API Reference

Look up an IOC

Perform an exact-match lookup of a single IOC value (domain, IP address, URL, or file hash) across the IOC feed and blog-derived IOC references, returning enrichment data when the value is known.

This endpoint shares the /v1/ioc collection path with Search IOCs; the two are selected by the query parameter you supply. Pass value for an exact lookup, or q for a substring search.

GET

/v1/ioc

Cost: 1 credit per successful call

Query parameters

valuestringrequired

The exact IOC value to look up (domain, IP address, URL, or file hash). Accepted range: 1–255 characters. This endpoint performs exact matching only; for substring search across 1M+ IOCs use Search IOCs.

Request

curl "https://api.edgeprotect.io/functions/v1/ioc?value=evil-azure-update.example" \
  -H "Authorization: Bearer $EDGEPROTECT_API_KEY"

Response

{
  "data": {
    "value": "evil-azure-update.example",
    "iocs": [
      {
        "id": 4819023,
        "ioc_type": "domain",
        "threat_type": "botnet_cc",
        "malware": "cobalt_strike",
        "malware_printable": "Cobalt Strike",
        "confidence_level": 90,
        "first_seen_utc": "2026-05-16T11:00:00Z",
        "last_seen_utc": "2026-05-27T03:14:00Z",
        "is_compromised": false,
        "tags": ["c2", "cobalt-strike"],
        "reporter": "community"
      }
    ],
    "blog_iocs": [
      {
        "blog_guid": "3f2a1b4c-9e8d-4a2b-b1c3-7d6e5f4a3b2c",
        "ioc_type": "domain",
        "context": "C2 domain used in Cobalt Strike campaign targeting financial sector",
        "confidence": 85,
        "verified": true,
        "false_positive": false,
        "created_at": "2026-05-17T08:00:00Z"
      }
    ],
    "blog_enrichment": [
      {
        "source": "threat_report",
        "data": {
          "threat_actors": ["FIN7"],
          "report_url": "https://example.com/cobalt-strike-campaign"
        },
        "created_at": "2026-05-17T08:05:00Z"
      }
    ],
    "generated_at": "2026-05-29T10:24:31.118Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

When the value is not found in any source, the call still succeeds and all three arrays are empty:

{
  "data": {
    "value": "not-a-known-ioc.example.com",
    "iocs": [],
    "blog_iocs": [],
    "blog_enrichment": [],
    "generated_at": "2026-05-29T10:24:31.118Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.valuestringoptional

The IOC value that was looked up, echoed back from the request.

data.iocsarrayoptional

Matching entries from the IOC feed. Empty when the value is unknown. Each object contains id, ioc_type, threat_type, malware, malware_printable, confidence_level (integer), first_seen_utc, last_seen_utc, is_compromised (boolean), tags (string array), and reporter.

data.blog_iocsarrayoptional

Blog-derived IOC references. Empty when none exist. Each object contains blog_guid, ioc_type, context, confidence (integer), verified (boolean), false_positive (boolean), and created_at.

data.blog_enrichmentarrayoptional

Additional enrichment records derived from blog reporting. Each object contains source, a free-form data object (which may include threat_actors and report_url), and created_at.

data.generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Status	`error`	When
400	`missing_query`	Neither `value` nor `q` was supplied.
400	`invalid_value`	`value` is empty or exceeds 255 characters.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route or entity does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.