API Documentation

curl -X GET "https://radar.offseq.com/api/v1/threats?severity=critical&limit=10" \
  -H "X-API-Key: tr_your_api_key_here"

curl -X GET "https://radar.offseq.com/api/v1/threats/search?q=CVE-2024-0001" \
  -H "X-API-Key: tr_your_api_key_here"

curl -X POST "https://radar.offseq.com/api/v1/threats/check-iocs" \
  -H "X-API-Key: tr_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "indicators": [
      {"type": "ip", "value": "192.168.1.100"},
      {"type": "domain", "value": "suspicious-site.com"}
    ]
  }'

curl -G "https://radar.offseq.com/api/v1/threats" \
  -H "X-API-Key: tr_your_api_key_here" \
  -d "product=nginx" \
  -d "affectedVersions=1.24.0" \
  -d "limit=50"

curl -G "https://radar.offseq.com/api/v1/threats" \
  -H "X-API-Key: tr_your_api_key_here" \
  -d "cwe=787" \
  -d "tag=rce" \
  -d "publishedAfter=2025-01-01" \
  -d "publishedBefore=2025-03-31" \
  -d "sort=-cvssScore"

curl -G "https://radar.offseq.com/api/v1/threats" \
  -H "X-API-Key: tr_your_api_key_here" \
  -d "severity=critical" \
  -d "hasExploits=true" \
  -d "hasPatch=true" \
  -d "days=30" \
  -d "minCvss=9.0" \
  -d "sort=-publishedDate"

curl -X GET "https://radar.offseq.com/api/v1/threats/filters" \
  -H "X-API-Key: tr_your_api_key_here" \
  | jq '.data.filters[] | "\(.name) (\(.aliases // [] | join(",")))"'

curl -G -D - "https://radar.offseq.com/api/v1/threats" \
  -H "X-API-Key: tr_your_api_key_here" \
  -d "severity=critical" \
  -d "afected_versions=1.24.0" \
  -o /dev/null \
  -s | grep -i "^x-"
# X-Unknown-Params: afected_versions
# X-RateLimit-Remaining-Hourly: 224

import requests
import json

API_KEY = "tr_your_api_key_here"
BASE_URL = "https://radar.offseq.com/api/v1"
HEADERS = {"X-API-Key": API_KEY}

def get_threats(severity="critical", limit=10):
    url = f"{BASE_URL}/threats"
    params = {"severity": severity, "limit": limit}

    response = requests.get(url, headers=HEADERS, params=params)
    response.raise_for_status()

    return response.json()

# Get critical threats
threats = get_threats()
print(f"Found {len(threats['data']['threats'])} critical threats")

def monitor_products(products, severities=["high", "critical"]):
    url = f"{BASE_URL}/threats/monitor"
    data = {
        "products": products,
        "severities": severities,
        "limit": 50
    }

    response = requests.post(url, headers=HEADERS, json=data)
    response.raise_for_status()

    return response.json()

# Monitor your tech stack
my_products = ["WordPress", "Apache", "MySQL", "Ubuntu"]
threats = monitor_products(my_products)

for threat in threats['data']['threats']:
    print(f"  {threat['severity'].upper()}: {threat['title']}")
    if threat.get('cveId'):
        print(f"   CVE: {threat['cveId']}")
    print(f"   Product: {threat.get('product', 'N/A')}")
    print()

def iterate_threats(**filters):
    """Generator yielding every matching threat, paging server-side."""
    page = 1
    while True:
        r = requests.get(
            f"{BASE_URL}/threats",
            headers=HEADERS,
            params={**filters, "page": page, "limit": 50},
        )
        r.raise_for_status()

        unknown = r.headers.get("X-Unknown-Params")
        if unknown:
            print(f"[warn] API ignored unknown params: {unknown}")

        body = r.json()
        for threat in body["data"]["threats"]:
            yield threat
        if not body["data"]["pagination"]["hasNext"]:
            break
        page += 1

# Every exploited critical with CVSS >= 9 in last 30 days, F5 vendor
for t in iterate_threats(
    vendor="F5",
    severity="critical",
    hasExploits="true",
    minCvss=9.0,
    days=30,
    sort="-cvssScore",
):
    print(t["cveId"], t["title"][:80])

from urllib.parse import urlparse

def fetch_by_url(threat_url):
    slug = urlparse(threat_url).path.rsplit("/", 1)[-1]
    r = requests.get(f"{BASE_URL}/threats/slug/{slug}", headers=HEADERS)
    if r.status_code == 404:
        return None
    r.raise_for_status()
    return r.json()["data"]

threat = fetch_by_url("https://radar.offseq.com/threat/poc-code-published-for-critical-nginx-vulnerabilit-3d78edaa")
print(threat["title"], threat.get("cvssScore"))

const axios = require('axios');

const api = axios.create({
  baseURL: 'https://radar.offseq.com/api/v1',
  headers: { 'X-API-Key': process.env.RADAR_API_KEY }
});

// Composable filter helper — every filter from the Filtering tab works
async function searchThreats(filters) {
  const { data, headers } = await api.get('/threats', { params: filters });

  // Catch typos early — unknown params surface here
  if (headers['x-unknown-params']) {
    console.warn('Unknown params (ignored):', headers['x-unknown-params']);
  }
  if (headers['x-warnings']) {
    console.warn('Warnings:', headers['x-warnings']);
  }
  if (headers['x-limit-capped']) {
    console.warn('Limit capped:', headers['x-limit-capped']);
  }

  return data.data;
}

// CISA-KEV-style: exploited critical with patches, last 30 days
const kev = await searchThreats({
  severity: 'critical',
  hasExploits: 'true',
  hasPatch: 'true',
  minCvss: 9.0,
  days: 30,
  sort: '-cvssScore',
  limit: 50
});
console.log(`${kev.pagination.total} matching threats`);
kev.threats.forEach(t => console.log(t.cveId, t.title));

// Get a single threat by URL slug
async function fetchBySlug(slug) {
  try {
    const { data } = await api.get(`/threats/slug/${slug}`);
    return data.data;
  } catch (e) {
    if (e.response?.status === 404) return null;
    throw e;
  }
}

// Check observed IoCs against the threat corpus
async function checkIoCs(indicators) {
  const { data } = await api.post('/threats/check-iocs', { indicators });
  return data.data.results;
}

// Usage
const threat = await fetchBySlug('poc-code-published-for-critical-nginx-vulnerabilit-3d78edaa');
if (threat) console.log(threat.title);

const matches = await checkIoCs([
  { type: 'ip', value: '192.168.1.100' },
  { type: 'domain', value: 'suspicious-site.com' }
]);

const { data } = await api.get('/threats/filters');
console.table(data.data.filters.map(f => ({
  name: f.name,
  aliases: (f.aliases || []).join(', '),
  type: f.type,
  example: f.example
})));