> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opensourcemalware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Retrieve detailed threat metadata including IOCs

> Reference for GET /threat-feed — retrieve verified threats in bulk from the OSM database to keep blocklists current and power automated alerting pipelines.

The `threat-data` endpoint returns the full threat record for a verified threat, including all associated IOCs. Pass a `threat_id` from a `check-malicious` response to retrieve the complete intelligence for that threat.

<Note>
  Subscription Required: This is a paid endpoint available to Researcher Pro and Enterprise users.
</Note>

Use this endpoint to:

* **Retrieve IOCs for blocking and detection:** Pull all indicators associated with a threat to feed into your firewall rules, SIEM detections, or EDR policies.
* **Enrich threat reports:** Get the full threat description, severity, tags, and IOC list for a package flagged during dependency scanning.
* **Power automated response:** Integrate into incident response workflows to automatically retrieve and act on threat intelligence when a malicious resource is detected.

**Endpoint**

```text theme={null}
GET https://api.opensourcemalware.com/functions/v1/threat-data
```

**Required header**

```text theme={null}
Authorization: Bearer osm_your_token
```

> **Pro or Enterprise required** This endpoint is restricted to users with Pro or Enterprise roles. Standard API tokens will receive a `403 Forbidden` response.

## Query parameters

`threat_id` is required. UUID of the threat to retrieve (e.g. from a `check-malicious` response).

## Response examples

### Success (200)

```json theme={null}
{
  "threat_id": "a5b0c00a-f2db-4f4a-87fd-ff62882d20bf",
  "package_name": "axios",
  "registry": "npm",
  "report_type": "package",
  "severity_level": "critical",
  "threat_description": "Legitimate axios npm package compromised via hijacked maintainer account. Malicious versions 1.14.1 and 0.30.4 were published by an attacker who changed the maintainer email to ifstap@proton.me. The compromised package contacts a C2 server and drops platform-specific RAT payloads (macOS, Windows, Linux). After execution, the malware deletes itself and replaces its own package.json with a clean version to evade forensic detection.",
  "osm_url": "https://opensourcemalware.com/npm/axios",
  "iocs": [
    {
        "ioc_type": "url",
        "value": "http://sfrclak.com:8000/6202033",
        "confidence_level": "high",
        "description": null
    },
    {
        "ioc_type": "domain",
        "value": "sfrclak.com",
        "confidence_level": "high",
        "description": null
    },
    {
        "ioc_type": "ip_address",
        "value": "142.11.206.73",
        "confidence_level": "high",
        "description": null
    },
    {
        "ioc_type": "file_hash_sha256",
        "value": "e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09",
        "confidence_level": "high",
        "description": "plain-crypto-js setup.js stage 1 javascript sha256 hash"
    },
    {
        "ioc_type": "file_hash_sha256",
        "value": "92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a",
        "confidence_level": "high",
        "description": "stage 2 mac binary sha256 hash"
    },
    {
        "ioc_type": "file_hash_sha256",
        "value": "617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101",
        "confidence_level": "high",
        "description": "stage 2 windows binary sha256 hash"
    },
    {
        "ioc_type": "file_hash_sha256",
        "value": "fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf",
        "confidence_level": "high",
        "description": "stage 2 linux python .py sha256 hash"
    }
  ],
  "ioc_count": 7,
  "inherited_iocs": [],
  "malicious_dependencies": [
    {
        "threat_id": "c23da496-61ec-491c-b35d-98941d5238c1",
        "package_name": "plain-crypto-js",
        "resource_identifier": "npm/plain-crypto-js",
        "registry": "npm",
        "depth": 1
    }
  ]
}
```

### 401 — Missing API token

```json theme={null}
{ "error": "API token required. Provide token in Authorization header or apikey query parameter." }
```

### 401 — Invalid or inactive token

```json theme={null}
{ "error": "Invalid or inactive API token" }
```

### 403 — Requires Pro/Editor/Admin

```json theme={null}
{ "error": "Access denied. This endpoint requires Pro, Editor, or Admin access." }
```

### 400 — Missing `threat_id`

```json theme={null}
{ "error": "Missing required parameter: threat_id" }
```

### 400 — Invalid UUID

```json theme={null}
{ "error": "Invalid threat_id format. Must be a valid UUID." }
```

### 404 — Not found or not verified/modified

```json theme={null}
{ "error": "Threat not found or not in verified/modified status." }
```

## cURL example

```text theme={null}
curl -X GET "https://api.opensourcemalware.com/functions/v1/threat-data?threat_id=YOUR_THREAT_UUID" \
  -H "Authorization: Bearer osm_your_token"
```

## Typical workflow

1. Use `check-malicious` to check if a package/resource is malicious and get the `threat_id` from the response
2. Pass the `threat_id` to `threat-data` to retrieve the full threat description and all IOCs
3. Use the IOCs for automated blocking, detection rules, or threat hunting in your environment

For a complete working example, see the [Check and enrich threats](https://docs.opensourcemalware.com/guides/check-and-enrich) guide.