> For the complete documentation index, see [llms.txt](https://docs.whiteintel.io/whiteintel-api-doc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.whiteintel.io/whiteintel-api-doc/threat-discovery/threat-feed-api-darkweb-chatters.md). # Threat Feed API (Darkweb Chatters) Fetch threat‑intel posts and/or taxonomy (categories, industries, networks) from **`Threat Feeds`** with tight filtering and per-endpoint quota enforcement. {% hint style="danger" %} This endpoint is not available by default but a add-on package for 3000 USD / year. {% endhint %} > **Endpoint**\ > `POST https://api.whiteintel.io/get_threat_feeds.php`\ > `Content-Type: application/json` *** ### Quick start **Latest posts (no filters)** ```bash curl -L 'https://api.whiteintel.io/get_threat_feeds.php' -H 'Content-Type: application/json' \ --data '{"apikey":"","page":1,"limit":5}' ``` **List available industries (taxonomy)** ```bash curl -L 'https://api.whiteintel.io/get_threat_feeds.php' -H 'Content-Type: application/json' \ --data '{"apikey":"","taxonomy":"industries","limit":100}' ``` *** ### Access & quotas * **Auth:** API key via JSON body `{ "apikey": "…" }`. * **Plan requirement:** This plan is an add-on for yearly Threat Intel license holders. * **Daily quota:** 20 calls. * **Burst rate limit:** 1 call / 5 seconds (**429** on violation). * **Method:** `POST` only. * **Content-Type:** `application/json`. *** ### Modes This endpoint supports **3** modes: 1. **Posts mode** (default) — returns documents from `Threat Feeds` with filters. 2. **Taxonomy mode** — set `"taxonomy": "categories" | "industries" | "networks"` to get distinct values **with counts**, optionally filtered by date. *** ### Request #### Posts mode (default) ```json { "apikey": "YOUR_KEY", // required "page": 1, // optional, default 1 (1-based) "limit": 100, // optional, default 100, min 1, max 100 "start_date": "YYYY-MM-DD", // optional (inclusive) "end_date": "YYYY-MM-DD", // optional (inclusive) "category": "ransomware", // string OR array (max 2 values) "industry": ["Manufacturing"], // string OR array (max 2 values) "network": ["darkweb","telegram"], // string OR array (multi allowed) "search": "keyword or domain" //Keyword or Domain, min length 4 chars } ``` **Filter rules** * **Dates**: `start_date` and `end_date` are **inclusive** at the day level. Internally we query `[start, end+1day)`. * **Category / Industry**: exact match strings. Arrays are allowed but **max 2 values** each (requests with more than 2 are **400**). * **Network**: exact match, array allowed (no explicit cap). * **Search:** Keyword or domain to search for. Can be empty or min 4 characters long. * **Pagination**: `page` is **1-based**. `limit` is **1..100**. **Examples** Searching for a Domain: ```bash curl -L 'https://api.whiteintel.io/get_threat_feeds.php' -H 'Content-Type: application/json' \ --data '{"apikey":"","page":1,"limit":50,"search":"tesla"}' ``` Single industry: ```bash curl -L 'https://api.whiteintel.io/get_threat_feeds.php' -H 'Content-Type: application/json' \ --data '{"apikey":"","page":1,"limit":50,"industry":"Government Administration"}' ``` Two industries + last 30 days: ```bash curl -L 'https://api.whiteintel.io/get_threat_feeds.php' -H 'Content-Type: application/json' \ --data '{"apikey":"","page":1,"limit":100,"start_date":"2025-08-08","end_date":"2025-09-07","industry":["Government Administration","Education"]}' ``` Category + network: ```bash curl -L 'https://api.whiteintel.io/get_threat_feeds.php' -H 'Content-Type: application/json' \ --data '{"apikey":"","page":1,"limit":100,"category":"ransomware","network":["darkweb"]}' ``` #### Taxonomy mode ```json { "apikey": "YOUR_KEY", // required "taxonomy": "categories", // required: categories | industries | networks "start_date": "YYYY-MM-DD", // optional "end_date": "YYYY-MM-DD", // optional "limit": 100 // optional, 1..100 (default 100) } ``` **Examples** ```bash # Categories in the last 30 days curl -L 'https://api.whiteintel.io/get_threat_feeds.php' -H 'Content-Type: application/json' \ --data '{"apikey":"","taxonomy":"categories","start_date":"2025-08-08","end_date":"2025-09-07","limit":100}' ``` ```bash # Networks (all time) curl -L 'https://api.whiteintel.io/get_threat_feeds.php' -H 'Content-Type: application/json' \ --data '{"apikey":"","taxonomy":"networks","limit":100}' ``` *** ### Responses #### Posts mode ```json { "success": true, "mode": "posts", "remaining_threat_feed_calls": 42, "results": [ { "id": 12345, "uuid": "e7f2…", "published_url": "https://…", "title": "…", "category": "ransomware", "network": "darkweb", "published_at": "2025-09-06 12:34:56", "victim_organization": "Acme Corp", "victim_site": "acme.example", "victim_domain": "acme.com", "victim_industry": "Manufacturing", "victim_country": "US", "threat_actor_names_cached": "ActorX", "tags_csv": "lockbit,leak", "tags_norm_json": ["lockbit","leak"], "threat_actors_norm_json": ["ActorX"], "screenshots_json": [{"url":"https://…/1.png"}] } ] } ``` **Fields** * **id, uuid** — identifiers * **published\_url** — source URL (if available) * **title** — post title * **category** — e.g., `ransomware` * **network** — e.g., `darkweb`, `telegram` * **published\_at** — UTC datetime * **victim\_**\* — contextual victim metadata * **threat\_actor\_names\_cached** — human-readable actor names * **tags\_csv** — comma-separated tags * **tags\_norm\_json, threat\_actors\_norm\_json, screenshots\_json** — JSON arrays #### Taxonomy mode ```json { "success": true, "mode": "taxonomy", "taxonomy": "industries", "remaining_threat_feed_calls": 43, "results": [ {"value":"Government Administration","cnt":2809}, {"value":"Education","cnt":1835} ] } ``` **Fields** * **taxonomy** — which taxonomy you requested * **results\[]** — objects of `{ value, cnt }` *** ### Errors
HTTPCode/MessageWhen
400Invalid JSON body.Malformed JSON
400Limit must be between 1 and 100.limit out of range
400category accepts at most 2 values.>2 categories provided
400industry accepts at most 2 values.>2 industries provided
400Invalid taxonomy. Use 'categories'…Bad taxonomy value
403API Key is missing. / Invalid API Key.Missing or invalid credentials
403Threat Feed add-on is required…If you do not have threat feeds add on
403Threat Feed daily limit is reached.When daily quota reached.
403API calls are only available for…Base plan is not entitled
429Please wait 5 seconds between requests.Rate limit exceeded
500Internal error.Unhandled server issue
*** ### Notes & best practices * **Exact matches**: Category, industry, and network filters are exact (case‑sensitive depends on DB collation). Prefer using **taxonomy** first to fetch valid values. * **Date windows**: If you specify only `start_date`, you’ll get everything from that day forward. If only `end_date`, you’ll get everything up to that day. * **Sorting**: Results are ordered by `published_at DESC, id DESC`. * **Quotas**: Track `remaining_threat_feed_calls` to avoid surprises. * **Max payloads**: Use pagination; consider smaller `limit` with multiple pages for heavy consumers. ***