Playground API
Console API
Préparez une requête. Inspectez la réponse.
ismalicious / playground
Sans clé API
inactifCtrl / ⌘ + Enter
Référence API
Explorez tous les endpoints et les exemples de code.
Deux serveurs :
api.ismalicious.com pour la plupart des routes, ismalicious.com/api pour /analyze, téléphone, crypto et e-mail. Choisissez le bon avant « Try it ». Exemples rédigés : documentation API.Référence
Tous les endpoints appelables depuis ce playground
89 opérations réparties en 21 groupes, générées depuis isMalicious - Threat Intelligence API v1.2.0 — le document OpenAPI que charge la référence interactive ci-dessus.
- Production server
- https://api.ismalicious.com
- Next.js web API (analyze / phone / crypto / email)
- https://ismalicious.com/api
- En-tête d’authentification
- X-API-KEY
| Méthode | Endpoint | Rôle |
|---|---|---|
| monitoring— Watch ownership and authenticated monitoring | ||
| POST | /monitoring/claim-pending | Verified pending watches transferred, possibly partially |
| check— Threat intelligence check endpoints for IPs, domains, URLs, and file hashes | ||
| GET | /bulk/check | Bulk check limits and usage |
| POST | /bulk/check | Bulk entity check |
| GET | /check | Full Threat Analysis |
| GET | /check/certificates | Check Certificates |
| GET | /check/location | Check Geolocation |
| POST | /check/password | Breach exposure of a password, checked as an indicator. |
| GET | /check/reputation | Check Reputation |
| GET | /check/stream | Report stream (SSE) |
| GET | /check/tenant | Microsoft 365 tenant |
| GET | /check/vulnerabilities | Check Vulnerabilities |
| GET | /check/whois | Check WHOIS |
| POST | /indicator-context | Existing evidence with optional, separately metered context qualification |
| GET | /pwned-passwords/range/{prefix} | k-anonymity lookup in Have I Been Pwned's Pwned Passwords corpus. |
| search— Search for similar malicious domains | ||
| POST | /search | Search Keywords |
| blocklist— Download blocklists and read their generation stats | ||
| GET | /blocklist/download/{filename} | Download Blocklist |
| GET | /blocklist/stats | Get Blocklist Stats |
| GET | /edl/cve/{id} | Indicators tagged with one CVE |
| GET | /edl/exploited-cves | Indicators of every CVE exploited in the last 7 days |
| submit— Submit new threat intelligence sources | ||
| POST | /submit | Submit Sources |
| gate— isinjected gate: prompt-injection scanning and link reputation for AI agents (own scan meter) | ||
| GET | /gate/quota | GET /gate/quota |
| POST | /gate/scan | POST /gate/scan |
| GET | /gate/url | GET /gate/url?u= |
| mail— Inbound-message scan: what a mail's structure and the dataset say about it (gate scan meter, one unit per message) | ||
| POST | /mail/scan | POST /mail/scan |
| platform— Dataset freshness and data-ops pipeline status | ||
| GET | /platform/data-freshness | Dataset freshness, version, and SLA status |
| GET | /platform/data-ops/pipeline | Data operations pipeline phases and last recorded run |
| cases— SOC case workspace: cases and their evidence timeline | ||
| GET | /cases | Case workspace list, wrapped as `{"cases": […]}` |
| POST | /cases | Created case |
| PATCH | /cases/{id} | Updated case |
| POST | /cases/{id}/evidence | Updated case with appended evidence |
| action-center— Prioritized SOC action queue | ||
| GET | /action-center/overview | Prioritized SOC action center overview |
| alerts— Alerting trends and metrics | ||
| GET | /alerts/trends | Opened/resolved per day plus MTTR percentiles for the signed-in scope |
| webhooks— Webhook event catalog | ||
| GET | /user/webhooks/events | Supported webhook events, signature scheme, and management path |
| briefs— Executive risk briefs | ||
| GET | /risk-brief/latest | Latest organization risk brief summary |
| trust— Trust assessment contract | ||
| GET | /trust/assessment/schema | Canonical trust assessment field contract |
| taxii— TAXII 2.1 / STIX 2.1 threat-intelligence feed (Pro and Enterprise). Never decrements the monthly request quota | ||
| GET | /taxii | TAXII discovery |
| GET | /taxii/api-root | TAXII API root |
| GET | /taxii/api-root/collections | List TAXII collections |
| GET | /taxii/api-root/collections/{collectionId} | Get a TAXII collection |
| GET | /taxii/api-root/collections/{collectionId}/manifest | Get object manifests |
| GET | /taxii/api-root/collections/{collectionId}/objects | Get collection objects |
| POST | /taxii/api-root/collections/{collectionId}/objects | Add objects (refused) |
| GET | /taxii/api-root/collections/{collectionId}/objects/{objectId} | Get an object |
