curl "https://pulsedive.com/api/explore.php?q=ioc%3Dpulsedive.com%20or%20threat%3Dryuk"

{
  "results": [
    {
      "iid": 123,
      "indicator": "pulsedive.com",
      "type": "domain",
      "risk": "none",
      "stamp_added": "2020-01-15 10:30:00",
      "stamp_updated": "2025-05-19 14:23:45",
      "stamp_seen": "2025-05-19 14:23:45",
      "stamp_retired": null,
      "summary": {
        "properties": {
          "geo": {
            "country": "United States",
            "countrycode": "US"
          },
          "dns": {
            "a": "142.250.190.14"
          }
        }
      }
    },
    {
      "iid": 456,
      "indicator": "malicious-domain.com",
      "type": "domain",
      "risk": "high",
      "stamp_added": "2024-03-20 08:15:00",
      "stamp_updated": "2025-05-18 12:00:00",
      "stamp_seen": "2025-05-18 12:00:00",
      "stamp_retired": null,
      "summary": {
        "threats": [
          {
            "name": "Ryuk",
            "category": "ransomware"
          }
        ]
      }
    }
  ],
  "query": "ioc=pulsedive.com or threat=ryuk"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

Explore

Search Dataset

Query Pulsedive’s dataset using the Explore query language. Search across indicators or threats by value, type, risk, timestamps, feeds, attributes, and properties using boolean logic and wildcards.

The Explore query language provides powerful search capabilities:

Boolean operators: Combine search terms with and, or, not
Wildcards: Use * for pattern matching
Field-specific queries: Search by specific fields like ioc=, type=, risk=, threat=, feed=
Complex filters: Filter by timestamps, attributes, and technical properties

For detailed query syntax and more examples, visit Query Language.

GET

api

explore.php

curl "https://pulsedive.com/api/explore.php?q=ioc%3Dpulsedive.com%20or%20threat%3Dryuk"

{
  "results": [
    {
      "iid": 123,
      "indicator": "pulsedive.com",
      "type": "domain",
      "risk": "none",
      "stamp_added": "2020-01-15 10:30:00",
      "stamp_updated": "2025-05-19 14:23:45",
      "stamp_seen": "2025-05-19 14:23:45",
      "stamp_retired": null,
      "summary": {
        "properties": {
          "geo": {
            "country": "United States",
            "countrycode": "US"
          },
          "dns": {
            "a": "142.250.190.14"
          }
        }
      }
    },
    {
      "iid": 456,
      "indicator": "malicious-domain.com",
      "type": "domain",
      "risk": "high",
      "stamp_added": "2024-03-20 08:15:00",
      "stamp_updated": "2025-05-18 12:00:00",
      "stamp_seen": "2025-05-18 12:00:00",
      "stamp_retired": null,
      "summary": {
        "threats": [
          {
            "name": "Ryuk",
            "category": "ransomware"
          }
        ]
      }
    }
  ],
  "query": "ioc=pulsedive.com or threat=ryuk"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

{
  "error": "<string>"
}

Query Parameters

key

string

Your Pulsedive API key.

API key authentication is optional. However, requests without a key have stricter rate limits. We recommend including an API key for better performance and reliability.

string

required

Explore query string using the Explore query language syntax. The query is URI-encoded.

Query syntax supports:

Field searches: ioc=example.com, type=domain, risk=high
Boolean logic: ioc=pulsedive.com or threat=ryuk
Wildcards: ioc=*.pulsedive.com, feed=*malware*
Negation: not risk=none
Combinations: (type=domain or type=ip) and risk=critical

Common searchable fields include ioc, type, risk, threat, feed, seen, added, updated, retired, port, protocol, and technology.

Some examples:

For detailed query syntax and more examples, visit Query Language.

type

enum<string>

default:indicators

Search mode, which determines the dataset you are querying and filters that are available. Options include:

indicators: Search for indicators by value, type, risk, attributes, properties, and associated threats or feeds.
threats: Search for threats by name, alias, category, or associated indicator attributes.

Available options:

indicators,

threats

limit

integer

Maximum number of results to return per query.

If you don't specify a limit, Pulsedive applies your account tier's default:

Visitor (not logged in): 10
Free: 50
Pro: 250
Team: 1000
Business/Custom: 10000

Required range: x >= 1

Example:

10

format

enum<string>

default:json

Output format for results.

Available formats:

json: JSON format (default)
csv: Comma-separated values with headers
stix: STIX 2.1 format (requires authentication)

CSV exports include a header with query information and result limit. STIX exports require a registered user account.

Available options:

json,

csv,

stix

pretty

enum<integer>

default:0

Indicates whether to format returned JSON results.

For pretty-printed output, set to 1. For compact output, set to 0.

Available options:

0,

1

Response

Successful request. Returns search results in the specified format.

Response from an indicator search query. Contains an array of matching indicators and the effective query that was executed.

results

object[]

Array of indicators matching the search query. Each indicator includes core identification, risk assessment, and summary information.

The structure of each indicator object varies based on available data. Common fields include indicator value, type, risk, timestamps, and associated threats/feeds.

Show child attributes

query

string

The effective query string that was executed. This reflects the parsed and processed version of your original query.

Useful for debugging query syntax and understanding how Pulsedive interpreted your search.

Example:

"ioc=pulsedive.com or threat=ryuk"

Getting Started

Indicators

Scan an Indicator

Explore

Threats

Feeds

Search Dataset

Query Parameters

Response