ThreatNexaris
Request a demo
PlatformThreat IntelligenceRisk PrioritizationHunting & DetectionExposureDigital RiskOperationsBy roleSOC AnalystIncident ResponderCTI LeadTechnicalIntegrationsDeploymentPlansSecurityDocsRequest a demo

API

Your data, retrievable.

Everything the interface shows is reachable over the API, because intelligence you cannot export is intelligence you are renting. This page covers the shape of it. The full endpoint reference goes to customers and evaluators directly.

The complete reference is not published here for the same reason the architecture is not. It is more useful to somebody enumerating a target than to a buyer deciding whether to talk to us.

Shape

What you can rely on.

Interface contract
Base
All endpoints sit under a versioned path, so a version change never breaks a running integration silently
Transport
HTTPS only. Plain HTTP is refused, not redirected
Authentication
Bearer token from a login exchange, scoped to one organisation
Authorisation
Every request is checked against the role and organisation of the caller, not only against the token
Format
JSON request and response bodies, UTF-8
Errors
A machine-readable code and a readable message. Never a stack trace
Paging
Cursor-based with a stable order, so a long export cannot silently skip rows
Limits
Per-organisation rate limits, reported in response headers before you reach them

Examples

Authenticate, then read.

Obtain a token
POST /v1/auth/token
Content-Type: application/json

{ "email": "analyst@example.com", "password": "..." }

200 OK
{
  "access_token": "...",
  "expires_in": 3600,
  "organisation": "example-ltd"
}
Read this week of exposure
GET /v1/exposure/this-week
Authorization: Bearer <access_token>

200 OK
{
  "generated_at": "2026-08-25T09:00:00Z",
  "items": [
    {
      "identifier": "CVE-2021-34473",
      "risk_score": 89,
      "band": "critical",
      "affected_assets": 4
    }
  ],
  "next_cursor": null
}

Endpoint families

What is reachable.

  • Intelligence

    Read malware, vulnerability, actor and indicator records, with their sources and assessments.

  • Exposure

    Read and maintain your asset inventory, and read the findings matched against it.

  • Detection

    Retrieve technique-mapped detection content in the query language of your platform.

  • Alerts and cases

    Create, transition and close work, and read the activity trail behind it.

  • Digital risk

    Read monitoring findings for your domains, people, brand and suppliers.

  • Export

    Structured intelligence over the standard transport, plus document and spreadsheet exports.

Ask for the full reference.

Customers get it on day one. Evaluators get it alongside the technical brief, which is usually the point at which you want to know whether it fits.

Request access See integrations