# Overview
Source: https://docs.pulsedive.com/addon/overview
Enrich web content with Pulsedive threat intelligence directly in your browser.
The Pulsedive browser add-on brings threat intelligence to any website you visit.
Highlight IPs, domains, URLs, or threat names in any webpage text to enrich them using Pulsedive's Community dataset.
The add-on works without an account, API key, or paid plan. Creating a free account at pulsedive.com unlocks higher limits and additional capabilities.
## Installation
The add-on is available for Chrome and Firefox.
| Browser | Store |
| ------- | ----------------------------------------------------------------------------------------------------------------------- |
| Chrome | [Chrome Web Store](https://chromewebstore.google.com/detail/pulsedive-threat-intellig/gdbemlfgncdmmljmkkcemfedbbfgghcp) |
| Firefox | [Firefox Add-Ons](https://addons.mozilla.org/en-US/firefox/addon/pulsedive/) |
To learn how to use the add-on effectively, visit [Usage](/addon/usage).
## Features
The add-on supports a wide range of threat research workflows.
Use it to enrich individual indicators, look up threats by name, or process thousands of indicators or threats at once.
### Indicator Highlighting
Highlight text on any webpage to parse and refang a domain, IP address, or URL and enrich it with Pulsedive threat intelligence.
From the add-on sidebar, run scans and pivot directly to Pulsedive for further investigation.
### Bulk Parsing
Highlight text containing hundreds or thousands of observable entities to parse and refang them all at once.
Download the results as a CSV file, or pass them to [Pulsedive Analyze](https://pulsedive.com/analyze/) for bulk enrichment.
### Threat Enrichment
The add-on can retrieve threat information for any threat name or alias found in
webpage text, including associated indicators, TTPs, latest news, and more.
### Auto-Popup
The auto-popup is a sidebar that appears automatically when you highlight text containing supported observable entities.
Triggering behavior depends on what you highlight:
* **Single indicator:** The indicator must make up most of the highlighted text, which limits unintentional triggering.
* **Multiple indicators:** The sidebar appears automatically if Bulk Parsing is enabled for the auto-popup.
### Add-On Button
The add-on button in the browser toolbar provides direct access to enrichment, independent of most auto-popup settings:
* **Text highlighted:** The add-on enriches the highlighted text regardless of auto-popup restrictions.
* **No text highlighted:** The add-on displays information for the domain of the active browser tab.
Threat enrichment is only available via the add-on button, not the auto-popup.
# Usage
Source: https://docs.pulsedive.com/addon/usage
How to use the Pulsedive browser add-on to streamline threat research.
The Pulsedive add-on keeps threat intelligence within reach wherever you work in the browser.
Enrich indicators inline as you read, cutting down context switches in your workflow.
These sections walk through the most common ways to put it to work.
To install the add-on, visit [Overview](/addon/overview).
## Enriching Indicators While Browsing
When you're reading a threat advisory, security blog, or research report, indicators appear as plain text scattered throughout the content.
1. Enable the auto-popup so the add-on identifies and highlights supported observable entities as you go, without copying anything manually.
2. Highlight any text containing a domain, IP address, or URL. The add-on sidebar opens with enrichment data from Pulsedive.
3. Run a passive or active scan, or pivot to Pulsedive for a deeper look.
If the auto-popup fires too aggressively on a particular site, visit [Muting Add-On Notifications](#muting-add-on-notifications).
## Processing a Large Set of Indicators
When you have a block of text containing many indicators, from a log excerpt, a paste site, or a shared report, Bulk Parsing lets you process them all at once rather than one at a time.
1. Enable **Bulk Parsing** in the add-on settings.
2. Highlight the entire block of text. The add-on parses and refangs all observable entities it finds.
3. Download the full list as a CSV for use in other tools, or pass them to [Pulsedive Analyze](https://pulsedive.com/analyze/) for bulk enrichment.
## Researching a Threat Name
When you come across a threat actor name, malware family, or campaign alias, look it up without navigating away from the page.
1. Highlight the exact name or alias in the page text.
2. Select the Pulsedive add-on button in the browser toolbar. The add-on retrieves a summary from Pulsedive's dataset and presents it in the sidebar.
