API Documentation

Reference documentation for the blackhat.ie threat intelligence API.

Authentication

Most endpoints require authentication via request headers.

Standard authentication header:

X-Internal-Token: <your-token>

Admin endpoints additionally require:

X-Admin-Token: <your-admin-token>

Public endpoints (no authentication required):

/health/rss.xml/audio/feed.xml/audio/:date/stream/stix/bundle

Endpoints

Intelligence

GET/api/v1/posts

Query intelligence posts with filtering and pagination.

Parameter	Description
`source_id`	Filter by source ID
`category`	Filter by category
`threat_level`	Filter by threat level
`search`	Full-text search query
`from_date`	Start date filter (ISO 8601)
`to_date`	End date filter (ISO 8601)
`limit`	Results per page (max 100)
`offset`	Pagination offset

GET/api/v1/posts/latest

Get the most recent intelligence posts.

Parameter	Description
`hours`	Lookback window in hours (max 168)
`limit`	Number of results

GET/api/v1/posts/:id

Get a single intelligence post by ID.

GET/api/v1/articles

Query synthesised intelligence articles.

Parameter	Description
`threat_level`	Filter by threat level
`featured`	Filter featured articles only
`limit`	Results per page
`offset`	Pagination offset

GET/api/v1/articles/latest

Get the most recent articles.

Parameter	Description
`hours`	Lookback window in hours
`limit`	Number of results

GET/api/v1/articles/:slug

Get a single article by its URL slug.

Threat Actors

GET/api/v1/actors

List all tracked threat actors with associated post counts.

GET/api/v1/actors/:name

Get threat actor detail with linked intelligence posts.

Sectors

GET/api/v1/sectors

List all sectors with associated post counts.

GET/api/v1/sectors/:slug

Get sector detail with posts and statistics.

MITRE ATT&CK

GET/api/v1/mitre/heatmap

Get technique and tactic frequency data for heatmap visualisation.

Parameter	Description
`days`	Lookback window in days (max 90)

GET/api/v1/mitre/techniques/:id

Get intelligence posts tagged with a specific MITRE technique.

Compliance

GET/api/v1/compliance/overview

Get compliance tag frequencies across intelligence.

Parameter	Description
`days`	Lookback window in days

GET/api/v1/compliance/:framework

Get posts tagged with a specific compliance framework (NIS2, DORA, GDPR).

OSINT

GET/api/v1/osint

List indicators of compromise.

Parameter	Description
`type`	Filter by indicator type (ip, domain, hash, cve, url, email)
`limit`	Number of results

GET/api/v1/osint/search

Search indicators of compromise.

Parameter	Description
`q`	Search query (minimum 2 characters)

GET/api/v1/osint/stats

Get IOC counts grouped by indicator type.

Audio Briefings

GET/api/v1/audio

List available audio briefings.

GET/api/v1/audio/latest

Get metadata for the latest audio briefing.

GET/api/v1/audio/:date/streamPublic

Stream the MP3 audio briefing for a given date.

Feeds

GET/api/v1/rss.xmlPublic

RSS 2.0 feed of intelligence reports.

GET/api/v1/audio/feed.xmlPublic

Podcast RSS feed for audio briefings.

Export

GET/api/v1/stix/bundlePublic

Export intelligence as a STIX 2.1 bundle.

Parameter	Description
`days`	Lookback window in days (max 90)

Stats

GET/api/v1/stats

Get platform-wide statistics.

GET/api/v1/healthPublic

Health check endpoint.

Rate Limits

Endpoint Type	Limit	Exceeded Response
Read endpoints	120 requests/minute	`HTTP 429`
Admin endpoints	10 requests/minute	`HTTP 429`

Response Format

All responses are JSON. Errors return a standard error object:

{"detail": "error message"}