Hunting API

Our hunting platform offers the following APIs.

Auth-Key (Required) Get False Positive List Create a collection

Obtain an Auth-Key (Required)

In order to interact with the Hunting APIs, you need to obtain an Auth-Key first. If you don't have one you can get one for free here:

abuse.ch Authentication Portal

Whenever you interact with one of the ThreatFox APIs, you must include the HTTP header Auth-Key with your Auth-Key. Example curl command:

curl -H "Auth-Key: YOUR-AUTH-KEY" -X POST https://hunting-api.abuse.ch/api/v1/ -d '{ "query": "get_fplist", "format": "csv" }'

Get False Positive List

You can obtain a copy of the False Positive List by sending a HTTP request to the Hunting API as follow:

Key	Required?	Comment	Sample value
`query`	Yes	Selector, must be `get_fplist`	get_fplist
`format`	Yes	Format you want to have. Supported: `csv` and `json`	json

Here's a sample curl command that describes how to query the API for get_fplist:

curl -H "Auth-Key: YOUR-AUTH-KEY" -X POST https://hunting-api.abuse.ch/api/v1/ -d '{ "query": "get_fplist", "format": "csv" }'

Create a collection

You can group your submissions across all our platforms in so called collections. To do so, must first create a collection either through the web UI or API.

You can create a new collection by sending a HTTP request to the Hunting API as follow:

Key	Required?	Comment	Sample value
`query`	Yes	Selector, must be `create_collection`	create_collection
`collection_name`	Yes	Name of the collection you want to create. Allowed chars: `A-Zaz-z0-9.-_:`	test1234
`description`	No	Description of the collection you want to create (max 400 chars).	This is just a test!
`anonymous`	No	Indicates whether you want to create this collection anonymously. Values: `0` (false) or `1` (true)	0

Here's a sample curl command that describes how to query the API for create_collection:

  curl -H "Auth-Key: YOUR-AUTH-KEY" -X POST https://hunting-api.abuse.ch/api/v1/ -d '{ "query": "create_collection",
  "collection_name": "test1234" , "description": "This is just a test!", "anonymous": 0}'