3. Open the full threat profile on Pulsedive to explore associated indicators, TTPs, latest news, and more.
Threat enrichment requires the add-on button.
It is not available via the auto-popup.
## Muting Auto-Popup
The auto-popup is useful for active research, but it can become disruptive on sites where you don't need constant enrichment, such as internal tooling, ticketing systems, or sites with large volumes of known-good indicators.
Use the mute options to reduce interruptions without disabling the add-on entirely.
1. Select the auto-popup sidebar on the site you want to mute.
2. Choose a muting option:
* **Mute for 5 minutes:** Temporarily pauses the auto-popup, then restores it automatically.
* **Mute for this site:** Disables the auto-popup on the current domain until you remove the exception.
* **Disable the auto-popup:** Turns off the auto-popup across all sites.
To undo any of these:
1. Select the add-on button in the browser toolbar.
2. Select the **Unmute** menu.
To review and remove site exceptions, visit the add-on settings page.
# Authentication
Source: https://docs.pulsedive.com/api/authentication
Securely authenticate your requests to Pulsedive’s API to enable seamless access to threat intelligence data.
Pulsedive uses API key authentication to secure and manage access to its threat intelligence endpoints.
We recommend including your API key with every request for the best performance and highest rate limits.
While you can make requests without an API key, you will encounter much stricter [rate limits](/api/limits/).
***
## Get Your API Key
Visit Pulsedive and [log in](https://pulsedive.com/login) to your account, or [register](https://pulsedive.com/register) for free.
Navigate to [Account](https://pulsedive.com/account), then locate the **API key** section to retrieve your unique key.
## Include the Key in Your Request
Include your API key in the `key` parameter in your request:
```bash theme={null}
# Replace the placeholder text with your Pulsedive API key
curl "https://pulsedive.com/api/indicator.php \
?indicator=1.1.1.1 \
&pretty=1 \
&key="
```
***
## Best Practices
* **Keep your API key private**: Don't share it or commit it to source control.
* **Use an API tier that fits your needs**: If you need elevated rate limits, upgrade your [API plan](https://pulsedive.com/about/api).
* **Monitor your usage**: Check your API usage in the **Activity** section of your [Account page](https://pulsedive.com/account).
# Query Language
Source: https://docs.pulsedive.com/api/explore/query-language
Learn Pulsedive's query language syntax for searching threat intelligence data. Use boolean logic, wildcards, and field-specific searches to find indicators by risk, type, attributes, and more.
This syntax applies to searches made through the [`explore` endpoint](/api/explore/search/).
The Pulsedive query language enables searching across our dataset with boolean logic and wildcards for precise discovery.
## Search Modes
The explore endpoint supports two search modes, controlled by the `type` parameter:
* **Indicator mode** (`type=indicators`, default): Search for indicators by value, type, risk, attributes, properties, and associated threats or feeds.
* **Threat mode** (`type=threats`): Search for threats by name, alias, category, or associated indicator attributes.
The search mode determines which dataset you are querying and which filters are available.
All modes support the same [query syntax](#syntax).
Feeds are not a separate search mode.
To search for indicators associated with specific feeds, use the `feed` search field in indicator mode (e.g., `feed=urlhaus`).
## Syntax
Query terms follow a simple field-value structure for building search expressions:
```txt theme={null}
[search field]=[value]
```
## Search Fields
Search fields let you target specific aspects of indicators and threats.
