<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Implementing Threat Feed Aggregation

## abuse.ch URLhaus API

**Base URL:** `https://urlhaus-api.abuse.ch/v1/`

### Recent URLs
```bash
curl -X GET https://urlhaus-api.abuse.ch/v1/urls/recent/ | jq '.urls[:5]'
```

### Query URL
```bash
curl -X POST https://urlhaus-api.abuse.ch/v1/url/ \
  -d '{"url":"http://evil.example/payload.exe"}'
```

### Query Host
```bash
curl -X POST https://urlhaus-api.abuse.ch/v1/host/ -d '{"host":"evil.example"}'
```

## ThreatFox API

**Base URL:** `https://threatfox-api.abuse.ch/api/v1/`

### Recent IOCs
```bash
curl -X POST https://threatfox-api.abuse.ch/api/v1/ \
  -d '{"query":"get_iocs","days":7}'
```

### Search IOC
```bash
curl -X POST https://threatfox-api.abuse.ch/api/v1/ \
  -d '{"query":"search_ioc","search_term":"evil.com"}'
```

## AlienVault OTX API

**Base URL:** `https://otx.alienvault.com/api/v1/`

### Get Subscribed Pulses
```bash
curl -H "X-OTX-API-KEY: KEY" \
  "https://otx.alienvault.com/api/v1/pulses/subscribed?modified_since=2026-03-01"
```

### Get Pulse Details
```bash
curl -H "X-OTX-API-KEY: KEY" \
  https://otx.alienvault.com/api/v1/pulses/PULSE_ID
```

### Domain Indicators
```bash
curl -H "X-OTX-API-KEY: KEY" \
  https://otx.alienvault.com/api/v1/indicators/domain/evil.com/general
```

## PhishTank API

### Check URL
```bash
curl -X POST https://checkurl.phishtank.com/checkurl/ \
  -d "url=http://suspect.example&format=json&app_key=KEY"
```

## Feed Format Reference

| Feed | Format | Auth | Refresh |
|------|--------|------|---------|
| URLhaus | JSON REST | None | 5 min |
| ThreatFox | JSON REST | None | Hourly |
| OTX | JSON REST | API Key | Hourly |
| PhishTank | JSON REST | API Key | Hourly |
| CISA AIS | TAXII 2.1 | Certificate | Daily |
| Feodo Tracker | CSV/JSON | None | 5 min |
