Skip to main content
POST
/
v1
/
indicators
/
search
Search Indicators
curl --request POST \
  --url https://api.example.com/v1/indicators/search \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "query": "<string>",
  "filter": {
    "types": [
      "INDICATOR_TYPE_UNSPECIFIED"
    ],
    "categories": [
      "THREAT_CATEGORY_UNSPECIFIED"
    ],
    "minSeverity": "SEVERITY_UNSPECIFIED",
    "minConfidenceScore": 123,
    "states": [
      "INDICATOR_STATE_UNSPECIFIED"
    ],
    "tags": [
      "<string>"
    ],
    "lastSeenWindow": {
      "start": "2023-11-07T05:31:56Z",
      "end": "2023-11-07T05:31:56Z"
    },
    "sourceIds": [
      "<string>"
    ],
    "protocols": [
      "PROTOCOL_UNSPECIFIED"
    ],
    "sensorTypes": [
      "SENSOR_TYPE_UNSPECIFIED"
    ]
  },
  "pagination": {
    "pageSize": 123,
    "pageToken": "<string>"
  }
}
'
import requests

url = "https://api.example.com/v1/indicators/search"

payload = {
    "query": "<string>",
    "filter": {
        "types": ["INDICATOR_TYPE_UNSPECIFIED"],
        "categories": ["THREAT_CATEGORY_UNSPECIFIED"],
        "minSeverity": "SEVERITY_UNSPECIFIED",
        "minConfidenceScore": 123,
        "states": ["INDICATOR_STATE_UNSPECIFIED"],
        "tags": ["<string>"],
        "lastSeenWindow": {
            "start": "2023-11-07T05:31:56Z",
            "end": "2023-11-07T05:31:56Z"
        },
        "sourceIds": ["<string>"],
        "protocols": ["PROTOCOL_UNSPECIFIED"],
        "sensorTypes": ["SENSOR_TYPE_UNSPECIFIED"]
    },
    "pagination": {
        "pageSize": 123,
        "pageToken": "<string>"
    }
}
headers = {
    "Authorization": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)
const options = {
  method: 'POST',
  headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    query: '<string>',
    filter: {
      types: ['INDICATOR_TYPE_UNSPECIFIED'],
      categories: ['THREAT_CATEGORY_UNSPECIFIED'],
      minSeverity: 'SEVERITY_UNSPECIFIED',
      minConfidenceScore: 123,
      states: ['INDICATOR_STATE_UNSPECIFIED'],
      tags: ['<string>'],
      lastSeenWindow: {start: '2023-11-07T05:31:56Z', end: '2023-11-07T05:31:56Z'},
      sourceIds: ['<string>'],
      protocols: ['PROTOCOL_UNSPECIFIED'],
      sensorTypes: ['SENSOR_TYPE_UNSPECIFIED']
    },
    pagination: {pageSize: 123, pageToken: '<string>'}
  })
};

fetch('https://api.example.com/v1/indicators/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/indicators/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'query' => '<string>',
    'filter' => [
        'types' => [
                'INDICATOR_TYPE_UNSPECIFIED'
        ],
        'categories' => [
                'THREAT_CATEGORY_UNSPECIFIED'
        ],
        'minSeverity' => 'SEVERITY_UNSPECIFIED',
        'minConfidenceScore' => 123,
        'states' => [
                'INDICATOR_STATE_UNSPECIFIED'
        ],
        'tags' => [
                '<string>'
        ],
        'lastSeenWindow' => [
                'start' => '2023-11-07T05:31:56Z',
                'end' => '2023-11-07T05:31:56Z'
        ],
        'sourceIds' => [
                '<string>'
        ],
        'protocols' => [
                'PROTOCOL_UNSPECIFIED'
        ],
        'sensorTypes' => [
                'SENSOR_TYPE_UNSPECIFIED'
        ]
    ],
    'pagination' => [
        'pageSize' => 123,
        'pageToken' => '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/indicators/search"