### Indicator Mode Fields
These fields are available when searching indicators (`type=indicators`, default):
| Search Field | Description | Example Query |
| ----------------------------------------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `ioc` | Search by indicator value. Default field when no search field is specified. | `ioc=pulsedive.com`
`ioc=pulsedive*`
`1.1.1.1` |
| `threat` | Filter by associated threat name or alias. | `threat=ryuk`
`threat=*zeus*` |
| `property`
`[property type]`
`[property name]`
`[type].[name]` | Filter by indicator properties. | `dns.a=45.55.106.210`
`meta=*pulsedive*`
`content-type=text/html*`
`ssl="*let's encrypt*"` |
| `type` | Filter by indicator type. | `type=url`
`type=domain,ip,ipv6` |
| `seen` | Filter by Last Seen timestamp (UTC). | `seen=day`
`seen=week`
`seen=month`
`seen=2020-01-01`
`seen=2022-01-01+`
`seen=2021-12-31-`
`seen=2020-01-01-2020-12-31` |
### Threat Mode Fields
These fields are available when searching threats (`type=threats`):
| Search Field | Description | Example Query |
| ------------ | -------------------------------------------------------------------------------- | ------------------------------------------------ |
| `threat` | Search by threat name or alias. Default field when no search field is specified. | `threat=ryuk`
`threat=*zeus*`
`ryuk` |
| `ioc` | Filter by associated indicator values. | `ioc=pulsedive.com`
`ioc=pulsedive*` |
| `category` | Filter by threat category. | `category=malware`
`category=phishing,scam` |
### Fields Available in Both Modes
These fields work in both indicator and threat mode:
| Search Field | Description | Example Query |
| ----------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| `feed`
`source` | Filter by associated feed name or organization. | `feed=urlhaus`
`feed=abuse.ch` |
| `attribute`
`[attribute type]` | Filter by indicator attributes. Includes ports, protocols, and technologies. | `port=443`
`protocol=http*`
`technology=apache`
`port=80 and port=443` |
| `risk` | Filter by risk level. | `risk=critical`
`risk=low,medium`
`risk=high+`
`risk=low-` |
| `active`
`retired` | Filter by active or retired status. | `active=true`
`retired=0` |
## Boolean Logic and Wildcards
Combine search terms using logical operators and pattern matching for complex queries.
Queries allow for `AND`, `OR`, and `NOT` operations.
Wildcards are also allowed.
If an operator is omitted between search terms, the default operation is `AND`.
| Operation | Operator | Example Query |
| --------- | ------------------ | ---------------------------------------------------------------------------------- |
| AND | `&`, `&&`, `and` | `pulsedive.com && type=domain`
`pulsedive.com type=domain` |
| OR | `\|`, `\|\|`, `or` | `google.com or pulsedive*`
`(*pulsedive* and type=domain) \| threat=phishing` |
| NOT | `!=` | `risk!=medium-` |
| Wildcard | `*` | `*pulsedive*` |
## Escaping and Quotes
Use escaping and quotes to handle special characters and spaces in your search terms.
Since special characters like asterisks (`*`) and parentheses (`()`) might conflict with your intended query, you can escape them with a backslash (`\`).
If your search field or search term has a space, you must wrap it in quotes (`"`).
## Examples
These examples show how to specify search modes using the `type` parameter and construct queries with proper URI encoding.
Search indicators (default):
```bash theme={null}
# These are equivalent
curl "https://pulsedive.com/api/explore.php?q=risk%3Dhigh"
curl "https://pulsedive.com/api/explore.php?type=indicators&q=risk%3Dhigh"
```
Search threats:
```bash theme={null}
curl "https://pulsedive.com/api/explore.php?type=threats&q=risk%3Dhigh"
```
Filter indicator types (within indicator mode):
```bash theme={null}
# Note: type=domain is inside the query string (q parameter)
curl "https://pulsedive.com/api/explore.php?q=type%3Ddomain%20and%20risk%3Dhigh"
```
The mode parameter `type` is separate from the query field `type=`.
The parameter controls which dataset to search (indicators or threats), while the query field filters indicators by their type (e.g., domain, IP, URL).
Combining both the parameter and the query field looks like:
```bash theme={null}
# Search indicator mode, filter by domain type only
curl "https://pulsedive.com/api/explore.php?type=indicators&q=type%3Ddomain%20and%20risk%3Dhigh"
```
# Search Dataset
Source: https://docs.pulsedive.com/api/explore/search
/api/scan-explore.yaml get /api/explore.php
Query Pulsedive's dataset using the Explore query language. Search across indicators or threats by value, type, risk, timestamps, feeds, attributes, and properties using boolean logic and wildcards.
