./feed

Public threat feed

A sample of confirmed indicators as JSON — wire it into your own detection stack. Higher volume, CSV, and STIX export are available with a partner API key.

JSON endpoint →

Need more than the free sample?

A partner API key raises your daily quota and unlocks CSV and STIX 2.1 export for your SIEM.

See partner & enterprise access →

// consume

curl https://api.openshield.app/v1/feed/indicators

The free feed is rate-limited per IP and returns a capped sample. ?limit= is supported up to the free cap.

No public indicators yet.