> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opensourcemalware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Automate threat intel and contributions via API

> Integrate threat intelligence into your security workflows with our RESTful API.

The OpenSourceMalware APIs give you programmatic access to the community-driven threat intelligence database. All requests go over HTTPS and return JSON.

<Warning>
  Regardless of your subscription tier, no user may harvest or stockpile data beyond what the API is designed to provide. This includes the use of automated tools (bots, scrapers, crawlers).
</Warning>

## Base URL

All API endpoints are served from the following base URL:

```text theme={null}
https://api.opensourcemalware.com/functions/v1/
```

## Authentication

Every request must include a Bearer token in the `Authorization` header:

```text theme={null}
Authorization: Bearer osm_your_token
```

You generate tokens from your profile settings on [opensourcemalware.com](https://opensourcemalware.com). Tokens are prefixed with `osm_`. See [Authentication](/api/authentication) for full details.

<Note>
  API tokens are generated from your profile settings. Go to **Settings → API Tokens → Generate Token** to create one.
</Note>

## Rate limits

Request limits are enforced per token, per minute. If you exceed your limit, the API returns `429 Too Many Requests`. See [Rate limits](/api/rate-limits) for limits and strategies to handle this.

## Available endpoints

### Free APIs

<CardGroup cols={2}>
  <Card title="GET /check-malicious" icon="shield-halved" href="/api/check-malicious">
    Check whether a package, repository, URL, domain, IP, wallet, or container image is flagged as malicious.
  </Card>

  <Card title="GET /query-latest" icon="clock-rotate-left" href="/api/query-latest">
    Retrieve the 100 most recent verified threat reports from any supported ecosystem or threat category.
  </Card>

  <Card title="POST /submit-threat" icon="flag" href="/api/submit-threat">
    Submit a new threat report about an asset you confirmed to be malicious.
  </Card>

  <Card title="PUT /modify-threat-report" icon="pen-to-square" href="/api/modify-threat">
    Update an existing threat report with new information, additional evidence, or corrected metadata.
  </Card>
</CardGroup>

### Paid APIs

<CardGroup cols={2}>
  <Card title="GET /threat-feed" icon="rss" href="/api/threat-feed">
    Poll for verified threat reports added within a time window.
  </Card>

  <Card title="GET /query-by-username" icon="user-secret" href="/api/query-username">
    Find all verified threats associated with a specific publisher or username.
  </Card>

  <Card title="GET /threat-data" icon="magnifying-glass-chart" href="/api/threat-data">
    Retrieve full threat metadata and all associated Indicators of Compromise for a specific threat UUID.
  </Card>

  <Card title="GET /query-latest-stix" icon="file-code" href="/api/query-latest-stix">
    Retrieve the 100 most recent verified threats as a STIX 2.1 bundle for ingestion into a TIP.
  </Card>

  <Card title="GET /anomali-feed" icon="tower-broadcast" href="/api/stix-anomali">
    A rolling-window STIX 2.1 bundle purpose-built for Anomali ThreatStream, with IOC-level indicators and relationship SROs.
  </Card>
</CardGroup>

## Response format

All endpoints return JSON. A successful check that finds a malicious resource returns `"malicious": true` with a `details` object containing the full threat record. A resource that is not in the database returns `"malicious": false` with an explanatory `message` field.

```json theme={null}
{
  "malicious": true,
  "report_type": "package",
  "resource_identifier": "evil-pkg",
  "ecosystem": "npm",
  "threat_count": 1,
  "details": {
    "id": "uuid-here",
    "status": "verified",
    "severity_level": "critical",
    "description": "Data exfiltration",
    "tags": ["infostealer"],
    "first_seen": "2025-01-05T12:00:00Z",
    "last_seen": "2025-01-10T08:30:00Z"
  }
}
```