The Explore query language provides powerful search capabilities:
- **Boolean operators**: Combine search terms with `and`, `or`, `not`
- **Wildcards**: Use `*` for pattern matching
- **Field-specific queries**: Search by specific fields like `ioc=`, `type=`, `risk=`, `threat=`, `feed=`
- **Complex filters**: Filter by timestamps, attributes, and technical properties
For detailed query syntax and more examples, visit [Query Language](/api/explore/query-language/).
# Get Feed by ID
Source: https://docs.pulsedive.com/api/feed/get-by-id
/api/feed/feed-by-id.yaml get /api/feed.php
Retrieve detailed threat intelligence information for a specific feed by looking up the feed's unique identifier.
# Get Feed by Name and Organization
Source: https://docs.pulsedive.com/api/feed/get-by-name-organization
/api/feed/feed-by-name-and-org.yaml get /api/feed.php
Retrieve detailed threat intelligence information for a specific feed by looking up the feed's unique identifier.
# Get Linked Indicators
Source: https://docs.pulsedive.com/api/feed/get-linked-indicators
/api/feed/feed-get-links.yaml get /api/feed.php
Retrieve indicators linked to a specific feed.
# Get Indicator by ID
Source: https://docs.pulsedive.com/api/indicator/get-by-id
/api/indicator/indicator-by-id.yaml get /api/indicator.php
Retrieve detailed threat intelligence information for a specific indicator by looking up the indicator's unique identifier.
# Get Indicator by Value
Source: https://docs.pulsedive.com/api/indicator/get-by-value
/api/indicator/indicator-by-value.yaml get /api/indicator.php
Retrieve detailed threat intelligence information for a specific indicator by looking up the indicator's value.
To query links and properties, retrieve the indicator by ID instead.
# Get Indicator Links or Properties
Source: https://docs.pulsedive.com/api/indicator/get-links-properties
/api/indicator/indicator-get-links-properties.yaml get /api/indicator.php
Retrieve links or properties for a specific indicator.
# Rate Limits
Source: https://docs.pulsedive.com/api/limits
Understand Pulsedive API rate limits, monitor usage with HTTP headers, and handle 429 errors.
The Pulsedive API implements rate limits to ensure reliable service for all users.
Your rate limits depend on your API plan and appear on your [Account page](https://pulsedive.com/account).
### Plan-Based Limits
Rate limits vary based on your subscription tier, with higher plans offering increased capacity for production use.
* **Free accounts**: Basic limits with requests limited per second, day, and month.
* **[Pro API](https://pulsedive.com/about/pro)**: Increased limits suitable for individual professionals and hobbyists.
* **[Commercial API](https://pulsedive.com/about/api)**: Increased limits for commercial environments. Higher-tier plans have soft limits.
* **[Enterprise](https://pulsedive.com/about/enterprise)**: No rate limits.
### What are Soft Limits?
Soft limits don't block your requests with error codes.
However, if you consistently exceed your plan's limits, we may reach out about upgrading [your plan](https://pulsedive.com/about/api) or reducing your request frequency.
### Rate Limit Headers
Each response includes HTTP headers showing your remaining requests for each period:
```text theme={null}
X-Requests-Remaining-Second: 1
X-Requests-Remaining-Day: 9
X-Requests-Remaining-Month: 249
```
Missing headers indicate no rate limit for that time period.
Note that headers may not appear in `429` error responses, so check both headers and status codes to monitor your usage.
### Rate Limit Exceeded
When you exceed your limits, you receive an HTTP `429` status code along with a response like:
```json theme={null}
{
"error": "API rate limit exceeded: 1 requests per second. Visit pulsedive.com\\/api to view limits and upgrade your plan."
}
```
You'll also receive this error code when queries exceed other limits, such as the maximum result count for searches with the [`explore` endpoint](/api/explore/search) (varies by plan).
***
Ready to get started?
Check out our [Pro](https://pulsedive.com/about/pro) and [API](https://pulsedive.com/about/api) plans for higher limits, or dive into the endpoints.
# API Reference
Source: https://docs.pulsedive.com/api/overview
Access comprehensive threat intelligence through Pulsedive's API. Search indicators, scan for threats, retrieve feed data, and automate security workflows with the same endpoints that power our web interface.
## Welcome to the Pulsedive API!
The Pulsedive platform UI performs requests to the same endpoints you will access programmatically.
