Developer Documentation

AdverseMonitor
API Documentation

Integrate dark web threat intelligence into your security workflows with our REST API. Access real-time threats, manage alerts, and retrieve metrics programmatically.

Quick Start Guide Get API Key

Quick Start

Get started with the AdverseMonitor API in minutes. All API requests require authentication using a Bearer token.

Base URL

https://platform.adversemonitor.com/api

curl -X GET "https://platform.adversemonitor.com/api/feed?limit=10" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

import requests

url = "https://platform.adversemonitor.com/api/feed"
headers = {
    "Authorization": "Bearer YOUR_API_KEY",
    "Content-Type": "application/json"
}
params = {"limit": 10}

response = requests.get(url, headers=headers, params=params)
threats = response.json()

const url = 'https://platform.adversemonitor.com/api/feed?limit=10';
const headers = {
  'Authorization': 'Bearer YOUR_API_KEY',
  'Content-Type': 'application/json'
};

fetch(url, { headers })
  .then(response => response.json())
  .then(data => console.log(data));

Authentication

All API requests must include your API key in the Authorization header as a Bearer token. You can generate an API key from your dashboard settings.

Authorization Header

Authorization: Bearer am_live_xxxxxxxxxxxxxxxxxxx

Security Best Practices

Never expose your API key in client-side code. Store it securely as an environment variable and only use it in server-side applications. Rotate your keys regularly.

Rate Limits

API rate limits vary by plan. All responses include rate limit headers to help you track usage.

Detection

100

requests/minute

Professional

500

requests/minute

Enterprise

Custom

contact sales

Rate Limit Headers

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1702857600

API Endpoints

Complete reference for all available endpoints.

GET /feed

Retrieve a paginated list of threats from the dark web feed.

Query Parameters

Parameter	Type	Description
limit	integer	Number of results to return (default: 20, max: 100)
offset	integer	Number of results to skip for pagination (default: 0)
category	string	Filter by threat category (e.g., "Ransomware", "Data Breach")
country	string	Filter by country code (ISO 3166-1 alpha-2)
date_from	string	Start date filter (ISO 8601 format: YYYY-MM-DD)
date_to	string	End date filter (ISO 8601 format: YYYY-MM-DD)
search	string	Search query for threat content

Example Request

curl -X GET "https://platform.adversemonitor.com/api/feed?limit=20&category=Ransomware&country=US" \
  -H "Authorization: Bearer YOUR_API_KEY"

import requests

url = "https://platform.adversemonitor.com/api/feed"
headers = {"Authorization": "Bearer YOUR_API_KEY"}
params = {
    "limit": 20,
    "category": "Ransomware",
    "country": "US"
}

response = requests.get(url, headers=headers, params=params)
data = response.json()

for threat in data['threats']:
    print(f"{threat['title']} - {threat['category']}")

const params = new URLSearchParams({
  limit: 20,
  category: 'Ransomware',
  country: 'US'
});

fetch(`https://platform.adversemonitor.com/api/feed?${params}`, {
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY'
  }
})
.then(res => res.json())
.then(data => {
  data.threats.forEach(threat => {
    console.log(`${threat.title} - ${threat.category}`);
  });
});

Example Response

200 OK

{
  "threats": [
    {
      "id": "threat_abc123",
      "title": "Acme Corporation - Data Breach",
      "category": "Ransomware",
      "country": "United States",
      "country_code": "US",
      "threat_actor": "LockBit 3.0",
      "posted_at": "2024-12-15T10:30:00Z",
      "severity": "critical",
      "excerpt": "Acme Corporation data leaked after refusing ransom payment..."
    }
  ],
  "pagination": {
    "total": 150,
    "limit": 20,
    "offset": 0,
    "has_more": true
  }
}

GET /feed/{id}

Retrieve detailed information about a specific threat, including AI analysis.

