Skip to main content
GET

Query Parameters

key
string

Your Pulsedive API key.

API key authentication is optional. However, requests without a key have stricter rate limits. We recommend including an API key for better performance and reliability.

tid
string
required

Unique identifier of the threat to retrieve.

Example:

"1"

get
enum<string>
required

Indicates which data subset to retrieve. Options include:

  • links: Retrieves relationship data showing how the indicator connects to other objects.

Large result sets are automatically paginated. To learn how to handle paginated responses, visit Pagination.

Available options:
links
summary
enum<integer>

Summarize the data in the response.

For summarized data, set to 1. For full results, set to 0.

Available options:
1,
0
Example:

1

splitrisk
enum<integer>

Split out indicator counts by risk level.

For risk breakdown, set to 1. For non-aggregated results, set to 0.

Available options:
1,
0
Example:

1

pretty
enum<integer>
default:0

Indicates whether to format returned JSON results.

For pretty-printed output, set to 1. For compact output, set to 0.

Available options:
0,
1

Response

Successful request. Returns threat summary information in JSON format.

updated_last_domain
string<sql-date-time> | null

Timestamp when the threat's last domain was updated. 24-hour format, UTC time zone.

Pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$
Example:

"2025-09-03 11:44:52"

attributes
object

Indicator attributes with risk breakdowns.

properties
object

Additional properties.

feeds
object[]

Feeds associated with this threat with risk breakdowns.

risk
object

Count of indicators at each risk level for the threat.

Consists of key-value pairs, where each key matches an indicator risk level and its value contains the corresponding count.

Example: