Integrate, Automate, or Build; On Your Terms
Embed ready-made platform capabilities, automate partner operations at scale, or access raw intelligence data to power your own products, however your business model demands.
Get a demoFor security teams
Standard APIs
SOCRadar’s Standard APIs empower security teams to streamline operations by seamlessly integrating the platform-based intelligence from their licensed modules directly into their existing technical ecosystem.
GET /v2/company/incidents?severity=critical 200 OK · 184 ms { "is_success": true, "total": 3, "data": [ { "alarm_id": 48210377, "severity": "CRITICAL", "title": "Exposed RDP on 3 public IPs", "status": "OPEN" } ] }
Unified Visibility
Connect your existing security toolchain (e.g., SIEM/SOAR, TIP, EDR, firewalls, and ticketing systems) to SOCRadar platform data and alerts to centralize operations.
Accelerated Response
Automate the transfer of critical alarms into ticketing workflows, significantly reducing Mean-Time-to-Respond (MTTR) by removing manual data entry.
Operational Efficiency
Eliminate the need for daily manual dashboard checks by programmatically ingesting real-time data from your active modules (ASM, Dark Web Monitoring, etc.).
Streamlined Access
Enable Standard APIs via a single API key, with access automatically configured based on the platform modules licensed by your organization.
ASM Vulnerabilities API
Returns vulnerability information for assets across your attack surface.
Provides: Vulnerability details, CVSS scores, asset associations, CVE information
ASM Digital Footprint API
Provides digital footprint analysis for attack surface management.
Provides: Asset discovery and relationship data, digital footprint insights
Brand Protection API
Returns alerts related to brand presence across digital channels.
Provides: Brand impersonation alerts, phishing sites, malicious domains, rogue mobile apps, brand abuse incidents
Dark Web Monitoring API
Provides platform dark web monitoring results.
Provides: Dark web mentions, threat actor discussions, leaked credentials, illicit marketplace data
DRP Fraud Protection API
Delivers fraud protection insights.
Provides: Fraud indicators, suspicious activities, fraudulent credit cards, BIN analysis
Incident API
Manages security incidents.
Provides: Incident details, status tracking, incident lifecycle management, response actions
Referer Log API
Provides access to referer logs.
Provides: HTTP referer data, traffic sources, web access patterns
Surface Web Monitoring API
Delivers surface web monitoring results.
Provides: Public web mentions, brand monitoring, website activity, surface web threats
Takedown API
Manages and tracks takedown requests.
Provides: Takedown request status, removal actions, takedown history, success rates
Collection Based IOC Feed API
Provides access to threat feed indicators of compromise.
Provides: IOC collections, threat indicators (IPs, domains, hashes), feed metadata, confidence scores
VIP Protection API
Provides VIP protection monitoring results.
Provides: Executive threat intelligence, VIP credential leaks, targeted threats against key personnel
Company Events API
Retrieves data associated with company events and activities.
Provides: Event logs, operational activities, system events, user actions
Company User Audit Logs API
Delivers user audit logs and associated data.
Provides: User activity tracking, login history, configuration changes, audit trail
Company Identity (User) Management API
Manages company users.
Provides: User accounts, permissions, role management, identity administration
Company Pocket API
Retrieves company pocket feed data.
Provides: Curated threat intelligence, saved feeds, custom collections
CTI Threat Hunting Rules API
Provides threat hunting rules and query capabilities.
Provides: Threat hunting rules, search queries, detection patterns, investigation results
CTI Allowlist API
Provides allowlist information for false positive suppression.
Provides: Whitelisted IPs, domains, hashes, trusted entities, allowlist management
DRP Configuration API
Manages DRP configuration assets.
Provides: Asset configurations, monitoring settings, DRP asset details, approval workflows
For MSSPs, vendors & mature enterprises
Advanced APIs
SOCRadar’s Advanced APIs deliver high-fidelity, raw threat intelligence designed for MSSPs, security vendors, and mature enterprises requiring specialized, large-scale data integration. This suite of endpoints extends beyond the platform’s standard data, providing direct feed access to large threat intelligence datasets.
With a flexible, credit-based consumption model, these APIs allow you to ingest only the precise datasets needed for your specific use cases, ensuring an efficient, scalable, and cost-effective integration solution.
GET /v2/feeds/ransomware-intelligence?limit=50 200 OK · credits_used: 1 { "is_success": true, "total": 50, "data": [ { "threat_actor": "ALPHV", "victim_sector": "Finance", "ioc_count": 214, "first_seen": "2026-08-11T21:04:56Z" } ] }
Advanced CTI Use Cases
Support threat hunting, investigation, and deep analysis through direct access to specialized CTI feeds that extend beyond basic platform data and alerts.
Enhanced Flexibility
Select only the specific API endpoints you need (e.g., Ransomware Intelligence, Advanced Phishing), eliminating the cost and processing overhead of irrelevant datasets.
Scalable Service Delivery for Vendors
Empower MSPs/MSSPs and cybersecurity vendors to embed raw SOCRadar data directly into their own service portfolios or dashboards to serve hundreds of end-clients efficiently.
Flexible Consumption
Utilize a licensing model adapted to high-volume integration, with options for credit-based querying or specific API bundles that scale with your data usage rather than user seat counts.
Threat Actor Malware API
Retrieves malware associated with threat actors and ransomware groups.
Provides: Malware families, threat actor TTPs, ransomware group intelligence, behavioral analysis
Threat Analysis API
Performs comprehensive threat analysis with automated trust scoring.
Provides: Trust scores (0-100), entity risk assessment, multi-source intelligence correlation, threat classification
Malware Analysis API
Analyzes malware samples and behaviors.
Provides: Malware signatures, behavioral patterns, file hashes, detection rates, malware classification
CTI Threat Hunting Rules API
Provides threat hunting rules for proactive detection.
