<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Threat Feed Aggregation

## abuse.ch Feeds

### URLhaus — Recent URLs
```bash
curl "https://urlhaus-api.abuse.ch/v1/urls/recent/"
```

### URLhaus — Query URL
```bash
curl -X POST "https://urlhaus-api.abuse.ch/v1/url/" \
  -d "url=https://evil.com/payload"
```

### Feodo Tracker — Recommended Blocklist
```bash
curl "https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.json"
```

### ThreatFox — Recent IOCs
```bash
curl -X POST "https://threatfox-api.abuse.ch/api/v1/" \
  -H "Content-Type: application/json" \
  -d '{"query":"get_iocs","days":1}'
```

### SSL Blacklist
```bash
curl "https://sslbl.abuse.ch/blacklist/sslblacklist.csv"
```

## AlienVault OTX

**Base URL:** `https://otx.alienvault.com/api/v1`

### List Subscribed Pulses
```bash
curl -H "X-OTX-API-KEY: $OTX_KEY" \
  "https://otx.alienvault.com/api/v1/pulses/subscribed"
```

### Get Pulse Indicators
```bash
curl -H "X-OTX-API-KEY: $OTX_KEY" \
  "https://otx.alienvault.com/api/v1/pulses/PULSE_ID/indicators"
```

### Search Pulses
```bash
curl -H "X-OTX-API-KEY: $OTX_KEY" \
  "https://otx.alienvault.com/api/v1/search/pulses?q=apt29"
```

## PhishTank

### Check URL
```bash
curl -X POST "https://checkurl.phishtank.com/checkurl/" \
  -d "url=https://suspicious.com&format=json&app_key=$PHISHTANK_KEY"
```

### Download Database
```bash
curl "http://data.phishtank.com/data/$PHISHTANK_KEY/online-valid.json.bz2" \
  --output phishtank.json.bz2
```

## MISP Feed Configuration

### Add Feed via API
```bash
curl -X POST "$MISP_URL/feeds/add" \
  -H "Authorization: $MISP_KEY" \
  -d '{
    "Feed": {
      "name": "abuse.ch URLhaus",
      "provider": "abuse.ch",
      "url": "https://urlhaus.abuse.ch/feeds/",
      "source_format": "csv",
      "enabled": true,
      "caching_enabled": true
    }
  }'
```

### Fetch All Feeds
```bash
curl -X GET "$MISP_URL/feeds/fetchFromAllFeeds" \
  -H "Authorization: $MISP_KEY"
```

## Environment Variables

| Variable | Description |
|----------|-------------|
| `OTX_API_KEY` | AlienVault OTX API key |
| `PHISHTANK_KEY` | PhishTank API key |
| `MISP_URL` | MISP instance URL |
| `MISP_KEY` | MISP automation key |
