Skip to main content
GET

Authorizations

Authorization
string
header
required

Encode your credentials in the format taxii2:<YOUR_API_KEY> using Base64 and include them in the Authorization header. An API key is required for all requests.

Some tools require a username and password separately. Use taxii2 as the username and your API key as the password. The client will automatically encode this as taxii2:<YOUR_API_KEY> and convert to Base64.

If using Try It: Use the username/password method for HTTP Basic Authorization.

Headers

Accept
string

Media type used for content negotiation. Use application/taxii+json;version=2.1 for TAXII requests.

Standard method required by the TAXII specification. Use in production environments.

Path Parameters

collectionID
string
required

ID of the collection to query. Use one of the available collection IDs.

Query Parameters

accept
string
required

Media type used for content negotiation. Use application/taxii+json;version=2.1 for TAXII requests.

Specific to Pulsedive's implementation. Best for testing and debugging, manual API exploration, and simple curl commands. For production deployments, use HTTP Accept Header.

pretty
enum<integer>
default:0

Indicates whether to format returned JSON results.

For pretty-printed output, set to 1. For compact output, set to 0.

Available options:
0,
1
limit
integer
default:1000

Maximum number of results to return per page.

Used with Next Token pagination.

Required range: x <= 1000
next
string

Token that indicates the next set of results to retrieve. Should match the next token provided in the previous response.

Used with Next Token Pagination.

added_after
string<date-time>

Timestamp filter. Returns only objects added after the specified time. UTC (YYYY-MM-DDTHH:MM:SS.MMMZ) or Pulsedive (YYYY-MM-DD HH:MM:SS) format.

Used with Time-Based Pagination.

match[id]
string

Filter by specific STIX object ID(s). Supports comma-separated list for multiple IDs.

To learn more, visit Filtering.

Example:

"indicator--12345678-1234-5678-9012-123456789012"

match[spec_version]
string

Filter by STIX specification version(s). Supports comma-separated list for multiple versions.

To learn more, visit Filtering.

Example:

"2.1"

match[type]
string

Filter by STIX object type(s). Supports comma-separated list for multiple types.

For available STIX Domain Object types, see the STIX specification.

To learn more, visit Filtering.

Example:

"indicator"

match[version]
string

Filter by STIX object version(s). Supports comma-separated list for multiple versions.

Accepts keywords (first, last, all) or timestamps in STIX (YYYY-MM-DDTHH:MM:SS.MMMZ) or Pulsedive (YYYY-MM-DD HH:MM:SS) format. Pulsedive doesn't maintain object version history, so first, last, and all will return the latest object version.

To learn more, visit Filtering.

match[seen]
string<date-time>

Filter by last seen timestamp(s). Specific to Pulsedive's implementation.

Supports comma-separated list for multiple timestamps.

Accepts STIX (YYYY-MM-DDTHH:MM:SS.MMMZ) or Pulsedive (YYYY-MM-DD HH:MM:SS) timestamp format.

To learn more, visit Filtering.

match[risk]
enum<string>

Filter by risk level(s). Specific to Pulsedive's implementation.

Supports comma-separated list for multiple risk levels.

To learn more, visit Filtering.

Available options:
unknown,
none,
very low,
low,
medium,
high,
critical
match[itype]
enum<string>

Filter by indicator type(s). Specific to Pulsedive's implementation.

Supports comma-separated list for multiple types.

To learn more, visit Filtering.

Available options:
ip,
ipv6,
domain,
url
match[retired]
boolean

Filter by indicator status. Specific to Pulsedive's implementation.

For retired indicators, set to true. For active indicators, set to false.

To learn more, visit Filtering.

Response

Successful request. Returns object information in JSON format.

more
boolean

Indicates whether additional results are available. Use the next field to retrieve them. Used with pagination.

Example:

false

next
string

Pagination token for retrieving the next set of results. Only present when more is true. Used with pagination.

Example:

"2018-01-01 00:00:00|1000"

objects
(Pulsedive Indicator Extension · object | Extended STIX Indicator Properties · object)[]

Array of STIX 2.1 objects. The first two objects are always system objects, followed by query results:

  1. identity: Identifies the Pulsedive organization. Conforms to the STIX 2.1 specification for the STIX Identity Domain Object.

  2. extension-definition: Defines Pulsedive custom extended properties for the STIX Indicator Domain Object.

  3. Query results: STIX objects that conform to the STIX 2.1 specification.

    For indicators:

    For threats, the appropriate object: