HackNotice is an external threat-intelligence and cyber-risk platform founded in 2018 and headquartered in Austin, Texas. It continuously collects intelligence from ransomware groups, infostealer malware logs, data breaches, dark-web marketplaces, hacker forums and public disclosures, then matches that intelligence against the domains, employees, customers and vendors an organization asks it to watch. The product is organized around four monitoring services — first-party domain monitoring, third-party vendor risk monitoring, end-user credential monitoring, and threat research and investigations — plus AI-assisted vendor security assessments. HackNotice exposes this surface programmatically through a REST API documented as a public Postman collection at api-docs.hacknotice.com, a remote Model Context Protocol server at mcp.hacknotice.com whose tool catalogue answers anonymously, first-party n8n automation nodes on npm, and webhook, Splunk HEC and SIEM/SOAR alert delivery.
HackNotice publishes 9 API contracts indexed on the APIs.io network, including Alerts API, All Business Accounts API, Calc endpoints API, and 6 more. Tagged areas include Company, Security, Threat Intelligence, Cybersecurity, and Dark Web Monitoring.
The HackNotice catalog on APIs.io includes 1 event-driven AsyncAPI specification and 1 Spectral governance ruleset.
HackNotice’s developer surface includes documentation, API reference, getting-started guide, support, engineering blog, pricing, signup flow, and 31 more developer resources.
Regulatory Posture applies to this provider. Its tags matched the
Horizontal (data, software, accessibility, platform) regime, so
Regulatory Posture carries 15 points of the composite.
If this regime is wrong for your business, say so on your
provider repo — the
applicability map is public and we will correct it.
Create-or-Update Ergonomics applies to this provider. This API accepts writes, so it
carries 10 points of the composite. It is scored from the published contracts
themselves: whether a caller can create-or-update in one call, whether the write accepts a key the caller already
holds, and whether the response says which branch ran. Without that, every write needs a search-and-branch in
front of it, and the first time that check is skipped a duplicate record is created.
Scored against the observed mean rather than raw — a provider at the catalog average is unchanged by this facet,
not penalised by it.
The six quality facets above are damped to 75 points between them,
because the conditional facet above carries the other
25. That is why each facet's contribution is shown against a damped
maximum: raising a quality facet moves the composite by 75% of its nominal
weight, not 100%. The full arithmetic is at apis.io/rating/.
Show this score on your site.
It updates itself when the score changes. Paste this where you link to your API docs:
<a href="https://apis.io/providers/hacknotice/"><img src="https://apis.io/badge/hacknotice/card.svg" alt="HackNotice on APIs.io — Kin Score by API Evangelist"></a>
Other styles, a README pill and a shields.io endpoint are on the badge page.
Raise your score.
Agent readiness — checks not met, largest first (exact, from this profile):
Idempotency+9 pts — OpenAPI mutating operations declare an idempotency key — a header, a request-body property, or a named de-duplication token whose own description says so (verified); else common[].type matches /idempoten/i (documented) Ask about this →
Delegated User Identity+6 pts — a served discovery document listing authorization_code in grant_types_supported (served), else an oauth2 authorizationCode flow or openIdConnect declared in an OpenAPI (documented) Ask about this →
Each check links to what satisfies it. Publish the artifact, or tell us where it already lives, and the score moves on the next scoring run.
Not sure how this applies to your stack? Ask about any one item. Kin Lane reads every question, looks at your profile and your situation, and replies with what a fix would take — scoped to that one area, priced up front, yours whether you ship it or not. Ask a question →
Standards this provider implements or carries. De facto ones are profiled and measured by the API Commons; formal ones come from the standards directory and are linked by the provider's own tags. The evidence column says how each claim was established — not that it was made.
Remote Model Context Protocol server operated by HackNotice, speaking JSON-RPC 2.0 over Streamable HTTP at https://mcp.hacknotice.com:13330/mcp. It publishes 80 tools across thi...
