API Reference

Intel

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Indicator Feeds

Get indicator feeds owned by this account

GET/accounts/{account_id}/intel/indicator-feeds

Get indicator feed metadata

GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}

Create new indicator feed

POST/accounts/{account_id}/intel/indicator-feeds

Update indicator feed metadata

PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}

Get indicator feed data

GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data

ModelsExpand Collapse

IndicatorFeedListResponse object { id, created_on, description, 5 more }

id: optional number

The unique identifier for the indicator feed

created_on: optional string

The date and time when the data entry was created

formatdate-time

description: optional string

The description of the example test

is_attributable: optional boolean

Whether the indicator feed can be attributed to a provider

is_downloadable: optional boolean

Whether the indicator feed can be downloaded

is_public: optional boolean

Whether the indicator feed is exposed to customers

modified_on: optional string

The date and time when the data entry was last modified

formatdate-time

name: optional string

The name of the indicator feed

IndicatorFeedGetResponse object { id, created_on, description, 9 more }

id: optional number

The unique identifier for the indicator feed

created_on: optional string

The date and time when the data entry was created

formatdate-time

description: optional string

The description of the example test

is_attributable: optional boolean

Whether the indicator feed can be attributed to a provider

is_downloadable: optional boolean

Whether the indicator feed can be downloaded

is_public: optional boolean

Whether the indicator feed is exposed to customers

last_upload_summary: optional object { persisted, skipped, uploaded }

Summary of indicator counts from the last successful upload to this feed. Populated by the custom-threat-feeds loader at the end of each successful load. Absent (omitted) when no upload has completed successfully or the upload errored before the summary write. Surfaces silent-failure paths so operators can see when their indicators were dropped (popularity allowlist, expired valid_until, etc.) without reading loader logs.

persisted: optional object { domains_added, domains_removed, ips_added, 3 more }

Net delta applied to feed indicators by this upload. Snapshot uploads emit both *_added and *_removed; delta-add emits only *_added; delta-remove emits only *_removed.

domains_added: optional number

domains_removed: optional number

ips_added: optional number

ips_removed: optional number

urls_added: optional number

urls_removed: optional number

skipped: optional object { allowlisted_domains, expired_indicators, invalid_indicators }

Counts of indicators that were uploaded but did not reach QuickSilver, broken down by reason.

allowlisted_domains: optional number

Domains filtered by the global popularity allowlist at QS provisioning time. Popular domains (bing.com, naver.com, etc.) are protected from custom-threat-feed enforcement.

expired_indicators: optional number

Indicators in the upload whose valid_until is already in the past. These are not added to QS; the expiration cron handles cleanup.

invalid_indicators: optional number

Reserved for future use. Currently always 0 — the unifier aborts the entire upload on a single bad indicator.

uploaded: optional object { domains, ips, urls }

Indicator counts from the unified file the loader received

domains: optional number

Number of domain indicators in the upload

ips: optional number

Number of IP indicators in the upload

urls: optional number

Number of URL indicators in the upload

latest_upload_status: optional "Mirroring" or "Unifying" or "Loading" or 3 more

Status of the latest snapshot uploaded

One of the following:

"Mirroring"

"Unifying"

"Loading"

"Provisioning"

"Complete"

"Error"

modified_on: optional string

The date and time when the data entry was last modified

formatdate-time

name: optional string

The name of the indicator feed

provider_id: optional number

The unique identifier for the provider

provider_name: optional string

The provider of the indicator feed

IndicatorFeedCreateResponse object { id, created_on, description, 5 more }

id: optional number

The unique identifier for the indicator feed

created_on: optional string

The date and time when the data entry was created

formatdate-time

description: optional string

The description of the example test

is_attributable: optional boolean

Whether the indicator feed can be attributed to a provider

is_downloadable: optional boolean

Whether the indicator feed can be downloaded

is_public: optional boolean

Whether the indicator feed is exposed to customers

modified_on: optional string

The date and time when the data entry was last modified

formatdate-time

name: optional string

The name of the indicator feed

IndicatorFeedUpdateResponse object { id, created_on, description, 5 more }

id: optional number

The unique identifier for the indicator feed

created_on: optional string

The date and time when the data entry was created

formatdate-time

description: optional string

The description of the example test

is_attributable: optional boolean

Whether the indicator feed can be attributed to a provider

is_downloadable: optional boolean

Whether the indicator feed can be downloaded

is_public: optional boolean

Whether the indicator feed is exposed to customers

modified_on: optional string

The date and time when the data entry was last modified

formatdate-time

name: optional string

The name of the indicator feed

IndicatorFeedDataResponse = string

Indicator FeedsSnapshots

Update indicator feed data

PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot

ModelsExpand Collapse

SnapshotUpdateResponse object { file_id, filename, status }

file_id: optional number

Feed id

filename: optional string

Name of the file unified in our system

status: optional string

Current status of upload, should be unified

Indicator FeedsPermissions

List indicator feed permissions

GET/accounts/{account_id}/intel/indicator-feeds/permissions/view

Grant permission to indicator feed

PUT/accounts/{account_id}/intel/indicator-feeds/permissions/add

Revoke permission to indicator feed

PUT/accounts/{account_id}/intel/indicator-feeds/permissions/remove

ModelsExpand Collapse

PermissionListResponse = array of object { id, description, is_attributable, 3 more }

id: optional number

The unique identifier for the indicator feed

description: optional string

The description of the example test

is_attributable: optional boolean

Whether the indicator feed can be attributed to a provider

is_downloadable: optional boolean

Whether the indicator feed can be downloaded

is_public: optional boolean

Whether the indicator feed is exposed to customers

name: optional string

The name of the indicator feed

PermissionCreateResponse object { success }

success: optional boolean

Whether the update succeeded or not

PermissionDeleteResponse object { success }

success: optional boolean

Whether the update succeeded or not

Indicator FeedsDownloads