API Reference

Search IOCs

Search 1M+ IOCs by substring across our IOC intelligence, optionally filtered by type, threat type, or malware family. Results are sorted by first_seen_utc descending.

This endpoint shares the /v1/ioc collection path with Look up an IOC; the two are selected by the query parameter you supply. Pass q for a substring search, or value for an exact lookup.

GET

/v1/ioc

Cost: 1 credit per successful call

Query parameters

qstringrequired

Substring to match against IOC values. Accepted range: 3–200 characters.

typestringoptionaldefault: null

Filter to a single IOC type. Maximum 40 characters, pattern ^[a-z0-9_-]+$. Common values: domain, ip, url, md5_hash, sha256_hash.

threat_typestringoptionaldefault: null

Filter to a threat type. Maximum 40 characters, pattern ^[a-z0-9_-]+$. Examples: botnet_cc, payload_delivery, malware_download.

malwarestringoptionaldefault: null

Filter to a malware family name. Maximum 80 characters.

limitintegeroptionaldefault: 50

Number of results to return. Accepted range: 1–200.

offsetintegeroptionaldefault: 0

Row offset for pagination. Accepted range: 0–2000.

Request

curl "https://api.precursorintelligence.com/functions/v1/ioc?q=azure&type=domain&threat_type=botnet_cc&malware=Cobalt%20Strike&limit=25" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "count": 2,
    "items": [
      {
        "ioc_value": "azure-update-cdn.net",
        "ioc_type": "domain",
        "threat_type": "botnet_cc",
        "malware": "Cobalt Strike",
        "confidence": 90,
        "first_seen_utc": "2026-05-16T11:00:00Z",
        "last_seen_utc": "2026-05-17T22:18:00Z"
      },
      {
        "ioc_value": "azure-telemetry-svc.com",
        "ioc_type": "domain",
        "threat_type": "botnet_cc",
        "malware": "Cobalt Strike",
        "confidence": 85,
        "first_seen_utc": "2026-05-14T08:31:00Z",
        "last_seen_utc": "2026-05-17T19:45:00Z"
      }
    ],
    "generated_at": "2026-05-18T10:24:31.118Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.countintegeroptional

Number of IOCs returned (equals items.length).

data.itemsarrayoptional

Matching IOCs, sorted by first_seen_utc descending. Each object contains the fields below.

data.items[].ioc_valuestringoptional

The IOC value (domain, IP address, URL, or file hash).

data.items[].ioc_typestringoptional

The IOC type, for example domain, ip, url, or sha256_hash.

data.items[].threat_typestringoptional

The associated threat type, for example botnet_cc or payload_delivery.

data.items[].malwarestringoptional

The associated malware family name.

data.items[].confidenceintegeroptional

Reporter confidence level for the IOC (0–100).

data.items[].first_seen_utcstringoptional

ISO 8601 timestamp when the IOC was first observed.

data.items[].last_seen_utcstring | nulloptional

ISO 8601 timestamp when the IOC was most recently observed. May be null.

data.generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Status	`error`	When
400	`missing_query`	Neither `q` nor `value` was supplied.
400	`invalid_q`, `invalid_type`, `invalid_threat_type`, `invalid_malware`, `invalid_limit`, `invalid_offset`	A parameter failed validation.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route or entity does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.