VULONE API

API Reference

Two APIs, one key. A REST API for asking questions a request at a time, and a TAXII 2.1 feed your SIEM subscribes to and re-pulls incrementally. Everything speaks JSON, and the feed speaks STIX 2.1 so Splunk, Microsoft Sentinel, MISP and OpenCTI ingest it without a custom parser.

REST base URL

https://app.vulone.com/api/v1

Question-at-a-time. Search actors, pull a profile, pivot a selector.

TAXII 2.1 discovery

https://app.vulone.com/taxii2/

Subscribe once, re-pull with added_after forever.

Authentication

Every request carries an API key. Create one in the dashboard API tab; it looks like vul_…. Send it in whichever form your client prefers:

# Bearer token (REST and TAXII)
curl -H "Authorization: Bearer vul_your_key" https://app.vulone.com/api/v1/search?q=intelbroker

# X-API-Key header
curl -H "X-API-Key: vul_your_key" https://app.vulone.com/api/v1/search?q=intelbroker

# HTTP Basic, key as the password (what most TAXII clients send)
curl -u "vulone:vul_your_key" https://app.vulone.com/taxii2/

Keys can be scoped. A key limited to search,actor is refused at the other endpoints with 403. A key with no scopes has full access.

Rate limits

Each key has a daily request quota, set by its plan. Every response is counted against it, and the API tab shows your last 24 hours. Exceeding the quota returns 429. The TAXII feed shares the same ledger, so an incremental sync every few minutes is well within a normal quota; a full re-pull of the indicator corpus is not, which is exactly what added_after is for.

REST API

Read-only GET endpoints under https://app.vulone.com/api/v1. Responses are pretty-printed JSON by default; add ?pretty=0 for compact output. Redaction follows your plan: a field your plan cannot see is withheld server-side, never merely hidden.

GET/api/v1/search

Matching actors across every indexed forum.

`q`	required	Username, email, alias or selector to search for.
`page`	optional	Zero-based page. 300 results per page.

curl -H "Authorization: Bearer vul_your_key" \
  "https://app.vulone.com/api/v1/search?q=intelbroker"

GET/api/v1/actor

The profile fields for one actor. Identify it by dump and uid; the other two parameters come back from /search.

`db`	required	The dump, e.g. `d_bf_2022`.
`id`	required	The actor's uid within that dump.
`table`, `idcol`	optional	Filled from the dump's layout when omitted.

GET/api/v1/actor/content

That actor's recovered content: posts, private messages or threads.

`db`, `id`	required	As above.
`type`	optional	`post`, `pm` or `thread`. Default `post`.
`offset`, `limit`	optional	Paging, up to 200 per call.

GET/api/v1/selector

Pivot a selector, a wallet, a Jabber ID, an email, to every account that used it. Scope: selector.

value required The selector to pivot on.

GET/api/v1/ransomware

A ransomware crew's profile, ATT&CK-mapped techniques, tooling and leaked-chat personas. Scope: ransomware.

group optional A crew slug, e.g. black-basta. Omit to list crews.

GET/api/v1/attack

MITRE ATT&CK reference: a technique by id, or a search. Scope: attack.

`id`	optional	A technique id, e.g. `T1486`.
`q`	optional	Free-text technique search.

Also available: /forums, /aliases, /graph, /dossier. Same auth, same shape.

TAXII 2.1 feed

The integration API. Where the REST endpoints answer a question, a TAXII collection is something your SIEM subscribes to: it pulls the collection, remembers the date of the last object it saw, and next time asks only for what is newer. That incremental cursor is the whole point, and it means one collection can back a live indicator feed without ever re-transferring what you already have.

Media types follow the standard: TAXII resources are application/taxii+json;version=2.1, object bundles are application/stix+json;version=2.1.

GET/taxii2/

Discovery. Returns the server title and its one API root, /taxii2/feeds/.

curl -u "vulone:vul_your_key" https://app.vulone.com/taxii2/

GET/taxii2/feeds/collections/

The collections you can subscribe to:

`c2-indicators`	indicator	Live C2 endpoints as STIX indicators, each tied to the malware family it serves.
`iocs`	indicator	The full indicator corpus. Large; built for incremental sync.
`ransomware-actors`	threat-actor	Tracked crews as threat-actor and malware objects with relationships.

GET/taxii2/feeds/collections/{id}/objects/

The STIX bundle. Parameters:

`added_after`	optional	ISO 8601 timestamp. Return only objects added since. This is the incremental cursor.
`limit`	optional	Objects per page, up to 5,000.
`next`	optional	The pagination cursor from the previous page's `next`.

# First pull: everything (paged)
curl -u "vulone:vul_your_key" \
  "https://app.vulone.com/taxii2/feeds/collections/c2-indicators/objects/?limit=500"

# Every pull after: only what is new since your last sync
curl -u "vulone:vul_your_key" \
  "https://app.vulone.com/taxii2/feeds/collections/c2-indicators/objects/?added_after=2026-08-27T00:00:00Z"

Responses carry more and next. When more is true, request the next page with the next cursor. Object ids are stable STIX 2.1 UUIDv5, so re-pulling never creates duplicates. A /manifest/ endpoint returns the same page as lightweight descriptors when you only need to know what changed.

STIX objects

A page of c2-indicators is a self-contained bundle: each indicator, the malware family it points at, and the relationship between them.

{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f0ab67f5-0247-5474-89c8-bf7137e00787",
  "name": "Cobalt Strike C2 115.191.53.193:443",
  "pattern": "[ipv4-addr:value = '115.191.53.193']",
  "pattern_type": "stix",
  "valid_from": "2026-02-28T00:00:14.000Z",
  "indicator_types": ["malicious-activity"],
  "confidence": 100
}

The feed carries infrastructure and public crew profiles only. It never exposes the breach corpus, private messages or any person's identity: that stays behind the session and its entitlements. The machine feed and the investigative search are deliberately different surfaces.

SIEM integrations

Microsoft Sentinel

Sentinel ingests TAXII natively. In Threat Intelligence → Add → TAXII:

API root URL	`https://app.vulone.com/taxii2/feeds/`
Collection ID	`c2-indicators`
Username / Password	`vulone` / your API key

Sentinel polls on its own schedule and tracks added_after for you.

MISP

Add a TAXII 2.1 feed under Sync Actions → Feeds, or pull with the CLI:

taxii2client \
  --url https://app.vulone.com/taxii2/ \
  --user vulone --pass vul_your_key

Splunk

With the Splunk Add-on for STIX/TAXII (or TA-taxii2), point an input at:

Discovery URL	`https://app.vulone.com/taxii2/`
Collection	`iocs` or `c2-indicators`
Auth	Basic, `vulone` / your key

OpenCTI

Use the built-in TAXII 2.1 connector with the discovery URL and Basic auth above. Objects arrive as native STIX and stitch into the OpenCTI graph on their stable ids.

Errors

`401`	Missing or invalid key. Check the header and that the key is not revoked.
`403`	The key is not scoped for this endpoint or collection.
`404`	Unknown endpoint, collection or object.
`429`	Daily quota exceeded. Switch a full pull to an incremental `added_after` sync.

Questions: [email protected].