Path Parameters

Parameter	Type	Description
id	string	Unique threat identifier

Example Request

curl -X GET "https://platform.adversemonitor.com/api/feed/threat_abc123" \
  -H "Authorization: Bearer YOUR_API_KEY"

import requests

threat_id = "threat_abc123"
url = f"https://platform.adversemonitor.com/api/feed/{threat_id}"
headers = {"Authorization": "Bearer YOUR_API_KEY"}

response = requests.get(url, headers=headers)
threat = response.json()

print(f"Threat: {threat['title']}")
print(f"AI Risk Level: {threat['ai_analysis']['risk_level']}")

const threatId = 'threat_abc123';
const url = `https://platform.adversemonitor.com/api/feed/${threatId}`;

fetch(url, {
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY'
  }
})
.then(res => res.json())
.then(threat => {
  console.log('Threat:', threat.title);
  console.log('AI Risk Level:', threat.ai_analysis.risk_level);
});

Example Response

200 OK

{
  "id": "threat_abc123",
  "title": "Acme Corporation - Data Breach",
  "category": "Ransomware",
  "country": "United States",
  "country_code": "US",
  "threat_actor": "LockBit 3.0",
  "posted_at": "2024-12-15T10:30:00Z",
  "severity": "critical",
  "content": "Full threat content...",
  "source_url": "https://...",
  "evidence": [
    {
      "type": "screenshot",
      "url": "https://..."
    }
  ],
  "ai_analysis": {
    "risk_level": "critical",
    "summary": "Active ransomware attack with data exfiltration confirmed...",
    "impact": "Customer PII and financial records compromised",
    "recommendations": [
      "Initiate incident response protocol",
      "Notify affected customers within 72 hours",
      "Engage forensics team for full investigation"
    ]
  }
}

GET /alerts

List all alert profiles configured for your account.

Example Request

curl -X GET "https://platform.adversemonitor.com/api/alerts" \
  -H "Authorization: Bearer YOUR_API_KEY"

import requests

url = "https://platform.adversemonitor.com/api/alerts"
headers = {"Authorization": "Bearer YOUR_API_KEY"}

response = requests.get(url, headers=headers)
alerts = response.json()

for alert in alerts['alert_profiles']:
    print(f"{alert['name']}: {len(alert['keywords'])} keywords")

fetch('https://platform.adversemonitor.com/api/alerts', {
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY'
  }
})
.then(res => res.json())
.then(data => {
  data.alert_profiles.forEach(alert => {
    console.log(`${alert.name}: ${alert.keywords.length} keywords`);
  });
});

Example Response

200 OK

{
  "alert_profiles": [
    {
      "id": "alert_xyz789",
      "name": "Company Domain Monitor",
      "keywords": ["acme.com", "acmecorp.com"],
      "categories": ["Ransomware", "Data Breach"],
      "notifications": {
        "email": ["[email protected]"],
        "slack": "https://hooks.slack.com/...",
        "teams": null
      },
      "created_at": "2024-12-01T08:00:00Z",
      "updated_at": "2024-12-15T10:30:00Z",
      "triggered_count": 42
    }
  ]
}

POST /alerts

Create a new alert profile to monitor specific keywords and categories.

Request Body

Field	Type	Description
name	string	Alert profile name (required)
keywords	array	Array of keywords to monitor (required)
categories	array	Array of threat categories to filter (optional)
notifications	object	Notification settings (email, slack, teams)

Example Request

curl -X POST "https://platform.adversemonitor.com/api/alerts" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Executive Monitor",
    "keywords": ["CEO Name", "acme.com"],
    "categories": ["Ransomware", "Data Breach", "Initial Access"],
    "notifications": {
      "email": ["[email protected]"],
      "slack": "https://hooks.slack.com/services/..."
    }
  }'

import requests

url = "https://platform.adversemonitor.com/api/alerts"
headers = {
    "Authorization": "Bearer YOUR_API_KEY",
    "Content-Type": "application/json"
}
payload = {
    "name": "Executive Monitor",
    "keywords": ["CEO Name", "acme.com"],
    "categories": ["Ransomware", "Data Breach", "Initial Access"],
    "notifications": {
        "email": ["[email protected]"],
        "slack": "https://hooks.slack.com/services/..."
    }
}

response = requests.post(url, headers=headers, json=payload)
alert = response.json()
print(f"Created alert: {alert['id']}")

const payload = {
  name: 'Executive Monitor',
  keywords: ['CEO Name', 'acme.com'],
  categories: ['Ransomware', 'Data Breach', 'Initial Access'],
  notifications: {
    email: ['[email protected]'],
    slack: 'https://hooks.slack.com/services/...'
  }
};

fetch('https://platform.adversemonitor.com/api/alerts', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify(payload)
})
.then(res => res.json())
.then(alert => console.log('Created alert:', alert.id));

Example Response

201 Created

{
  "id": "alert_new123",
  "name": "Executive Monitor",
  "keywords": ["CEO Name", "acme.com"],
  "categories": ["Ransomware", "Data Breach", "Initial Access"],
  "notifications": {
    "email": ["[email protected]"],
    "slack": "https://hooks.slack.com/services/...",
    "teams": null
  },
  "created_at": "2024-12-15T14:22:00Z",
  "updated_at": "2024-12-15T14:22:00Z",
  "triggered_count": 0
}

GET /metrics

Retrieve account-level metrics including threat counts and alert statistics.