This means that in most cases, you can use the API to fetch the same data and perform the same functions as the [web interface](https://pulsedive.com/).
We have designed the API to be flexible and comprehensive, but if you have questions or need features we haven't covered yet, please [contact us](https://pulsedive.com/contact)!
## Endpoints
Direct all API requests to these paths:
[Look up threat intelligence for specific indicators](/api/indicator/overview/) like domains and IP addresses.
[Scan indicators](/api/scan/overview/) on-demand to gather threat intelligence without storing them permanently.
[Search across Pulsedive's database](/api/explore/overview/) using flexible queries to find indicators or threats that match your criteria.
[Get information about threats](/api/threat/overview/) like malware families, adversary groups, and campaigns.
[Access curated threat intelligence collections](/api/feed/overview/) from security organizations and research projects.
# Pagination
Source: https://docs.pulsedive.com/api/pagination
Retrieve large datasets efficiently with automatic page breaks.
* Pagination only applies when requesting linked indicators from threats or feeds. Other API endpoints do not use pagination.
* Page limits per request vary by plan:
* Free: 1
* Pro: 2
* Team: 4
* Business/Custom: 10
When working with large datasets, pagination helps you retrieve manageable chunks of data instead of overwhelming responses.
The Pulsedive API automatically breaks large result sets into pages when you request linked indicators from threats or feeds.
***
## How Pagination Works
When your request returns a large number of results, the Pulsedive API automatically splits the response into pages and includes helpful navigation fields:
* `page_current`: Shows which page you are currently viewing (starts at `0`)
* `page_next`: Tells you the next page number to request (only appears when more pages are available)
The first page of a paginated response looks like this:
```json theme={null}
{
"page_current": 0,
"page_next": 1,
"results": [
{
"iid": 918421,
"indicator": "185.220.100.255",
"type": "ip",
"risk": "low",
"stamp_linked": "2018-11-18 11:46:55",
"summary": {
"properties": {
...
}
}
},
...
]
}
```
If your results fit on a single page, you won't receive the `page_current` and `page_next` fields.
## Retrieving Additional Pages
To get the next page of results, make the same request and add a `page` parameter with the value from `page_next`.
Keep requesting subsequent pages until `page_next` disappears from the response—this means you have reached the end of the data.
Each pagination request counts toward your API rate limits.
Plan your requests accordingly when working with large datasets.
### Example Workflow
This walkthrough demonstrates how to retrieve all linked indicators from a feed using pagination.
This example uses these parameters:
```json theme={null}
{
"fid": "19",
"get": "links",
"pretty": "1",
"key": ""
}
```
Make a request to the [`feed.php` endpoint](/api/feed/get-by-id/):
```bash theme={null}
curl "https://pulsedive.com/api/feed.php \
?fid=19 \
&get=links \
&pretty=1 \
&key="
```
The results include `page_current` and `page_next` keys:
```json theme={null}
{
"page_current": 0,
"page_next": 1,
"results": [
{
"iid": 918421,
"indicator": "185.220.100.255",
"type": "ip",
"risk": "low",
"stamp_linked": "2018-11-18 11:46:55",
"summary": {
"properties": {
...
}
}
},
...
]
}
```
Using the `page_next` value, request the next page with the `page` parameter:
```json theme={null}
{
"fid": "19",
"get": "links",
"pretty": "1",
"key": "",
"page": "1"
}
```
```bash theme={null}
curl "https://pulsedive.com/api/feed.php \
?fid=19 \
&get=links \
&pretty=1 \
&page=1 \
&key="
```
When results are exhausted, only `page_current` appears:
```json theme={null}
{
"page_current": 2,
"results": [
{
"iid": 95352,
"indicator": "191.20.101.211",
"type": "domain",
"risk": "medium",
"stamp_linked": "2021-04-23 05:22:12",
"summary": {
"properties": {
...
}
}
},
...
]
}
```
***
## Troubleshooting
Find answers to common questions about working with paginated responses.
### Can I jump to a specific page?
While you can technically request any page number, we recommend following the sequence provided by `page_next`.
Skipping ahead or accessing pages out of order can lead to inconsistent results, especially if the dataset has changed between requests.
