Integrate, Automate, or Build; On Your Terms

Embed ready-made platform capabilities, automate partner operations at scale, or access raw intelligence data to power your own products, however your business model demands.

Get a demo

Standard APIs

For security teams

SOCRadar’s Standard APIs empower security teams to streamline operations by seamlessly integrating the platform-based intelligence from their licensed modules directly into their existing technical ecosystem.

GET /v2/company/incidents?severity=critical

200 OK · 184 ms

"is_success": true,
"total": 3,
"data": [
  "alarm_id": 48210377,
  "severity": "CRITICAL",
  "title": "Exposed RDP on 3 public IPs",
  "status": "OPEN"
]

Unified Visibility

Connect your existing security toolchain (e.g., SIEM/SOAR, TIP, EDR, firewalls, and ticketing systems) to SOCRadar platform data and alerts to centralize operations.
Accelerated Response

Automate the transfer of critical alarms into ticketing workflows, significantly reducing Mean-Time-to-Respond (MTTR) by removing manual data entry.
Operational Efficiency

Eliminate the need for daily manual dashboard checks by programmatically ingesting real-time data from your active modules (ASM, Dark Web Monitoring, etc.).
Streamlined Access

Enable Standard APIs via a single API key, with access automatically configured based on the platform modules licensed by your organization.

API Name	Description
ASM Vulnerabilities API	Returns vulnerability information for assets across your attack surface. Provides: Vulnerability details, CVSS scores, asset associations, CVE information
ASM Digital Footprint API	Provides digital footprint analysis for attack surface management. Provides: Asset discovery and relationship data, digital footprint insights
Brand Protection API	Returns alerts related to brand presence across digital channels. Provides: Brand impersonation alerts, phishing sites, malicious domains, rogue mobile apps, brand abuse incidents.
Dark Web Monitoring API	Provides platform dark web monitoring results. Provides: Dark web mentions, threat actor discussions, leaked credentials, illicit marketplace data
DRP Fraud Protection API	Delivers fraud protection insights. Provides: Fraud indicators, suspicious activities, fraudulent credit cards, BIN analysis
Incident API	Manages security incidents. Provides: Incident details, status tracking, incident lifecycle management, response actions
Referer Log API	Provides access to referer logs. Provides: HTTP referer data, traffic sources, web access patterns
Surface Web Monitoring API	Delivers surface web monitoring results. Provides: Public web mentions, brand monitoring, website activity, surface web threats
Takedown API	Manages and tracks takedown requests. Provides: Takedown request status, removal actions, takedown history, success rates
Collection Based IOC Feed API	Provides access to threat feed indicators of compromise. Provides: IOC collections, threat indicators (IPs, domains, hashes), feed metadata, confidence scores
VIP Protection API	Provides VIP protection monitoring results. Provides: Executive threat intelligence, VIP credential leaks, targeted threats against key personnel
Company Events API	Retrieves data associated with company events and activities. Provides: Event logs, operational activities, system events, user actions
Company User Audit Logs API	Delivers user audit logs and associated data. Provides: User activity tracking, login history, configuration changes, audit trail
Company Identity (User) Management API	Manages company users. Provides: User accounts, permissions, role management, identity administration
Company Pocket API	Retrieves company pocket feed data. Provides: Curated threat intelligence, saved feeds, custom collections
CTI Threat Hunting Rules API	Provides threat hunting rules and query capabilities. Provides: Threat hunting rules, search queries, detection patterns, investigation results
CTI Allowlist API	Provides allowlist information for false positive suppression. Provides: Whitelisted IPs, domains, hashes, trusted entities, allowlist management
DRP Configuration API	Manages DRP configuration assets. Provides: Asset configurations, monitoring settings, DRP asset details, approval workflows

Advanced APIs

For MSSPs, vendors & mature enterprises

SOCRadar’s Advanced APIs deliver high-fidelity, raw threat intelligence designed for MSSPs, security vendors, and mature enterprises requiring specialized, large-scale data integration. This suite of endpoints extends beyond the platform’s standard data, providing direct feed access to large threat intelligence datasets.

With a flexible, credit-based consumption model, these APIs allow you to ingest only the precise datasets needed for your specific use cases, ensuring an efficient, scalable, and cost-effective integration solution.

GET /v2/feeds/ransomware-intelligence?limit=50

200 OK · credits_used: 1

"is_success": true,
"total": 50,
"data": [
  "threat_actor": "ALPHV",
  "victim_sector": "Finance",
  "ioc_count": 214,
  "first_seen": "2026-08-11T21:04:56Z"
]

Advanced CTI Use Cases

Support threat hunting, investigation, and deep analysis through direct access to specialized CTI feeds that extend beyond basic platform data and alerts.
Enhanced Flexibility

Select only the specific API endpoints you need (e.g., Ransomware Intelligence, Advanced Phishing), eliminating the cost and processing overhead of irrelevant datasets.
Scalable Service Delivery for Vendors

Empower MSPs/MSSPs and cybersecurity vendors to embed raw SOCRadar data directly into their own service portfolios or dashboards to serve hundreds of end-clients efficiently.
Flexible Consumption

Utilize a licensing model adapted to high-volume integration, with options for credit-based querying or specific API bundles that scale with your data usage rather than user seat counts.

