API Reference

List Recent IOCs

Return IOCs first seen in the last N days, optionally filtered by IOC type. The look-back window is intentionally short because broader windows can exceed the response size cap.

GET

/v1/ioc/recent

Cost: 1 credit per successful call

Query parameters

typestringoptionaldefault: null

Filter results to a single IOC type. Maximum 40 characters, pattern ^[a-z0-9_-]+$. Common values include domain, url, ip:port, and sha256_hash.

daysintegeroptionaldefault: 1

Look-back window in days. Accepted range: 1–7.

limitintegeroptionaldefault: 100

Maximum number of IOC records to return. Accepted range: 1–200.

Request

curl "https://api.precursorintelligence.com/functions/v1/ioc/recent?type=domain&days=1&limit=100" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "count": 3,
    "days": 1,
    "ioc_type": "domain",
    "limit": 100,
    "items": [
      {
        "id": 80421,
        "ioc_value": "phish-cdn-update.org",
        "ioc_type": "domain",
        "threat_type": "payload_delivery",
        "malware_printable": "QakBot",
        "first_seen_utc": "2026-05-28T03:11:00Z",
        "last_seen_utc": "2026-05-28T09:44:00Z",
        "confidence_level": 75,
        "tags": ["phishing", "qakbot"]
      },
      {
        "id": 80418,
        "ioc_value": "update-secure-login.net",
        "ioc_type": "domain",
        "threat_type": "phishing",
        "malware_printable": "AgentTesla",
        "first_seen_utc": "2026-05-28T01:47:00Z",
        "last_seen_utc": "2026-05-28T08:02:00Z",
        "confidence_level": 80,
        "tags": ["credential-theft"]
      },
      {
        "id": 80401,
        "ioc_value": "cdn-static-assets.ru",
        "ioc_type": "domain",
        "threat_type": "botnet_cc",
        "malware_printable": "Emotet",
        "first_seen_utc": "2026-05-27T22:09:00Z",
        "last_seen_utc": "2026-05-28T05:31:00Z",
        "confidence_level": 90,
        "tags": ["botnet", "emotet"]
      }
    ],
    "generated_at": "2026-05-29T10:24:31.118Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.countintegeroptional

Number of IOCs returned (equals items.length).

data.daysintegeroptional

The look-back window used for this request, in days.

data.ioc_typestring | nulloptional

The IOC type filter applied to this request. null when no filter was supplied.

data.limitintegeroptional

The maximum number of records requested.

data.itemsarrayoptional

IOCs first seen within the window, ordered most recent first. Each object contains the fields below.

data.items[].idintegeroptional

Numeric identifier for the IOC record.

data.items[].ioc_valuestringoptional

The IOC value (domain, IP address, URL, or file hash).

data.items[].ioc_typestringoptional

The IOC type, for example domain, url, or sha256_hash.

data.items[].threat_typestringoptional

The associated threat type, for example payload_delivery or botnet_cc.

data.items[].malware_printablestringoptional

Human-readable malware family name.

data.items[].first_seen_utcstringoptional

ISO 8601 timestamp when the IOC was first observed.

data.items[].last_seen_utcstring | nulloptional

ISO 8601 timestamp when the IOC was most recently observed. May be null.

data.items[].confidence_levelintegeroptional

Reporter confidence level for the IOC (0–100).

data.items[].tagsarrayoptional

String tags associated with the IOC.

data.generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Status	`error`	When
400	`invalid_type`, `invalid_days`, `invalid_limit`	A parameter failed validation.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route or entity does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.