Provides: Detection rules, hunting patterns, MITRE ATT&CK mappings, rule metadata
CTI Threat Investigating API
Provides deep-dive analysis of threats, actors, and campaigns with detailed contextual information.
Provides: Real-time threat actor tracking, campaign analysis, IOC enrichment, behavioral analysis, attribution, malware analysis
Identity Access Intelligence API
Provides intelligence on identity-related threats.
Provides: Identity compromise data, access patterns, credential analysis, privileged account monitoring
Ransomware News (Victims) API
Retrieves information about ransomware incidents and victims.
Provides: Ransomware victim details, attack timelines, data leak information, ransom demands, threat actor activity
CTI Vulnerability Intelligence API
Delivers comprehensive intelligence on vulnerabilities.
Provides: CVE details, CVSS/EPSS/SVRS scores, exploit availability, patch information, vulnerability trends
IoC Enrichment API
Provides IOC enrichment capabilities.
Provides: Enhanced IOC context, additional metadata, threat intelligence enrichment, relationships
CTI Dark Web News API
Provides dark web news and intelligence feeds.
Provides: Dark web forum posts, threat actor discussions, emerging threats, underground market intelligence
CTI Threat Feed API
Enables access to aggregated open-source intelligence (OSINT) and threat data with filtering capabilities.
Provides: Real-time OSINT threat indicators, feed metadata, IOC types (IP, domain, hash, URL), threat scores, categories
CTI Source Code Leakage API
Provides source code leakage information from public repositories.
Provides: Exposed credentials in code, API keys, tokens, commit history, repository details, author information
CTI Rapid Reputation API
Provides rapid reputation information for entities.
Provides: Entity reputation scores, trust indicators, threat classifications, historical reputation data
Advanced Fraud Detection API
Provides advanced fraud detection capabilities for financial transactions.
Provides: Fraudulent credit card data, BIN analysis, fraud patterns, card validation, discovery history
Combolists API (Add-on)
Provides comprehensive credential breach data (recommended for e-commerce and banking customers).
Provides: Credential combinations (e.g., email/password), breach sources, leak timestamps, affected domains
Premium Feeds API (Add-on)
Access to curated, analyst-validated premium threat intelligence feeds with IOCs derived from commercial sources, private honeypots, sector-specific monitoring, and direct partnerships.
Provides: Commercial and privately sourced data, deep metadata including: threat actor, malware family, first seen, last seen, CVE associations, geolocation, TTP linkage, threat feed categories on industry, region and threat types
For partners & platform operators
Multi-Tenant Management APIs
The SOCRadar Multi-Tenant API delivers complete programmatic control over the entire tenant lifecycle. Designed to automate routine operations, it allows engineering and operations teams to dynamically handle customer onboarding, license tiering, RBAC policies, and ecosystem structuring via standard API endpoints. Eliminate manual configuration drift, ensure consistent policy deployment, and manage thousands of customer accounts through a single, automated control plane.
POST /v2/tenants 201 Created · 96 ms { "is_success": true, "tenant": { "tenant_id": "tn_8f31c2", "license_tier": "MSSP_PRO", "users_provisioned": 12, "status": "ACTIVE" } }
Zero-Touch Lifecycle Management
Automate the complete client lifecycle by programmatically provisioning, updating, and archiving tenant companies in seconds without manual portal configuration.
Flexible Packaging & Licensing
Dynamically configure SKUs, manage feature permissions, and extend subscriptions to tailor service tiers to each client’s contract level.
Dynamic Ecosystem Control
Easily create client ecosystems and seamlessly move accounts between groups to maintain structured governance across complex partner and client portfolios.
Granular Access & Identity Governance
Programmatically assign roles, update permissions, and manage user access across multiple tenants to enforce least-privilege policies and accelerate analyst onboarding.
Seamless Multi-Tenant Operations
Eliminate manual administrative drag to scale operations, onboard new clients faster, and reduce margin-killing configuration errors.
Provisioning Multi-Tenant Company Management API
Provides full lifecycle management for companies within a token-based multi-tenant environment.
Provides: Programmatic onboarding, configuration, and management of customer organizations across multi-tenant environments
Provisioning Multi-Tenant Ecosystem Management API
Allows operators to organize companies into logical groupings called ecosystems.
Provides: A structural layer between the top-level multi-tenant system and individual companies, enabling segmentation by region, industry, customer tier, or any other business classification
Provisioning Multi-Tenant User Management API
Provides control over user accounts within a multi-tenant environment.
Provides: Operators to create users, manage their assignments across companies, and control roles and access rights
Provisioning Multi-Tenant Incident Management API
Enables operators to retrieve and monitor security findings across all companies from a single endpoint.
Provides: A unified view of alarms detected across the multi-tenant hierarchy, with rich filtering capabilities for cross-tenant incident management workflows
Why Choose SOCRadar APIs
Access Massive, Curated Threat Datasets
Tap into intelligence built from millions of data points across the surface, deep, and dark web, pre-processed and correlated, so your team isn’t starting from raw noise.
Integrate at Any Level, On Your Terms
Choose how deep you go: embed ready-made platform intelligence, automate partner operations at scale, or access raw data to build your own models and features.
Scale Without Manual Overhead
Provision tenants, manage licenses, and configure settings programmatically, eliminating the back-office work that slows partners and MSSPs down as they grow.
Build on Real-Time Intelligence
Get continuously updated threat data, not static feeds. Your SIEM, SOAR, or custom workflows always act on current, not stale, intelligence.
Trust Enterprise-Grade Reliability
Rely on an API infrastructure built to support MSSPs, OEM partners, and enterprise security teams operating at scale, with the uptime and support your operations depend on.