### Can I go back to a previous page?
Paging works in a forward direction only.
To start over, make your original request again (without a `page` parameter) to get page 0.
### How do I know when I've retrieved all the data?
You have reached the final page of results when the API response no longer includes a `page_next` value.
# Quickstart
Source: https://docs.pulsedive.com/api/quickstart
Jump into Pulsedive’s powerful threat intelligence. This quickstart guide walks you through getting your API key, authenticating your first request, and retrieving data--all in under five minutes. No fluff, all action.
## Before You Begin
To complete this quickstart, you will need:
* **An active Pulsedive account**: [Sign up for free!](https://pulsedive.com/register)
* A simple command-line tool like `curl` or your preferred HTTP client.
Although you can access our API without an API key, using an API key gives you higher rate limits and smoother access to Pulsedive’s data.
You can [find your API key](https://pulsedive.com/account) in your account dashboard.
***
## Fetch Indicator Data
Query the [`/indicator.php` endpoint](/api/indicator/overview/) by indicator value. This is one of the most common calls users make.
```bash theme={null}
curl "https://pulsedive.com/api/indicator.php \
?indicator=1.1.1.1 \
&pretty=1 \
&key="
```
You'll receive detailed threat intelligence on the indicator, including risk scores, associated threats, and detailed scan data.
***
## Use Explore to Search Across Data
Need to search across multiple indicators? Use the [`/explore.php` endpoint](/api/explore/overview/) with a query string.
```bash theme={null}
curl "https://pulsedive.com/api/explore.php \
?q=ioc=*evil* \
&limit=5 \
&pretty=1 \
&key="
```
This returns up to five results matching your pattern, including filtering options like risk, type, and threat.
To learn more about query syntax, operators, and wildcards, visit [Query Language](/api/explore/query-language/).
***
## Scan and Enrich an Indicator
Want deeper insight? Request enrichment and scoring for an indicator using the [`/analyze.php` endpoint](/api/scan/overview/).
Request enrichment and scoring for your indicator.
This tells Pulsedive to gather threat intelligence, generate insights, and perform risk scoring.
```bash theme={null}
# Scan for passive (non-intrusive) analysis
curl "https://pulsedive.com/api/analyze.php \
?value=evil.com \
&probe=0 \
&pretty=1 \
&key="
```
Passive scans (`probe=0`) collect data without direct contact (WHOIS, DNS).
You can also request an active scan (`probe=1`) for comprehensive intelligence, but with noisier, direct contact.
By default, Pulsedive performs enrichment on new indicators without saving the indicator.
To save it to Pulsedive's database, add `submit=1` to your request.
Existing indicators are always updated with fresh scan results.
You will receive a response like:
```json theme={null}
{
"success": "Added request to queue.",
"sid": 2100188,
"qids": [
{
"indicator": "evil.com",
"qid": 2100254203
}
]
}
```
Your request is added to the queue immediately, but processing happens asynchronously in the background.
Use the returned queue ID (`qid`) to check for results:
```bash theme={null}
curl "https://pulsedive.com/api/analyze.php \
?qid=123456 \
&pretty=1 \
&key="
```
***
## What's Next?
Once you're authenticated and have your first API responses:
* Dive deeper into indicators: Try [retrieving indicator links or properties](/api/indicator/get-links-properties/) or use the [`historical`](/api/indicator/get-by-value#parameter-historical) and [`schema`](/api/indicator/get-by-value#parameter-schema) parameters to customize your results.
* Explore other endpoints: Fetch [threat](/api/threat/get-by-name/) or [feed](/api/feed/get-by-name-organization/) data to expand your threat intelligence coverage.
* For smoother development, check out [community libraries](/libraries/).
# Responses
Source: https://docs.pulsedive.com/api/responses
Understand Pulsedive API response formats, HTTP status codes, and error handling.
The Pulsedive API returns consistent, predictable responses to help you build reliable integrations.
## Response Format
All API responses use JSON format for straightforward parsing and integration.
## Successful Responses
Successful requests return predictable patterns with clear status indicators.
When your request succeeds, you receive an HTTP `200` status code along with the requested data.
Many successful responses also include a `success` parameter, though this parameter doesn't appear across all endpoints.