	payload := strings.NewReader("{\n  \"query\": \"<string>\",\n  \"filter\": {\n    \"types\": [\n      \"INDICATOR_TYPE_UNSPECIFIED\"\n    ],\n    \"categories\": [\n      \"THREAT_CATEGORY_UNSPECIFIED\"\n    ],\n    \"minSeverity\": \"SEVERITY_UNSPECIFIED\",\n    \"minConfidenceScore\": 123,\n    \"states\": [\n      \"INDICATOR_STATE_UNSPECIFIED\"\n    ],\n    \"tags\": [\n      \"<string>\"\n    ],\n    \"lastSeenWindow\": {\n      \"start\": \"2023-11-07T05:31:56Z\",\n      \"end\": \"2023-11-07T05:31:56Z\"\n    },\n    \"sourceIds\": [\n      \"<string>\"\n    ],\n    \"protocols\": [\n      \"PROTOCOL_UNSPECIFIED\"\n    ],\n    \"sensorTypes\": [\n      \"SENSOR_TYPE_UNSPECIFIED\"\n    ]\n  },\n  \"pagination\": {\n    \"pageSize\": 123,\n    \"pageToken\": \"<string>\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.example.com/v1/indicators/search")
  .header("Authorization", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"query\": \"<string>\",\n  \"filter\": {\n    \"types\": [\n      \"INDICATOR_TYPE_UNSPECIFIED\"\n    ],\n    \"categories\": [\n      \"THREAT_CATEGORY_UNSPECIFIED\"\n    ],\n    \"minSeverity\": \"SEVERITY_UNSPECIFIED\",\n    \"minConfidenceScore\": 123,\n    \"states\": [\n      \"INDICATOR_STATE_UNSPECIFIED\"\n    ],\n    \"tags\": [\n      \"<string>\"\n    ],\n    \"lastSeenWindow\": {\n      \"start\": \"2023-11-07T05:31:56Z\",\n      \"end\": \"2023-11-07T05:31:56Z\"\n    },\n    \"sourceIds\": [\n      \"<string>\"\n    ],\n    \"protocols\": [\n      \"PROTOCOL_UNSPECIFIED\"\n    ],\n    \"sensorTypes\": [\n      \"SENSOR_TYPE_UNSPECIFIED\"\n    ]\n  },\n  \"pagination\": {\n    \"pageSize\": 123,\n    \"pageToken\": \"<string>\"\n  }\n}")
  .asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/indicators/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"query\": \"<string>\",\n  \"filter\": {\n    \"types\": [\n      \"INDICATOR_TYPE_UNSPECIFIED\"\n    ],\n    \"categories\": [\n      \"THREAT_CATEGORY_UNSPECIFIED\"\n    ],\n    \"minSeverity\": \"SEVERITY_UNSPECIFIED\",\n    \"minConfidenceScore\": 123,\n    \"states\": [\n      \"INDICATOR_STATE_UNSPECIFIED\"\n    ],\n    \"tags\": [\n      \"<string>\"\n    ],\n    \"lastSeenWindow\": {\n      \"start\": \"2023-11-07T05:31:56Z\",\n      \"end\": \"2023-11-07T05:31:56Z\"\n    },\n    \"sourceIds\": [\n      \"<string>\"\n    ],\n    \"protocols\": [\n      \"PROTOCOL_UNSPECIFIED\"\n    ],\n    \"sensorTypes\": [\n      \"SENSOR_TYPE_UNSPECIFIED\"\n    ]\n  },\n  \"pagination\": {\n    \"pageSize\": 123,\n    \"pageToken\": \"<string>\"\n  }\n}"

response = http.request(request)
puts response.read_body
{
  "indicators": [
    {
      "id": "<string>",
      "type": "INDICATOR_TYPE_UNSPECIFIED",
      "value": "<string>",
      "categories": [
        "THREAT_CATEGORY_UNSPECIFIED"
      ],
      "severity": "SEVERITY_UNSPECIFIED",
      "confidenceScore": 123,
      "tlp": "TLP_MARKING_UNSPECIFIED",
      "state": "INDICATOR_STATE_UNSPECIFIED",
      "firstSeen": "2023-11-07T05:31:56Z",
      "lastSeen": "2023-11-07T05:31:56Z",
      "validUntil": "2023-11-07T05:31:56Z",
      "sources": [
        {
          "id": "<string>",
          "name": "<string>",
          "reliability": 123,
          "reportedAt": "2023-11-07T05:31:56Z"
        }
      ],
      "sightings": [
        {
          "sourceId": "<string>",
          "observedAt": "2023-11-07T05:31:56Z",
          "count": "<string>"
        }
      ],
      "enrichment": {
        "geo": {
          "countryCode": "<string>",
          "city": "<string>",
          "latitude": 123,
          "longitude": 123
        },
        "asn": {
          "number": 123,
          "organization": "<string>"
        },
        "reverseDns": "<string>",
        "malwareFamilies": [
          "<string>"
        ],
        "attackTechniques": [
          "<string>"
        ],
        "aiSummary": "<string>",
        "riskScore": 123,
        "enrichedAt": "2023-11-07T05:31:56Z"
      },
      "tags": [
        "<string>"
      ],
      "labels": [
        {
          "key": "<string>",
          "value": "<string>"
        }
      ],
      "createdAt": "2023-11-07T05:31:56Z",
      "updatedAt": "2023-11-07T05:31:56Z",
      "protocol": "PROTOCOL_UNSPECIFIED",
      "sensorType": "SENSOR_TYPE_UNSPECIFIED"
    }
  ],
  "pageInfo": {
    "nextPageToken": "<string>",
    "totalCount": "<string>"
  }
}
{
  "code": 123,
  "message": "<string>",
  "details": [
    {
      "@type": "<string>"
    }
  ]
}
Search enriched and verified indicators stored in ClickHouse.

​
Filters

FieldTypeDescription
protocolsstring[]e.g. PROTOCOL_MODBUS, PROTOCOL_S7
sensor_typesstring[]e.g. SENSOR_TYPE_ICS
min_confidenceintegerMinimum confidence score (0–100)
created_afterdatetimeISO 8601 lower bound
created_beforedatetimeISO 8601 upper bound

​
Example request

{
  "filter": {
    "protocols": ["PROTOCOL_MODBUS"],
    "min_confidence": 70,
    "created_after": "2026-07-01T00:00:00Z"
  },
  "page_size": 50
}

​
Authentication

Requires WorkOS JWT or API key with indicators:read scope.

​
Metering

This endpoint is metered for billing (Stripe). See your plan at app.reyhford.com.

Authorizations

​
Authorization
string
header
required

WorkOS JWT or machine API key: Bearer

Body

application/json
​
query
string

Free-text query matched against value, tags and enrichment summary.

​
filter
object

Declarative filter; all set fields are ANDed together.

​
pagination
object

Cursor-based pagination request parameters.

Response

A successful response.

​
indicators
object[]
​
pageInfo
object

Pagination metadata returned with list responses.