Example Request

curl -X GET "https://platform.adversemonitor.com/api/metrics" \
  -H "Authorization: Bearer YOUR_API_KEY"

import requests

url = "https://platform.adversemonitor.com/api/metrics"
headers = {"Authorization": "Bearer YOUR_API_KEY"}

response = requests.get(url, headers=headers)
metrics = response.json()

print(f"Total Threats Indexed: {metrics['total_threats']}")
print(f"Alerts Triggered: {metrics['alerts_triggered']}")

fetch('https://platform.adversemonitor.com/api/metrics', {
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY'
  }
})
.then(res => res.json())
.then(metrics => {
  console.log('Total Threats Indexed:', metrics.total_threats);
  console.log('Alerts Triggered:', metrics.alerts_triggered);
});

Example Response

200 OK

{
  "total_threats": 83247,
  "alerts_triggered": 156,
  "alert_profiles_count": 3,
  "threat_categories": {
    "Ransomware": 42130,
    "Data Breach": 28456,
    "Initial Access": 8924,
    "DDoS": 2156,
    "Other": 1581
  },
  "countries_monitored": 92,
  "last_threat_at": "2024-12-15T14:25:00Z",
  "api_usage": {
    "requests_today": 245,
    "requests_this_month": 8932
  }
}

Error Codes

The API uses standard HTTP status codes. All error responses include a JSON body with details.

400 Bad Request

Invalid request parameters or malformed JSON body.

                                        {"error": "Invalid category. Must be one of: Ransomware, Data Breach, Initial Access"}
                                    

401 Unauthorized

Missing or invalid API key. Check your Authorization header.

{"error": "Invalid API key. Please check your credentials."}

403 Forbidden

API access not available for your plan. Upgrade to Professional or Enterprise.

{"error": "API access requires Professional or Enterprise plan"}

404 Not Found

Requested resource does not exist.

{"error": "Threat not found"}

429 Too Many Requests

Rate limit exceeded. Check X-RateLimit-Reset header for retry time.

{"error": "Rate limit exceeded. Retry after 45 seconds."}

500 Internal Server Error

Something went wrong on our end. Please try again or contact support.

{"error": "Internal server error. Please contact support."}

Response Schemas

Common object structures used throughout the API.

Threat Object

Threat Schema

{
  "id": "string",
  "title": "string",
  "category": "string",
  "country": "string",
  "country_code": "string",
  "threat_actor": "string",
  "posted_at": "ISO 8601 datetime",
  "severity": "critical | high | medium | low",
  "excerpt": "string",
  "content": "string (full endpoint only)",
  "source_url": "string (full endpoint only)",
  "evidence": ["array (full endpoint only)"],
  "ai_analysis": {
    "risk_level": "string",
    "summary": "string",
    "impact": "string",
    "recommendations": ["array"]
  }
}

Alert Profile Object

Alert Profile Schema

{
  "id": "string",
  "name": "string",
  "keywords": ["array of strings"],
  "categories": ["array of strings"],
  "notifications": {
    "email": ["array of email addresses"],
    "slack": "webhook URL or null",
    "teams": "webhook URL or null"
  },
  "created_at": "ISO 8601 datetime",
  "updated_at": "ISO 8601 datetime",
  "triggered_count": "integer"
}

Pagination Object

Pagination Schema

{
  "total": "integer",
  "limit": "integer",
  "offset": "integer",
  "has_more": "boolean"
}

Need Help?

Our support team is here to help you integrate the AdverseMonitor API into your security workflows.

Email Support View Dashboard

AdverseMonitor API Documentation

Quick Start

Authentication

Rate Limits

API Endpoints

Query Parameters

Example Request

Example Response

Path Parameters

Example Request

Example Response

Example Request

Example Response

Request Body

Example Request

Example Response

Example Request

Example Response

Error Codes

Response Schemas

Threat Object

Alert Profile Object

Pagination Object

Need Help?

AdverseMonitor
API Documentation