API Reference

List Top Vendors by Honeypot Activity

Return the top vendors ranked by Shadowserver honeypot connection volume over a configurable look-back window, so you can identify which vendor ecosystems are most actively targeted at a given moment.

GET

/v1/shadowserver/top-vendors

Cost: 1 credit per successful call

Query parameters

daysintegeroptionaldefault: 30

Look-back window in days. Accepted range: 1–30.

limitintegeroptionaldefault: 25

Maximum number of vendors to return. Accepted range: 1–50.

Request

curl "https://api.precursorintelligence.com/functions/v1/shadowserver/top-vendors?days=7&limit=10" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "count": 10,
    "days": 7,
    "limit": 10,
    "items": [
      { "vendor": "microsoft", "connections": 81412, "cve_count": 14 },
      { "vendor": "fortinet",  "connections": 42188, "cve_count": 9  },
      { "vendor": "cisco",     "connections": 31047, "cve_count": 7  }
    ],
    "generated_at": "2026-05-18T10:24:31.118Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.countintegeroptional

Number of items returned (equals items.length).

data.daysintegeroptional

The look-back window used for this query, in days.

data.limitintegeroptional

The maximum row count applied to this query.

data.itemsarrayoptional

Vendor records ranked by connection volume, highest first. Each item contains the fields below.

data.items[].vendorstringoptional

Vendor name.

data.items[].connectionsintegeroptional

Total honeypot connections observed for this vendor within the window.

data.items[].cve_countintegeroptional

Number of distinct CVEs attributed to this vendor with activity in the window.

data.generated_atstringoptional

ISO 8601 timestamp indicating when the response was produced.

Errors

Status	`error`	When
400	`invalid_days`, `invalid_limit`	A query parameter failed validation.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route or entity does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.