Overlays applied on top of this provider's contracts. Each card says who wrote it: a document the provider publishes, or one API Evangelist derived or generated.
aid: hacknotice
name: HackNotice
description: HackNotice is an external threat-intelligence and cyber-risk platform founded in 2018 and headquartered in Austin,
Texas. It continuously collects intelligence from ransomware groups, infostealer malware logs, data breaches, dark-web marketplaces,
hacker forums and public disclosures, then matches that intelligence against the domains, employees, customers and vendors
an organization asks it to watch. The product is organized around four monitoring services — first-party domain monitoring,
third-party vendor risk monitoring, end-user credential monitoring, and threat research and investigations — plus AI-assisted
vendor security assessments. HackNotice exposes this surface programmatically through a REST API documented as a public
Postman collection at api-docs.hacknotice.com, a remote Model Context Protocol server at mcp.hacknotice.com whose tool catalogue
answers anonymously, first-party n8n automation nodes on npm, and webhook, Splunk HEC and SIEM/SOAR alert delivery.
deliveryModel:
model: unknown
open_source: unknown
commercial: true
callable_host: true
label: Delivery model not determined — needs a product licence on record
confidence: low
source:
- openapi
- pricing
- repository-unlicensed
generated: '2026-08-28'
method: derived
accessModel:
pricing: paid
onboarding: unknown
trial: false
try_now: false
public: false
label: Paid
confidence: high
source:
- plans
- authentication
- rate-limits
- security
generated: '2026-11-13'
method: derived
image: https://hacknotice.com/wp-content/uploads/2022/12/favicon.png
url: https://raw.githubusercontent.com/api-evangelist/hacknotice/refs/heads/main/apis.yml
x-type: company
x-source: harvest:secondary-market
specificationVersion: '0.20'
created: '2026-08-22'
modified: '2026-09-16'
x-docs-platform: postman
x-docs-platform-confidence: high
x-docs-platform-checked: 2026-10-03
tags:
- Company
- Security
- Threat Intelligence
- Cybersecurity
- Dark Web Monitoring
- Data Breaches
- Credential Monitoring
- Third-Party Risk Management
- Vulnerability Management
- Ransomware
- Security Assessments
- Alerts
- Monitoring
tags_raw:
- Company
- Security
- Threat Intelligence
- Cybersecurity
- Dark Web Monitoring
- Data Breaches
- Credential Monitoring
- Third Party Risk
- Vendor Risk Management
- Vulnerability Management
- Ransomware
- Security Assessments
- Alerts
- Monitoring
- Third-Party Risk
apis:
- aid: hacknotice:hacknotice-mcp
name: HackNotice MCP Server
description: Remote Model Context Protocol server operated by HackNotice, speaking JSON-RPC 2.0 over Streamable HTTP at
https://mcp.hacknotice.com:13330/mcp. It publishes 80 tools across third-party, first-party, end-user, research and assessment
groups, plus cross-cutting global-breach, exposure, chatter, credential-leak, leaked-file and correlated-leak search.
tools/list and initialize answer anonymously, so every tool inputSchema is public; tools/call is gated on a per-user X-HackNotice-Integration-Key.
humanURL: https://github.com/HackNotice/n8n-nodes-hacknotice-mcp
baseURL: https://mcp.hacknotice.com:13330/mcp
tags:
- MCP
- Agents
- Threat Intelligence
- Security
properties:
- type: MCPServer
url: mcp/hacknotice-mcp.yml
- type: ToolCrosswalk
url: mcp/hacknotice-tool-crosswalk.yml
- type: SourceCode
url: https://github.com/HackNotice/n8n-nodes-hacknotice-mcp
- aid: hacknotice:hacknotice-alerts-api
name: HackNotice Alerts API
description: Cross-service alert retrieval.
