ThreatTrove

API

JSON over HTTP, no authentication on a private deployment. Put it behind a reverse proxy — or an API gateway — if you expose it to the internet. Rate limit: 60 requests per minute per IP.

Endpoints

MethodPathReturns
GET/api/v1/hash/<md5|sha1|sha256>verdict for a file hash
GET/api/v1/url?url=<url>verdict for a URL
GET/api/v1/domain?domain=<name>verdict for a domain
GET/api/v1/ip?ip=<addr>verdict for an IP address
GET/api/v1/lookup?q=<anything>auto-detects the indicator type
POST/api/v1/bulkqueue a bulk job, returns 202 + job id
GET/api/v1/bulk/<id>job status and verdict counts
GET/api/v1/bulk/<id>/itemsper-indicator results
GET/api/v1/sourcesconfigured sources and their state
GET/api/v1/statsinstance statistics
Append &fresh=1 to bypass the result cache.

Examples

# single hash
curl -s 'https://threattrove.com/api/v1/hash/44d88612fea8a8f36de82e1278abb02f' | jq .verdict

# URL
curl -s 'https://threattrove.com/api/v1/url?url=https%3A%2F%2Fexample.com%2Flogin' | jq '.verdict, .headline'

# bulk CSV
curl -s -F 'file=@feed.csv' -F 'label=weekly' https://threattrove.com/api/v1/bulk

# poll
curl -s 'https://threattrove.com/api/v1/bulk/<job_id>' | jq .status

Response shape

{
  "indicator": { "kind": "hash", "value": "44d88612…", "raw": "44d88612…", "hashes": {"md5": "…"} },
  "verdict": "malicious",          // malicious | suspicious | clean | known_good | unknown
  "confidence": 100,
  "headline": "2 source(s) flagged this as malicious",
  "score": 200,
  "elapsed_seconds": 0.54,
  "sources_checked": 2,
  "results": [
    { "source": "circl", "status": "found", "verdict": "malicious",
      "detections": 0, "total": 0, "note": "listed by malshare.com",
      "category": "reputation", "detail": {} }
  ]
}

Sources on this instance

12 of 21 are active.

SourceSupportsStatus
circl hash active
otx hash active
malwarebazaar hash active
threatfox hash, url, domain, ip active
urlhaus hash active
virustotal hash needs key
hybridanalysis hash needs key
malshare hash needs key
triage hash needs key
otx_url url active
urlscan url, domain, ip active
urlhaus_url url active
virustotal_url url needs key
gsb url, domain needs key
phishtank url needs key
otx_domain domain, ip active
virustotal_domain domain, ip needs key
dns domain, ip active
rdap domain, ip active
crt domain active
reverseip domain, ip opt-in