Live try-out
Run endpoints from the page with your token.
API OpenAPI schema and Swagger UI
REST API
Endpoints for token status and scopes, hunting rules, IoC lists and IP feed lists; authentication with a bearer token and company ID header, pagination and bulk download.
Screenshots are taken from a demo tenant; organisation names and data are entirely fictional.
The documentation page groups endpoints by module and gives runnable cURL examples. Paste a token and every request on the page goes out exactly as an external integration would send it; the token stays in the browser tab and is never written to disk. The tokens/scopes endpoint explains why a call returned 403.
What it does
Bulk download
Rules come as filtered zips, lists as TXT/JSON.
Scope explanation
Each endpoint's required scope and the reason for a 403 can be queried.
What you get
- Integrations are built from documentation, not trial and error.
- SOAR playbooks pull data directly.
- Rules and lists stay current through automation.
Other modules
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.