List Posts (Pagination by Page Number)

Endpoint

GET https://api.falconfeeds.io/merlin/threat/feed/s

Authentication

Authorization: Bearer <your-api-token>

Query Parameters

Parameter	Type	Required	Description
`page`	`number`	No	Page number. Latest data appears on page 1, with older data on subsequent pages.
`threatActorUUID`	`string`	No	Filter by threat actor UUID.
`category`	`string`	No	Filter by category. See allowed values below.
`keyword`	`string`	No	Search across title, description, and tags. Use `sortByScore=true` for relevance ranking.
`uuid`	`string`	No	Retrieve a single post by its UUID.
`publishedSince`	`number`	No	Retrieve posts published after this timestamp (in milliseconds).
`modifiedSince`	`number`	No	Retrieve posts modified after this timestamp (in milliseconds).
`sortByScore`	`boolean`	No	If `true`, sort results by relevance score. Only applies when `keyword` is provided.
`victimKey`	`string`	No	Specify the victim category to filter by. See allowed values below.
`victimValue`	`string`	No	The value corresponding to the selected `victimKey`. Required only if `victimKey` is provided.
`includeImages`	`boolean`	No	Include direct image URLs along with image keys. Available on selected plans only.

Allowed Values - `category`

Ransomware, Data Breach, Data Leak, Malware, DDoS Attack,
Phishing, Combo List, Logs, Defacement, Alert, Vulnerability

Allowed Values - `victimKey`

Country, Industry, Organization, Site, Region, Subregion

Use publishedSince to retrieve posts from a specific time window. For example, the timestamp in milliseconds for 8 Nov 2024 07:03:53 is 1731049442641.

Request

curl --location 'https://api.falconfeeds.io/merlin/threat/feed/s' \
  --header 'Authorization: Bearer <your-api-token>'

Response

{
  "message": "string",
  "data": [
    {
      "uuid": "string",
      "title": "string",
      "content": "string",
      "rawTitle": "string",
      "rawContent": "string",
      "category": "string",
      "tags": ["string"],
      "threatActors": [
        {
          "uuid": "string",
          "name": "string",
          "description": "string"
        }
      ],
      "network": "string",
      "images": ["string"],
      "imageUrls": ["string"],
      "published": {
        "url": "string",
        "timestamp": "number"
      },
      "modifiedAt" : "string",
      "victims": [
        {
          "type": "string",
          "values": ["string"]
        }
      ],
      "victimConfirmedPost": null,
      "isReportedByVictim": false,
      "isThreatActorClaimed": false
    }
  ],
  "page": 1
}

string

Status message from the API.

array

Array of post objects.

string

Unique identifier for the post.

string

Translated/processed title of the post.

string

Translated/processed content body of the post.

string

Original unprocessed title of the post.

string

Original unprocessed content body of the post.

string

Category of the post (e.g., Ransomware, Data Breach).

array

Tags associated with the post.

array

List of threat actors associated with this post.

string

Network or platform where the post originated.

array

Array of image keys associated with the post.

array

Array of direct image URLs. Available on selected plans only.

string

Source URL of the original post.

number

Published timestamp of the post in milliseconds. Defaults to 0 when unavailable.

string

Timestamp when the post was modified. null when unavailable.

array

Array of victim objects with type and values.

object | null

Victim’s official confirmation post details. Returns null for this endpoint.

boolean

Whether the post was reported by the victim. Defaults to false.

boolean

Whether a threat actor has claimed responsibility. Defaults to false.

number

Current page number of the response.

​Endpoint

​Authentication

​Query Parameters

​Allowed Values - category

​Allowed Values - victimKey

​Request

​Response

Endpoint

Authentication

Query Parameters

Allowed Values - `category`

Allowed Values - `victimKey`

Request

Response