| GET | /taxii/api-root/collections/{collectionId}/objects/{objectId}/versions | Get object versions |
| GET | /taxii/api-root/status/{statusId} | Get status |
| stats— Public dataset statistics — no authentication, not metered | ||
| GET | /stats | Public dataset statistics |
| cve— CVE catalog: lookup by id, search and recent list (authenticated, one request each) and public statistics (EPSS, exploitation signals, time series — no authentication, not metered) | ||
| GET | /cve | CVE lookup, search and recent list |
| GET | /cve/{id} | CVE by id (path form) |
| GET | /cve/{id}/affected | Am I affected? — a version or a domain checked against one CVE, without an account. Without `product`/`version`/`domain` it returns the affected products and their branches (the CVE page's picker and « versions per branch » data). |
| GET | /cve/{id}/indicators | Indicators tagged with a CVE |
| GET | /cve/exploited | CVEs exploited in the last N days |
| GET | /cve/recent | Recent CVEs (bare array) |
| GET | /cve/stats/epss | CVE EPSS statistics |
| GET | /cve/stats/timeseries | CVE time series |
| ransomware— Ransomware intelligence from the cached ransomware.live datasets: victims, groups, sectors, press. Authenticated, one request each except `/ransomware/live-quota` | ||
| GET | /ransomware/feed | Recent ransomware victims |
| GET | /ransomware/group-profile | Ransomware group profile |
| GET | /ransomware/groups | Ransomware groups |
| GET | /ransomware/live-quota | ransomware.live call budget |
| GET | /ransomware/press | Ransomware press |
| GET | /ransomware/sector-risk | Sector risk |
| GET | /ransomware/sector-risk/history | Sector risk history |
| GET | /ransomware/sector-victims | Sector victims |
| GET | /ransomware/stats | Ransomware statistics |
| surveillance— Vulnerability monitoring of the organisation's stack: watched sources (a domain, a lockfile/SBOM project, a manual stack), findings with the affected range and the fix, the alert policy. API key or session; the unit is the watched source, not the request | ||
| POST | /surveillance/analyze | Read a domain or parse a lockfile without saving anything. |
| GET | /surveillance/catalog/products | Resolve a product name to watchable identities (no CPE knowledge needed). |
| DELETE | /surveillance/components/{id} | Remove a component. |
| PATCH | /surveillance/components/{id} | Set a component's version or branch, or stop monitoring it. |
| GET | /surveillance/exposure | What touches the organisation's stack now, by proof. |
| GET | /surveillance/findings | Findings, filtered and paged. |
| GET | /surveillance/findings/{id} | One finding with the why and the fix of each component. |
| PATCH | /surveillance/findings/{id} | Triage a finding (acknowledge, snooze, patched, not affected, accepted risk). |
| POST | /surveillance/findings/bulk-status | Triage up to 200 findings at once. |
| GET | /surveillance/policy | The organisation's alert policy. |
| PUT | /surveillance/policy | Update the alert policy. |
| POST | /surveillance/policy/test | Send a test notification to one channel, now. |
| POST | /surveillance/preview | Expected alert volume over the last 90 days, and what needs action today. |
| GET | /surveillance/quota | Sources used and allowed on the served plan. |
| GET | /surveillance/sources | List the organisation's watched sources and the source quota. |
| POST | /surveillance/sources | Watch a domain, a lockfile/SBOM project or a manual stack. |
| DELETE | /surveillance/sources/{id} | Stop watching a source (its components and their links go with it). |
| GET | /surveillance/sources/{id} | One source with its components. |
| PATCH | /surveillance/sources/{id} | Rename, describe, pause or resume a source. |
| POST | /surveillance/sources/{id}/components | Add components to a source. |
| POST | /surveillance/sources/{id}/refresh | Re-read a domain now, or re-upload a lockfile. |
| Scam Intelligence— Next.js routes for analyze / email / phone / crypto (ismalicious.com/api). | ||
| POST | ismalicious.com/api/analyze | Unified analyze (auto-detect type) |
| GET | ismalicious.com/api/check/crypto | Check crypto wallet address |
| GET | ismalicious.com/api/check/email | Check email address |
| GET | ismalicious.com/api/check/phone | Check phone number risk |
| Account | ||
| POST | ismalicious.com/api/keys/instant | Get an API key instantly (email only) |
Appeler un endpoint sans le playground
# X-API-KEY carries Base64(apiKey:apiSecret)
curl -H "X-API-KEY: $ISMALICIOUS_KEY" \
"https://api.ismalicious.com/check?query=example.com"