Skip to main content

API documentation

Integrate real-time threat intelligence into your security workflows

Threat Radar API v1

The Threat Radar API provides programmatic access to real-time threat intelligence data from multiple sources. Integrate threat monitoring, vulnerability scanning, and security alerts directly into your applications, SIEM systems, or security workflows.

Quick start

  1. Sign in at radar.offseq.com/console with your email address
  2. Enter the one-time code we email you
  3. Copy your API key from Console → Settings; it is shown only after the code is verified, never sent by email
  4. Start making API requests with your key straight away. Free keys are accepted at 30 requests/day, 20 per hour; upgrade in Console → Billing for higher limits

First request

Critical threats from the last 7 days.

curl -G "https://radar.offseq.com/api/v1/threats" \
  -H "X-API-Key: tr_your_api_key_here" \
  -d "severity=critical" \
  -d "days=7"

GET/api/v1/threats

The parameters most integrations use.

ParameterWhat it doesExample
cveIdOne CVE in any casing, or the bare year-number form (alias of cve)cveId=CVE-2025-1974
daysPublished in the last N days (1..3650)days=7
severitylow | medium | high | critical; comma-separated for severalseverity=critical,high
typeThreat type, multi-valuetype=vulnerability
searchCase-insensitive text across title, description, CVE, product, vendor, tagssearch=nginx

All 19 filters are in the .

POST/api/v1/match/batch

Match a host’s packages (purl, CPE or name + ecosystem) in one call.

curl "https://radar.offseq.com/api/v1/match/batch" \
  -H "X-API-Key: tr_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"queries":[{"purl":"pkg:npm/lodash@4.17.20"},
       {"package":{"name":"django","ecosystem":"PyPI"},"version":"4.2.0"}]}'

One batch call counts as one request, whatever its size up to the cap. Per-batch cap by plan: Free 50 · Individual 200 · Base 200 · Pro 1,000 · Enterprise 4,000. Request and response shapes are in the .

Base URL

https://radar.offseq.com/api/v1

Response format

JSON, Content-Type: application/json, on every endpoint.

OpenAPI 3.1 spec for every endpoint, no key needed: radar.offseq.com/openapi.json. Load it into Swagger UI, Postman or a client generator.

Features

  • Real-time threat intelligence from multiple sources
  • CVE vulnerability data with enriched metadata
  • IoC (Indicators of Compromise) checking
  • SBOM and lockfile scanning with SARIF and a CI gate (POST /scan)
  • Versioned priority score on every threat and an explained patch order for a CVE list (POST /prioritize)
  • Product, vendor, and version-level monitoring
  • Geographic threat distribution data (structured + AI-identified)
  • RESTful API with JSON responses
  • API access on every tier, Free included, at 30 requests/day, 20 per hour
  • Per-tier rate limiting, from Free through Enterprise

What you can filter on

GET /threats supports 19 filter parameters plus aliases. Highlights:

  • Identifier normalization: 2025-1974 = cve-2025-1974 = CVE-2025-1974
  • Fuzzy version match: finds affectedVersions=1.24.0 even in unstructured news/Reddit posts
  • Multi-value: tag=a,b or severity=critical&severity=high
  • CVSS range: minCvss=9.0
  • Exploitation & patch flags: hasExploits=true (exploited in the wild), publicExploit=true (public exploit code), hasPatch=true
  • EPSS movers: epssRising=true, sort=epss_rising
  • Priority: sort=priority, minPriority=critical
  • Date windows: publishedAfter + publishedBefore or days=7
  • CWE filtering: cwe=787
  • Diagnostic headers: typos surface in X-Unknown-Params

See the for the complete reference, or call GET /api/v1/threats/filters for a machine-readable catalog.