humanURL: https://api-docs.hacknotice.com
baseURL: https://extensionapi.hacknotice.com
tags:
- Alerts
properties:
- type: OpenAPI
url: openapi/hacknotice-alerts-api-openapi.yml
- type: Documentation
url: https://api-docs.hacknotice.com
- type: APIReference
url: https://api-docs.hacknotice.com
- type: Postman
url: https://api-docs.hacknotice.com
- type: Authentication
url: authentication/hacknotice-authentication.yml
- type: RateLimits
url: rate-limits/hacknotice-rate-limits.yml
- type: ErrorCatalog
url: errors/hacknotice-problem-types.yml
- type: DataModel
url: data-model/hacknotice-data-model.yml
- type: Conventions
url: conventions/hacknotice-conventions.yml
- aid: hacknotice:hacknotice-all-business-accounts-api
name: HackNotice All Business Accounts API
description: Authentication, leak/leakfile search, customer records, metrics, habits, downloads, utilities and item notes
shared by every business account.
humanURL: https://api-docs.hacknotice.com
baseURL: https://extensionapi.hacknotice.com
tags:
- All Business Accounts
properties:
- type: OpenAPI
url: openapi/hacknotice-all-business-accounts-api-openapi.yml
- type: Documentation
url: https://api-docs.hacknotice.com
- type: APIReference
url: https://api-docs.hacknotice.com
- type: Postman
url: https://api-docs.hacknotice.com
- type: Authentication
url: authentication/hacknotice-authentication.yml
- type: RateLimits
url: rate-limits/hacknotice-rate-limits.yml
- type: ErrorCatalog
url: errors/hacknotice-problem-types.yml
- type: DataModel
url: data-model/hacknotice-data-model.yml
- type: Conventions
url: conventions/hacknotice-conventions.yml
- aid: hacknotice:hacknotice-calc-endpoints-api
name: HackNotice Calc endpoints API
description: Aggregate/rollup calculation endpoints for breaches, threat actors and per-service alerts.
humanURL: https://api-docs.hacknotice.com
baseURL: https://extensionapi.hacknotice.com
tags:
- Calc endpoints
properties:
- type: OpenAPI
url: openapi/hacknotice-calc-endpoints-api-openapi.yml
- type: Documentation
url: https://api-docs.hacknotice.com
- type: APIReference
url: https://api-docs.hacknotice.com
- type: Postman
url: https://api-docs.hacknotice.com
- type: Authentication
url: authentication/hacknotice-authentication.yml
- type: RateLimits
url: rate-limits/hacknotice-rate-limits.yml
- type: ErrorCatalog
url: errors/hacknotice-problem-types.yml
- type: DataModel
url: data-model/hacknotice-data-model.yml
- type: Conventions
url: conventions/hacknotice-conventions.yml
- aid: hacknotice:hacknotice-deprecated-api
name: HackNotice Deprecated API
description: Endpoints HackNotice groups as deprecated in its published collection (dark hash alerts, Teams accounts).
humanURL: https://api-docs.hacknotice.com
baseURL: https://extensionapi.hacknotice.com
tags:
- Deprecated
properties:
- type: OpenAPI
url: openapi/hacknotice-deprecated-api-openapi.yml
- type: Documentation
url: https://api-docs.hacknotice.com
- type: APIReference
url: https://api-docs.hacknotice.com
- type: Postman
url: https://api-docs.hacknotice.com
- type: Authentication
url: authentication/hacknotice-authentication.yml
- type: RateLimits
url: rate-limits/hacknotice-rate-limits.yml
- type: ErrorCatalog
url: errors/hacknotice-problem-types.yml
- type: DataModel
url: data-model/hacknotice-data-model.yml
- type: Conventions
url: conventions/hacknotice-conventions.yml
- aid: hacknotice:hacknotice-domain-business-accounts-api
name: HackNotice Domain Business Accounts API
description: 'First-party domain monitoring: domain watchlists, domain leaks, domain alerts and downloads.'
