data.indicator[]:
          type: object
    GetV3IndicatorsIndicatoridResponse:
      type: object
      properties:
        data:
          type: object
          description: Indicator object with requested additional fields
        status:
          type: string
          description: Response status
    PostV3IndicatorsEnrichRequest:
      type: object
      properties:
        Content-Type:
          type: string
          description: application/json
        data:
          type: string
          description: Array of Indicator objects (by id or by type/summary).
      required:
      - Content-Type
      - data
    DeleteV2IndicatorsIndicatortypeIndicatorResponse:
      type: object
      properties:
        status:
          type: string
    PutV3IndicatorsUltrabadguyComResponse:
      type: object
      properties:
        data:
          type: object
          description: The updated indicator object.
        message:
          type: string
          description: Status message, e.g., "Updated".
        status:
          type: string
          description: Result status, e.g., "Success".
    GetV2IndicatorsHostsExampleComDnsresolutionsResponse:
      type: object
      properties:
        status:
          type: string
        data.resultCount:
          type: integer
        data.dnsResolution[]:
          type: object
    PostV3IndicatorsIndicatoridEnrichResponse:
      type: object
      properties:
        data:
          type: object
          description: Enriched Indicator data.
        status:
          type: string
          description: Success
    PostV3IndicatorsEnrichResponse:
      type: object
      properties:
        data:
          type: array
          description: Array of enriched Indicator objects.
        enriched:
          type: integer
          description: Number of Indicators successfully enriched.
        status:
          type: string
          description: Success
    PostV2IndicatorsIndicatortypeIndicatorAttributesRequest:
      type: object
      properties:
        type:
          type: string
          description: ‘Description’
        value:
          type: string
          description: ‘Example description.’
        displayed:
          type: string
          description: 'true'
        source:
          type: string
          description: ‘Hybrid Analysis’
      required:
      - type
      - value
    PutV2IndicatorsIndicatortypeIndicatorAttributesAttributeidRe:
      type: object
      properties:
        value:
          type: string
          description: ‘Updated description.’
        displayed:
          type: string
          description: 'true'
        source:
          type: string
          description: ‘Hybrid Analysis’
      required:
      - value
    PutV3IndicatorsUltrabadguyComRequest:
      type: object
      properties:
        associatedGroups:
          type: object
          description: Metadata for associated groups; contains data array and mode.
        securityLabels:
          type: object
          description: Metadata for security labels; contains data array and mode.
        tags:
          type: object
          description: Metadata for tags; contains data array and mode.
    PostV2IndicatorsIndicatoridRequest:
      type: object
      properties:
        ip:
          type: string
          description: IP address of the address indicator
        rating:
          type: number
        confidence:
          type: integer
        active:
          type: boolean
        activeLocked:
          type: boolean
      required:
      - ip
    PostV3IndicatorsIndicatoridEnrichRequest:
      type: object
      properties:
        Content-Type:
          type: string
          description: application/json
      required:
      - Content-Type
    GetApiV2IndicatorsResponse:
      type: object
      properties:
        status:
          type: string
        data:
          type: object
          properties:
            resultCount:
              type: integer
            owner:
              type: array
              items:
                type: object
                properties:
                  id:
                    type: integer
                  name:
                    type: string
                  type:
                    type: string
    PostV2IndicatorsIndicatoridResponse:
      type: object
      properties:
        status:
          type: string
        data.id:
          type: string
  securitySchemes:
    TC-Token:
      type: apiKey
      in: header
      name: Authorization
      x-source: https://docs.threatconnect.com/en/latest/tcex/authorization.html