API Name	Description
Threat Actor Malware API	Retrieves malware associated with threat actors and ransomware groups. Provides: Malware families, threat actor TTPs, ransomware group intelligence, behavioral analysis
Threat Analysis API	Performs comprehensive threat analysis with automated trust scoring. Provides: Trust scores (0-100), entity risk assessment, multi-source intelligence correlation, threat classification
Malware Analysis API	Analyzes malware samples and behaviors. Provides: Malware signatures, behavioral patterns, file hashes, detection rates, malware classification.
CTI Threat Hunting Rules API	Provides threat hunting rules for proactive detection. Provides: Detection rules, hunting patterns, MITRE ATT&CK mappings, rule metadata.
CTI Threat Investigating API	Provides deep-dive analysis of threats, actors, and campaigns with detailed contextual information. Provides: Real-time threat actor tracking, campaign analysis, IOC enrichment, behavioral analysis, attribution, malware analysis
Identity Access Intelligence API	Provides intelligence on identity-related threats. Provides: Identity compromise data, access patterns, credential analysis, privileged account monitoring
Ransomware News (Victims) API	Retrieves information about ransomware incidents and victims. Provides: Ransomware victim details, attack timelines, data leak information, ransom demands, threat actor activity
CTI Vulnerability Intelligence API	Delivers comprehensive intelligence on vulnerabilities. Provides: CVE details, CVSS/EPSS/SVRS scores, exploit availability, patch information, vulnerability trends
IoC Enrichment API	Provides IOC enrichment capabilities. Provides: Enhanced IOC context, additional metadata, threat intelligence enrichment, relationships
CTI Dark Web News API	Provides dark web news and intelligence feeds. Provides: Dark web forum posts, threat actor discussions, emerging threats, underground market intelligence
CTI Threat Feed API	Enables access to aggregated open-source intelligence (OSINT) and threat data with filtering capabilities. Provides: Real-time OSINT threat indicators, feed metadata, IOC types (IP, domain, hash, URL), threat scores, categories
CTI Source Code Leakage API	Provides source code leakage information from public repositories. Provides: Exposed credentials in code, API keys, tokens, commit history, repository details, author information
CTI Rapid Reputation API	Provides rapid reputation information for entities. Provides: Entity reputation scores, trust indicators, threat classifications, historical reputation data
Advanced Fraud Detection API	Provides advanced fraud detection capabilities for financial transactions. Provides: Fraudulent credit card data, BIN analysis, fraud patterns, card validation, discovery history
Combolists API (Add-on)	Provides comprehensive credential breach data (recommended for e-commerce and banking customers) Provides: Credential combinations (e.g. email/password), breach sources, leak timestamps, affected domains
Premium Feeds API (Add-on)	Access to curated, analyst validated premium threat intelligence feeds with IOCs derived from commercial sources, private honeypots, sector-specific monitoring, and direct partnerships. Provides: Commercial and privately sourced data, Deep metadata including: threat actor, malware family, first seen, last seen, CVE associations, geolocation, TTP linkage, threat feed categories on industry, region and threat types.

Multi-Tenant Management APIs

For partners & platform operators

The SOCRadar Multi-Tenant API delivers complete programmatic control over the entire tenant lifecycle. Designed to automate routine operations, it allows engineering and operations teams to dynamically handle customer onboarding, license tiering, RBAC policies, and ecosystem structuring via standard API endpoints. Eliminate manual configuration drift, ensure consistent policy deployment, and manage thousands of customer accounts through a single, automated control plane.

POST /v2/tenants

201 Created · 96 ms

"is_success": true,
"tenant": [
  "tenant_id": "tn_8f31c2",
  "license_tier": "MSSP_PRO",
  "users_provisioned": 12,
  "status": "ACTIVE"
]

Zero-Touch Lifecycle Management

Automate the complete client lifecycle by programmatically provisioning, updating, and archiving tenant companies in seconds without manual portal configuration.
Flexible Packaging & Licensing

Dynamically configure SKUs, manage feature permissions, and extend subscriptions to tailor service tiers to each client’s contract level.
Dynamic Ecosystem Control

Easily create client ecosystems and seamlessly move accounts between groups to maintain structured governance across complex partner and client portfolios.
Granular Access & Identity Governance

Programmatically assign roles, update permissions, and manage user access across multiple tenants to enforce least-privilege policies and accelerate analyst onboarding.
Seamless Multi-Tenant Operations

Eliminate manual administrative drag to scale operations, onboard new clients faster, and reduce margin-killing configuration errors.

API Name	Description
Provisioning Multi-Tenant Company Management API	Provides full lifecycle management for companies within a token-based multi-tenant environment. Provides: Programmatic onboarding, configuration, and management of customer organizations across multi-tenant environments
Provisioning Multi-Tenant Ecosystem Management API	Allows operators to organize companies into logical groupings called ecosystems Provides: A structural layer between the top-level multi-tenant system and individual companies, enabling segmentation by region, industry, customer tier, or any other business classification.
Provisioning Multi-Tenant User Management API	Provides control over user accounts within a multi-tenant environment Provides: Operators to create users, manage their assignments across companies, and control roles and access rights
Provisioning Multi-Tenant Incident Management API	Enables operators to retrieve and monitor security findings across all companies from a single endpoint Provides: A unified view of alarms detected across the multi-tenant hierarchy, with rich filtering capabilities for cross-tenant incident management workflows.

Why Choose SOCRadar APIs

Access Massive, Curated Threat Datasets

Tap into intelligence built from millions of data points across the surface, deep, and dark web, pre-processed and correlated, so your team isn’t starting from raw noise.
Integrate at Any Level, On Your Terms

Choose how deep you go: embed ready-made platform intelligence, automate partner operations at scale, or access raw data to build your own models and features.
Scale Without Manual Overhead

Provision tenants, manage licenses, and configure settings programmatically; eliminating the back-office work that slows partners and MSSPs down as they grow.
Build on Real-Time Intelligence

Get continuously updated threat data, not static feeds. Your SIEM, SOAR, or custom workflows always act on current, not stale, intelligence.
Trust Enterprise-Grade Reliability

Rely on an API infrastructure built to support MSSPs, OEM partners, and enterprise security teams operating at scale, with the uptime and support your operations depend on.