---
title: "Creates a new IOC set."
method: POST
path: "/threatintel/v1/ioc-sets"
tags: ["Threat Intel"]
---

# Creates a new IOC set.

`POST /threatintel/v1/ioc-sets`

Creates a new IOC Set.

## Request body

- CreateIOCSetRequestBody
  - `description` string — IOC set description.
  - `iocType` 'hash' | 'ext', required — IOc set type, can be either hash / extension.
  - `iocs` string[], required — IOCs that needs to be added in IOC set.
  - `name` string, required — IOC set name
  - `source` string — Source of IOC set.

## Response `200`

IOC Set created successfully.

## Other responses

- `400` — Bad Request
- `401` — The request either did not include an authentication token, or you have provided an expired authentication token.
- `404` — The requested resource was not found.
- `500` — Internal error.

---

[API](https://skmtc.net/druva/apis/authentication.md) · [All operations](https://skmtc.net/druva/apis/authentication/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/druva/authentication/versions/2af2bf148b25/schema)