v1

latestOpenAPI 3.0.02026-07-249055687.1 KB

threat-feed

Get Threat Feed Items (Beta)

Paginated list of threats, sorted by updated_at by default. Set updated_after to the unix timestamp of your last sync while sorting by updated_at to synchronize all new or updated threats in the feed.

This endpoint requires an Enterprise Plan with Threat Feed add-on. Contact our sales team for more details.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:

threat-feed:list

get/orgs/{org_slug}/threat-feed

Path parameters

org_slugstring required

The slug of the organization

Query parameters

per_pageinteger

Number of threats per page

page_cursorstring

Page cursor token. Pass the returned nextPageCursor to this query string to fetch the next page of the threat feed.

sort'id' | 'created_at' | 'updated_at'

Set the sort order for the threat feed items. Default is descending order by updated_at, which includes all new and updated threat feed items.

updated_afterstring

A Unix timestamp in seconds that filters results to items only updated after the timestamp.

created_afterstring

A Unix timestamp in seconds that filters results to items only created after the date.

direction'desc' | 'asc'

Order direction of the provided sort field.

filter'u' | 'c' | 'fp' | 'tp' | 'mal' | 'vuln' | 'anom' | 'joke' | 'spy' | 'typo' | 'obf' | 'dual'

Filter by threat classification. Supported values: mal (malware, including possible malware), vuln (vulnerability), typo (typosquat, including possible typosquat), anom (anomaly), spy (telemetry), obf (obfuscated code), dual (dual-use tool), joke (protestware or joke package), tp (all confirmed true positives), fp (false positive), u (unreviewed), c (classified, i.e. anything except unreviewed).

namestring

Filter threats by package name

versionstring

Filter threats by package version.

is_human_reviewedboolean

Only return threats which have been human-reviewed

Filter threats by package ecosystem.

Response

The paginated list of items in the threat feed and the next page cursor.

nextPageCursorstring nullable required