ThreatX

ThreatX API

ThreatX API as documented publicly: 5 operations. Contract generated from the documentation by API Evangelist (2026-10-21); not the provider's own document.

Documentation GitHub OpenAPI

Operations 5

POST /tx_api/v1/channels-H POST /tx_api/v1/channels-H #

POST /tx_api/v1/customers POST /tx_api/v1/customers #

POST /tx_api/v1/lists POST /tx_api/v1/lists #

POST /tx_api/v1/login POST /tx_api/v1/login #

POST /tx_api/v2/logs POST /tx_api/v2/logs #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/threatx:threatx-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.1.0
info:
  title: ThreatX API
  version: '2026-10-21'
  description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-10-21: 5 operation(s) read from 2 public documentation page(s) (each operation
    names its page in x-source). This is not the provider''s published contract; ThreatX has published no machine-readable contract that the pipeline
    could find. Engine: local.'
  x-evidence-tiers:
    code-example: 5
    documentation: 0
    pages-with-code: 2
    pages-read: 2
  x-generated-from: documentation
  x-provenance: generated
  x-authored-by: API Evangelist
  x-generated: '2026-10-21'
  x-generator: generate-contract-from-docs.py
  x-engine: local
  x-sources:
  - https://www.threatx.com/documentation/using-threatx/threatx-administrator-guide
  - https://www.threatx.com/documentation/using-threatx/threatx-analyst-guide
paths:
  /tx_api/v1/channels-H:
    post:
      operationId: post_tx_api_v1_channels_H
      tags:
      - Tx Api
      summary: POST /tx_api/v1/channels-H
      x-source: https://www.threatx.com/documentation/using-threatx/threatx-administrator-guide
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostTxApiV1ChannelsHRequest'
      responses:
        '201':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostTxApiV1ChannelsHResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl https://provision.threatx.io/tx_api/v1/channels-H 'Content-Type: \napplication/json' -d '{ \"command\": \"list\", \"token\"\
          :\"<access_token>\" }' \n Example Response \n {\n  \"Ok\": [\n    ...\n    {\n      \"name\": \"test_channel\",\n\"require_totp_setup\"\
          :  null ,\n      \"uuid\": \"81815E73-ABB9-4533-977B-93964B8AAB73\",\n\"sso\":  null \n},\n    ...\n  ]\n} \n Channels: update \n The \
          \ update  command updates a specified chan"
  /tx_api/v1/customers:
    post:
      operationId: post_tx_api_v1_customers
      tags:
      - Tx Api
      summary: POST /tx_api/v1/customers
      x-source: https://www.threatx.com/documentation/using-threatx/threatx-administrator-guide
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostTxApiV1CustomersRequest'
      responses:
        '201':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostTxApiV1CustomersResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl https://provision.threatx.io/tx_api/v1/customers -H 'Content-Type: \napplication/json' -d '{ \"command\": \"list\", \"\
          token\":\"<access_token>\" }' \n Example Response \n {\n  \"Ok\": [\n    ...\n    {\n      \"name\": \"testco\",\n      \"contact_email\"\
          : \"alice@testco.com\",\n      \"description\": \"Tesco tenant\",\n      \"active\": true,\n      \"autoblock_threshold\": 70,\n     \
          \ \"autoblock_timeout\": 3600,\n      \"block_emba"
  /tx_api/v1/lists:
    post:
      operationId: post_tx_api_v1_lists
      tags:
      - Tx Api
      summary: POST /tx_api/v1/lists
      x-source: https://www.threatx.com/documentation/using-threatx/threatx-analyst-guide
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostTxApiV1ListsRequest'
      responses:
        '201':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostTxApiV1ListsResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl https://provision.threatx.io/tx_api/v1/lists -H 'Content-Type: application/json' -d '{ \"command\":\"delete_blocklist\"\
          , \"token\":\"<api_token>\", \"customer_name\":\"<tenant_name>\", \"ip\":\"1.2.3.4\" } } \n The response to the command is as follows:\
          \ \n {\"Ok\":\"Blocklist entry for IP 1.2.3.4 removed\"} \n The following example adds an IP address to the Blacklist. "
  /tx_api/v1/login:
    post:
      operationId: post_tx_api_v1_login
      tags:
      - Tx Api
      summary: POST /tx_api/v1/login
      x-source: https://www.threatx.com/documentation/using-threatx/threatx-administrator-guide
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostTxApiV1LoginRequest'
      responses:
        '201':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostTxApiV1LoginResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl https://provision.threatx.io/tx_api/v1/login -H 'Content-Type: \napplication/json' -d '{ \"command\":\"login\", \"api_token\"\
          :\"<api_key>\" }' \n Example Response \n {\n\"Ok\": {\n    \"status\": true,\n    \"token\": \"<access_token>\"\n}\n} \n Customers:\
          \ list \n The  list  command returns the details of all tenants authorized for the current API access token. \n Parameters Type “command”:\
          \ “list” String “token”: “<acc"
  /tx_api/v2/logs:
    post:
      operationId: post_tx_api_v2_logs
      tags:
      - Tx Api
      summary: POST /tx_api/v2/logs
      x-source: https://www.threatx.com/documentation/using-threatx/threatx-analyst-guide
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostTxApiV2LogsRequest'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl https://provision.threatx.io/tx_api/v2/logs -H 'Content-Type: \napplication/json' -d '{ \"command\":\"audit_events\", \"\
          token\":\"<api_token>\", \n\"customer_name\":\"<tenant_name>\", \"limit\": 100 }' \n Blocked Requests \n The Blocked Requests page lists\
          \ the requests that were blocked and relevant data about when and where the attack occurred that caused the threat to be blocked. \n\
          \ The Request ID is a random"
components:
  schemas:
    PostTxApiV1ChannelsHRequest:
      type: object
      properties:
        command:
          type: string
        token:
          type: string
    PostTxApiV1ChannelsHResponse:
      type: object
      properties:
        Ok:
          type: string
    PostTxApiV1CustomersRequest:
      type: object
      properties:
        command:
          type: string
        token:
          type: string
    PostTxApiV1CustomersResponse:
      type: object
      properties:
        Ok:
          type: string
    PostTxApiV1ListsRequest:
      type: object
      properties:
        command:
          type: string
        token:
          type: string
        customer_name:
          type: string
        ip:
          type: string
    PostTxApiV1ListsResponse:
      type: object
      properties:
        Ok:
          type: string
    PostTxApiV1LoginRequest:
      type: object
      properties:
        command:
          type: string
        api_token:
          type: string
    PostTxApiV1LoginResponse:
      type: object
      properties:
        Ok:
          type: string
    PostTxApiV2LogsRequest:
      type: object
      properties:
        command:
          type: string
        token:
          type: string
        customer_name:
          type: string
        limit:
          type: integer
tags:
- name: Tx Api