humanURL: https://api-docs.hacknotice.com
baseURL: https://extensionapi.hacknotice.com
tags:
- Domain Business Accounts
properties:
- type: OpenAPI
url: openapi/hacknotice-domain-business-accounts-api-openapi.yml
- type: Documentation
url: https://api-docs.hacknotice.com
- type: APIReference
url: https://api-docs.hacknotice.com
- type: Postman
url: https://api-docs.hacknotice.com
- type: Authentication
url: authentication/hacknotice-authentication.yml
- type: RateLimits
url: rate-limits/hacknotice-rate-limits.yml
- type: ErrorCatalog
url: errors/hacknotice-problem-types.yml
- type: DataModel
url: data-model/hacknotice-data-model.yml
- type: Conventions
url: conventions/hacknotice-conventions.yml
- aid: hacknotice:hacknotice-enduser-business-accounts-api
name: HackNotice Enduser Business Accounts API
description: 'End-user monitoring: end-user watchlists, end-user leaks and end-user alerts.'
humanURL: https://api-docs.hacknotice.com
baseURL: https://extensionapi.hacknotice.com
tags:
- Enduser Business Accounts
properties:
- type: OpenAPI
url: openapi/hacknotice-enduser-business-accounts-api-openapi.yml
- type: Documentation
url: https://api-docs.hacknotice.com
- type: APIReference
url: https://api-docs.hacknotice.com
- type: Postman
url: https://api-docs.hacknotice.com
- type: Authentication
url: authentication/hacknotice-authentication.yml
- type: RateLimits
url: rate-limits/hacknotice-rate-limits.yml
- type: ErrorCatalog
url: errors/hacknotice-problem-types.yml
- type: DataModel
url: data-model/hacknotice-data-model.yml
- type: Conventions
url: conventions/hacknotice-conventions.yml
- aid: hacknotice:hacknotice-research-service-accounts-api
name: HackNotice Research Service Accounts API
description: Threat-research search over terms, filenames and word pools, plus saved searches.
humanURL: https://api-docs.hacknotice.com
baseURL: https://extensionapi.hacknotice.com
tags:
- Research Service Accounts
properties:
- type: OpenAPI
url: openapi/hacknotice-research-service-accounts-api-openapi.yml
- type: Documentation
url: https://api-docs.hacknotice.com
- type: APIReference
url: https://api-docs.hacknotice.com
- type: Postman
url: https://api-docs.hacknotice.com
- type: Authentication
url: authentication/hacknotice-authentication.yml
- type: RateLimits
url: rate-limits/hacknotice-rate-limits.yml
- type: ErrorCatalog
url: errors/hacknotice-problem-types.yml
- type: DataModel
url: data-model/hacknotice-data-model.yml
- type: Conventions
url: conventions/hacknotice-conventions.yml
- aid: hacknotice:hacknotice-third-party-accounts-api
name: HackNotice Third Party Accounts API
description: 'Third-party vendor monitoring: hacks, hack updates, watchlists, alerts and vendor security assessments.'
humanURL: https://api-docs.hacknotice.com
baseURL: https://extensionapi.hacknotice.com
tags:
- Third Party Accounts
properties:
- type: OpenAPI
url: openapi/hacknotice-third-party-accounts-api-openapi.yml
- type: Documentation
url: https://api-docs.hacknotice.com
- type: APIReference
url: https://api-docs.hacknotice.com
- type: Postman
url: https://api-docs.hacknotice.com
- type: Authentication
url: authentication/hacknotice-authentication.yml
- type: RateLimits
url: rate-limits/hacknotice-rate-limits.yml
- type: ErrorCatalog
url: errors/hacknotice-problem-types.yml
- type: DataModel
url: data-model/hacknotice-data-model.yml
- type: Conventions
url: conventions/hacknotice-conventions.yml
maintainers:
- FN: Kin Lane
email: kin@apievangelist.com
- FN: APIs.json
email: info@apis.io
common:
- type: CapabilityMap
url: capabilities/hacknotice-capability-edges.yml
name: HackNotice Business Capability Map
- type: License
name: MIT
