Skip to content
DocumentationAPI ReferenceChangelog
API ReferenceTalon Studio v1.0.2-beta

Threat Feeds

List threat-intelligence feeds.

List threat feeds

GET/api/v1/threat-feedsthreat_feeds:read

List threat-intelligence feeds. Feeds exist at two levels: the org's own, and a separate set per workspace.

Query parameters
workspaceIdstring (UUID) · optional
With an org-scoped token, list this workspace's feeds instead of the org's. A workspace-bound token always gets its own workspace's feeds.
Response
slugstring
namestring
enabledboolean
indicatorCountinteger
Currently active (non-revoked) indicators from the feed.
Returned as { data: [...] }, oldest feed first. Listing a scope for the first time adds the built-in feeds to it — CISA KEV, CISA Advisories, GitHub Security Advisories, URLhaus, ThreatFox, MalwareBazaar, Feodo Tracker and Ransomware.live. At org level CISA KEV and CISA Advisories start enabled and the rest disabled; a workspace's copies all start disabled, so opening a workspace doesn't fetch every source.
Omitting workspaceId
An org-scoped token that omits workspaceId sees the org-level feeds (Org/threat-feeds.yaml in the Git repository), not a merged view of every workspace's feeds.
Request
curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/threat-feeds"
Response
{
  "data": [
    {
      "slug": "cisa-kev",
      "name": "CISA KEV",
      "enabled": true,
      "indicatorCount": 1284
    },
    {
      "slug": "urlhaus",
      "name": "URLhaus (abuse.ch)",
      "enabled": false,
      "indicatorCount": 0
    }
  ]
}