List Posts - FalconFeeds

Endpoint

GET https://api.falconfeeds.io/merlin/threat/feed

Authentication

All requests must include the Authorization header with your API token as a Bearer token.

Authorization: Bearer <your-api-token>

Query Parameters

Parameter	Type	Required	Description
`next`	`string`	No	Cursor for the next page. Pass the `next` value from the previous response.
`threatActorUUID`	`string`	No	Filter results by a specific threat actor UUID.
`category`	`string`	No	Filter by category. See allowed values below.
`keyword`	`string`	No	Keyword search across posts. Results are ranked by relevance score (not timestamp) when this param is used.
`uuid`	`string`	No	Retrieve a single post by its UUID.
`publishedSince`	`number`	No	Retrieve posts published after this timestamp (in milliseconds).
`publishedTill`	`number`	No	retrieves the posts published at or before the requested publishedTill timestamp.
`modifiedSince`	`number`	No	Retrieve posts modified after this timestamp (in milliseconds).
`victimKey`	`string`	No	Specify the victim category to filter by. See allowed values below.
`victimValue`	`string`	No	The value corresponding to the selected `victimKey`. Required only if `victimKey` is provided.
`includeImages`	`boolean`	No	Include direct image URLs along with image keys. Available on selected plans only.

Allowed Values - `category`

Ransomware, Data Breach, Data Leak, Malware, DDoS Attack,
Phishing, Combo List, Logs, Defacement, Alert, Vulnerability

Allowed Values - `victimKey`

Country, Industry, Organization, Site, Region, Subregion

Request

curl --location 'https://api.falconfeeds.io/merlin/threat/feed' \
  --header 'Authorization: Bearer <your-api-token>'

Response

{
  "message": "string",
  "data": [
    {
      "uuid": "string",
      "title": "string",
      "content": "string",
      "rawTitle": "string",
      "rawContent": "string",
      "category": "string",
      "tags": ["string"],
      "threatActors": [
        {
          "uuid": "string",
          "name": "string",
          "description": "string"
        }
      ],
      "network": "string",
      "images": ["string"],
      "imageUrls": ["string"],
      "published": {
        "url": "string",
        "timestamp": "number"
      },
      "modifiedAt" : "string",
      "victims": [
        {
          "type": "string",
          "values": ["string"]
        }
      ],
      "victimConfirmedPost": {
        "title": "string",
        "content": "string",
        "category": "string",
        "publishedAt": null,
        "publishedTimeStampInMilliseconds": "number",
        "discoveredAt": "string",
        "sourceURL": "string"
      },
      "isReportedByVictim": false,
      "isThreatActorClaimed": false
    }
  ],
  "next": "string"
}

string

Status message from the API.

array

Array of post objects.

string

Unique identifier for the post.

string

Translated/processed title of the post.

string

Translated/processed content body of the post.

string

Original unprocessed title of the post.

string

Original unprocessed content body of the post.

string

Category of the post (e.g., Ransomware, Data Breach).

array

Tags associated with the post.

array

List of threat actors associated with this post.

string

Network or platform where the post originated.

array

Array of image keys associated with the post.

array

Array of direct image URLs. Available on selected plans only.

string

Source URL of the original post.

number

Published timestamp of the post in milliseconds. Defaults to 0 when unavailable.

string

Timestamp when the post was modified. null when unavailable.

array

Array of victim objects with type and values.

object | null

Victim’s official confirmation post details, if available. null when not confirmed.

string

Title of the victim’s confirmation post.

string

Content of the victim’s confirmation post.

string

Category of the victim’s confirmation post.

string | null

Timestamp when the victim published the confirmation. null when unavailable.

number

Published timestamp of the confirmation post in milliseconds. Defaults to 0 when unavailable.

string

Timestamp when the confirmation was discovered, in UTC format.

string

URL to the victim’s confirmation source.

boolean

Whether the post was reported by the victim. Defaults to false.

boolean

Whether a threat actor has claimed responsibility. Defaults to false.

string

Cursor value to pass as next to retrieve the next page of results.

​Endpoint

​Authentication

​Query Parameters

​Allowed Values - category

​Allowed Values - victimKey

​Request

​Response

Endpoint

Authentication

Query Parameters

Allowed Values - `category`

Allowed Values - `victimKey`

Request

Response