## Error Responses
When requests fail, the API provides clear error messages to help you troubleshoot and resolve issues.
When something goes wrong, the API returns a JSON object with an `error` field explaining what happened.
For example, a request with these parameters:
```json title="GET request to /api/indicator.php with parameters" theme={null}
{
"iid": "-1",
"pretty": "1"
}
```
Returns this error:
```json title="404 Indicator not found" theme={null}
{
"error": "Indicator not found."
}
```
## HTTP Status Codes
The API uses standard HTTP conventions to communicate result outcomes.
### Success Codes
This code confirms your request completed successfully:
* `200`: Request succeeded and data is returned.
### Client Error Codes
These codes indicate issues with your request that you can resolve by adjusting parameters or authentication:
* `400`: Bad request. Review your parameters or request format.
* `401`: Unauthorized. Check your API key or permissions.
* `404`: Not found. The requested resource doesn't exist.
* `429`: [Rate limit](/api/limits/) exceeded. Wait before retrying or upgrade your plan for higher limits.
### Server Error Codes
These codes indicate temporary issues on our end that resolve automatically:
* `500`: Internal server error. We have been automatically notified and are investigating.
# Add Indicator to the Queue
Source: https://docs.pulsedive.com/api/scan/add
/api/scan-explore.yaml post /api/analyze.php
Add an indicator to the scanning queue and receive a queue ID, so you can poll for results.
# Poll for Scan Results
Source: https://docs.pulsedive.com/api/scan/poll
/api/scan-explore.yaml get /api/analyze.php
Poll for scan results using the queue ID returned from the POST request.
Returns processing status while the scan is in progress, then complete results when finished.
Polling requests don't count against your rate limit, but please poll responsibly. (We recommend at most every 500ms.)
# Get Threat by ID
Source: https://docs.pulsedive.com/api/threat/get-by-id
/api/threat/threat-by-id.yaml get /api/threat.php
Retrieve detailed threat intelligence information for a specific threat by looking up the threat's ID.
# Get Threat by Name
Source: https://docs.pulsedive.com/api/threat/get-by-name
/api/threat/threat-by-name.yaml get /api/threat.php
Retrieve detailed threat intelligence information for a specific threat by looking up the threat's name.
To query links, retrieve the threat by ID instead.
# Get Linked Indicators
Source: https://docs.pulsedive.com/api/threat/get-linked-indicators
/api/threat/threat-get-links.yaml get /api/threat.php
Retrieve indicators linked to a specific threat.
To create risk breakdowns, use the `summary` parameter with the `splitrisk` parameter. This will split out indicator counts by risk level.
# Pulsedive Documentation
Source: https://docs.pulsedive.com/index
Find everything you need to look up indicators, investigate threats, and integrate Pulsedive into your detection and response workflows.
## Understand the Data
Learn how Pulsedive ingests, enriches, and retires threat intelligence.
Understand the core objects — indicators, threats, and feeds — and how they relate.
## Query the API
Make your first API call in minutes.
Look up indicators, threats, and feeds; scan IOCs; and explore the Pulsedive dataset.
## Export Intelligence
Export large datasets as CSV or via TAXII for offline analysis and pipeline integration.
Consume Pulsedive data as STIX 2.1 objects over a TAXII 2.1 server.
## Integrate
Community-maintained client libraries for working with the Pulsedive API.
Highlight indicators and threat names on any webpage to enrich them with Pulsedive intelligence directly in your browser.
# Get API Roots
Source: https://docs.pulsedive.com/taxii/api-root/get
/taxii/api.yaml get /taxii2
Get information about available API roots and server capabilities.
# Get Collections
Source: https://docs.pulsedive.com/taxii/collection/get
/taxii/api.yaml get /taxii2/api/collections
Get information about all [available collections](/taxii/collection/overview#available-collections) in the API root.
Collections contain the STIX objects you can download from Pulsedive's TAXII server.
# Get Objects
Source: https://docs.pulsedive.com/taxii/object/get
/taxii/api.yaml get /taxii2/api/collections/{collectionID}/objects
Fetch STIX objects from a specific collection with optional filtering and pagination.