url: https://github.com/HackNotice/n8n-nodes-hacknotice-mcp/blob/main/LICENSE
- type: DomainSecurity
url: security/hacknotice-domain-security.yml
- type: Website
url: https://hacknotice.com/
- type: DeveloperPortal
url: https://api-docs.hacknotice.com
- type: Documentation
url: https://hacknotice.zendesk.com/hc/en-us
- type: APIReference
url: https://api-docs.hacknotice.com
- type: GettingStarted
url: https://hacknotice.zendesk.com/hc/en-us/articles/13771563959828-Overview-Getting-Started-for-Sec-Teams
- type: Support
url: https://hacknotice.zendesk.com/hc/en-us
- type: HelpCenter
url: https://hacknotice.zendesk.com/hc/en-us
- type: Blog
url: https://hacknotice.com/category/blog/
- type: BlogRSS
url: https://hacknotice.com/feed/
- type: GitHubOrganization
url: https://github.com/HackNotice
- type: Pricing
url: https://hacknotice.com/pricing/
- type: SignUp
url: https://hacknotice.com/free-account/
- type: Login
url: https://app.hacknotice.com/
- type: TermsOfService
url: https://hacknotice.com/businesstandc/
- type: PrivacyPolicy
url: https://hacknotice.com/privacy/
- type: Postman
url: https://api-docs.hacknotice.com
- type: OpenAPI
url: openapi/_original/hacknotice-openapi.yml
- type: MCPServer
url: mcp/hacknotice-mcp.yml
- type: ToolCrosswalk
url: mcp/hacknotice-tool-crosswalk.yml
- type: Packages
url: packages/hacknotice-packages.yml
- type: SDKs
url: packages/hacknotice-packages.yml
- type: Authentication
url: authentication/hacknotice-authentication.yml
- type: RateLimits
url: rate-limits/hacknotice-rate-limits.yml
- type: Plans
url: plans/hacknotice-plans-pricing.yml
- type: Conventions
url: conventions/hacknotice-conventions.yml
- type: ErrorCatalog
url: errors/hacknotice-problem-types.yml
- type: Lifecycle
url: lifecycle/hacknotice-lifecycle.yml
- type: Conformance
url: conformance/hacknotice-conformance.yml
- type: DataModel
url: data-model/hacknotice-data-model.yml
- type: Overlay
url: overlays/hacknotice-openapi-overlay.yaml
- type: Webhooks
url: asyncapi/hacknotice-webhooks.yml
- type: AgentSkill
url: skills/_index.yml
- type: LLMsTxt
url: llms/hacknotice-llms.txt
- type: UsageTerms
url: terms/hacknotice-terms-of-service.yml
- type: DataProcessing
url: privacy/hacknotice-privacy-policy.yml
x-enrichment:
date: '2026-08-22'
status: enriched
artifacts_added: 25
pass: local-v1
HackNotice API — frequently asked questions
Does HackNotice have an API?
Yes. APIs.io lists 9 APIs from HackNotice, including HackNotice MCP Server, HackNotice Alerts API and HackNotice All Business Accounts API, and 6 more.
Is there an OpenAPI specification for the HackNotice API?
Yes. APIs.io indexes 8 OpenAPI specifications for HackNotice, each linked for download from this page.
How do I authenticate with the HackNotice API?
HackNotice uses bearer-token authentication (apiKey · 3 schemes). The details are profiled on APIs.io as HackNotice Authentication.
How much does the HackNotice API cost?
HackNotice publishes its prices; its Breach Claim Response Starter plan is $5,000 as of 2026-10-28. APIs.io lists 15 pricing plans for HackNotice, with each plan's price, limits and inclusions under Pricing on this page.
Does HackNotice have an MCP server?
Yes. APIs.io lists 1 MCP server for HackNotice: Remote MCP server at mcp.hacknotice.com:13330 over streamable HTTP requiring an API key; 80 tools listed.
Is the HackNotice API ready for AI agents?
HackNotice has a Kin Score of 52.2 out of 100 (developing) and an Agent Readiness score of 34.2 (agent-ready), scored by API Evangelist on 2026-11-13.
Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
Kin Score
How this is scored →
It updates itself when the score changes. Paste this where you link to your API docs: