security-apis/README.md

# awesome-security-apis
A collective awesome list of public (JSON) APIs for use in security.

The list is supported by https://alexanderjaeger.de

Learn about REST: https://github.com/marmelab/awesome-rest

Thanks to all [contributors](https://github.com/deralexxx/security-apis/graphs/contributors), you're awesome and wouldn't be possible without you! The goal is to build a categorized community-driven collection of APIs relevant for security people.

# Index
* [Online](#online)
* [Tools](#tools)
* [SIEM](#siem)
* [Various](#various)


## Online
API | Description | Auth | HTTPS | Link | Free / Commercial|
|---|---|---|---|---|---|
| Alexa | Alexa Top Sites | `apiKey` | Yes | [Link!](https://docs.aws.amazon.com/AlexaTopSites/latest/) |?|
| ANY.RUN | Interactive malware analysis service.  | `apiKey` | Yes | [Link!](https://any.run/api-documentation/) |Both, API commercial only|
| BinaryEdge.io | Search Engine for internet connected devices and Honeypot Network | `apiKey` | Yes | [Link!](https://binaryedge.io/) |Free/Commercial|
| CriminalIP.io | Search Engine for internet connected devices | `apiKey` | Yes | [Link!](https://www.criminalip.io/) |Free/Commercial|
| Bluecoat Site Review | URL Analysis | `none` | Yes | [Link!](https://sitereview.bluecoat.com/sitereview.jsp) |Free|
| bgpmon.net | Bgp monitoring | `?` | Yes | [Link!](https://bgpmon.net/bgpmon-web-services-api/) |?|
| caprivacy.github.io | California Privacy Directory  | None | Yes | [Link!](https://caprivacy.github.io/caprivacy/) |?|
| censys.io | Free for Researchers Threat Intel  | `apiKey` | Yes | [Link!](https://censys.io/api) |?|
| CIRCL CVE Search | CVE Search | `none` | Yes | [Link!](https://cve.circl.lu/api/) |Free|
| CIRCL hashlookup | File hash lookup | `none` | Yes | [Link!](https://hashlookup.circl.lu/) |Free|
| CIRCL Passive SSH | Passive SSH | `ApiKey` | Yes | [Link!](https://github.com/D4-project/passive-ssh#api) |Free for security teams|
| Cloidsploit | Vuln Scanner | `apiKey` | Yes | [Link!](https://cloudsploit.com/api) |Free|
| CrowdStrike API | TI | `apiKey` | Yes | [Link!](https://www.crowdstrike.com/blog/tech-center/get-access-crowdstrike-apis/) |NO|
| CVEAPI | API for CVE data | `none` | Yes | [Link!](https://cveapi.com/) |Free|
| Cymon.io | Open Threat Intel  | `apiKey` | Yes | [Link!](https://cymon.docs.apiary.io/) |?|
| Cybergreen | How clean is a network  | `apiKey` | Yes | [Link!](http://stats.cybergreen.net/download/) |?|
| CyCAT.org | The Cybersecurity Resource Catalogue public API services. | `none` | Yes | [Link!](https://api.cycat.org/) |Free - OpenAPI|
| Domaintools | Commercial Threat Intel  | `apiKey` | Yes | [Link!](https://www.domaintools.com/products/api-integration/) |Commercial|
| Dragos WorldView | ICS Threat Intelligence  | `apiKey` | Yes | [Link!](https://portal.dragos.com/api/v1/doc/) |Commercial|
| DShield | Internet Storm Center API  | `apiKey` | Yes | [Link!](https://www.dshield.org/api/) |Free|
| EmailRep | Free API to query email reputation and report malicious senders | none | Yes | [Link!](https://blog.sublimesecurity.com/emailrep-query-and-report) | Free |
| emergingthreats.net | Domain / IP intelligence and reputation | `apiKey` | Yes | [Link!](http://apidocs.emergingthreats.net/) |?|
| Farsight DNSDB Passive DNS | Passive DNS and more | `apiKey` | Yes | [Link!](https://api.dnsdb.info/) |?|
| Fireeye iSight | Commercial Threat Intel  | `apiKey` | Yes | [Link!](https://docs.fireeye.com/iSight/index.html#/) |Commercial|
| FIRST.org | Incident Response Teams API | `none` | Yes | [Link!](https://api.first.org/) |?|
| Flashpoint Intel | Threat Intel | `apiKey` | Yes | [Link!](https://www.flashpoint-intel.com/api/) |?|
| Flexera | Vuln Management | `apiKey` | Yes | [Link!](http://helpnet.flexerasoftware.com/svm/api/Default.htm) |?|
| GreyNoise | GreyNoise is a system that collects and analyzes data on Internet-wide scanners. | `apiKey` | Yes | [Link!](https://github.com/GreyNoise-Intelligence/api.greynoise.io) |Free/Commercial|
| HackerOne | Query HackerOne reports | `apiKey` | Yes | [Link!](https://api.hackerone.com/docs/v1) |?|
| have i been pwned | [unofficial endpoints](apidocs/haveIBeenPwned.md) | `apiKey` | Yes | [Link!](https://haveibeenpwned.com/API/v2) |?|
| Hybrid Analysis | Online Sandbox | `none` | Yes | [Link!](https://www.hybrid-analysis.com/docs/api/v2) |Free|
| IP ASN History (D4 Project - CIRCL) | IP and BGP intelligence | `none` | Yes |[Link!](https://github.com/D4-project/IPASN-History)|Free|
| MAlshare | Malware Sharing  | `apiKey` | Yes | [Link!](https://malshare.com/doc.php) |?|
| Mac Vendor Lookup | Threat Intel  | `apiKey` | Yes | [Link!](https://macvendors.com/api) |?|
| MAC address API | Threat Intel  | `apiKey` | Yes | [Link!](https://macaddress.io/api-documentation) |Commercial|
| Malpedia | Curated list of malware  | `apiKey` | Yes | [Link!](https://malpedia.caad.fkie.fraunhofer.de/usage/api) |Free|
| MalwareBazaar | Malware Sharing Service  | `apiKey` | Yes | [Link!](https://bazaar.abuse.ch/api/) |Free (CCO)|
| MaxMind | GeoIP and More  | `apiKey` | Yes | [Link!](https://dev.maxmind.com/) |?|
| Microsoft Security Response Center API | Programmatic interfaces to engage with the Microsoft Security Response Center (MSRC)  | `None` | Yes | [Link!](https://msrc.microsoft.com/report/developer) |Free|
| MWDB | The MWDB system (also known as the “Malware Database”) is a repository for storing malware samples and information acquired during their analysis  | `apiKey` | Yes | [Link!](https://mwdb.readthedocs.io/en/latest/user-guide/8-REST-and-mwdblib.html) |Free|
| NeutrinoAPI | IP Blocklist API  | `apiKey` | Yes | [Link!](https://www.neutrinoapi.com/api/ip-blocklist/) |?|
| Onyphe | Search Engine for internet connected devices   | `apiKey` | Yes | [Link!](https://www.onyphe.io/) |Free/Commercial|
| ORKL.eu | Search Engine for intel reports   | `apiKey` | Yes | [Link!](https://orkl.eu) |Free (API rate limited)|
| Passive Total | Threat Intel | `apiKey` | Yes | [Link!](https://api.passivetotal.org/api/docs/) |?|
| Pastebin |  | `apiKey` | Yes | [Link!](https://pastebin.com/doc_api) |?|
| Phishtank |  | `?` | Yes | [Link!](http://www.phishtank.com/developer_info.php) |?|
| ProxySpace | Proxy servers, proxy judge and IP geolocation | None | Yes | [Link!](https://proxyspace.pro) |Free|
| Pulsedive | Free threat intelligence platform ingesting over 50 OSINT feeds and user submissions. | `apiKey` | Yes | [Link!](https://pulsedive.com/api/) |Both|
| Qualys SSLLabs | Test SSL and more | `apiKey` | Yes | [Link!](https://www.ssllabs.com/projects/ssllabs-apis/) |?|
| Spamhaus | Domain / IP intelligence and reputation | `?` | Yes | [Link!](https://www.spamhaus.org/zen/) |?|
| Shadowserver Sandbox API | Sandbox | `?` | Yes | [Link!](http://www.shadowserver.org/wiki/pmwiki.php/Services/Sandboxapi) |Free|
| Shadowserver Bintest API | This server provides a lookup mechanism to test an executable file against a list of known software applications.| `?` | Yes | [Link!](http://bin-test.shadowserver.org/) |Free|
| Shadowserver IP-BGP API | Mapping IP numbers to BGP prefixes and ASNs | `?` | Yes | [Link!](https://www.shadowserver.org/wiki/pmwiki.php/Services/IP-BGP) |Free|
| Shodan.io | Search Engine for internet connected devices | `apiKey` | Yes | [Link!](https://developer.shodan.io/) |Free/Commercial|
| StalkPhish.io | Phishing/brand impersonation detection feed | `apiKey` | Yes | [Link!](https://www.stalkphish.io/) |Free/Commercial|
| Tenable | ? | `?` | Yes | [Link!](https://cloud.tenable.com/api#/overview) |?|
| Team Cymru | Threat Intel | `apiKey` | Yes | [Link!](http://www.team-cymru.org/services.html) |Both|
| ThreatConnect | Threat Intel / SOC platform  | `apiKey` | Yes | [Link!](https://docs.threatconnect.com/en/latest/) |Commercial|
| URLhaus | abuse.ch API | `apiKey` | Yes | [Link!](https://urlhaus-api.abuse.ch/) |Free|
| urlscan.io | Online tool to scan URLs | `apiKey` | Yes | [Link!](https://urlscan.io/about-api/) |Free|
| Valhalla | Online repository of curated yara rules | `apiKey` | Yes | [Link!](https://valhalla.nextron-systems.com/) |Commercial|
| VirusTotal | VirusTotal File/URL Analysis | `apiKey` | Yes | [Link!](https://www.virustotal.com/en/documentation/public-api/) |?|
| vulners | vulners Vuln Database | `apiKey` | Yes | [Link!](https://vulners.com/docs) |?|
| whoisxmlapi.com | Whois APIs| `apiKey` | Yes | [Link!](https://whoisapi.whoisxmlapi.com/docs) |Commercial|
| Zoomeye | Search Engine for internet connected devices | `apiKey` | Yes | [Link!](https://www.zoomeye.org/doc) |Both|

## Tools

API | Description | Auth | HTTPS | Link | Free / Commercial|
|---|---|---|---|---|---|
| Carbon Black | Endpoint Security | `apiKey` | Yes | [Link!](https://github.com/carbonblack/cbapi) |Commercial|
| Cuckoo | Cuckoo Sandbox | `apiKey` | Yes | [Link!](https://cuckoo.sh/docs/usage/api.html) |OpenSource|
| CRITS | TI System | `apiKey` | Yes | [Link!](https://github.com/crits/crits/wiki/Authenticated-API) |?|
| CrowdStrike falcon-orchestrator | Orchestrator | `apiKey` | Yes | [Link!](https://github.com/CrowdStrike/falcon-orchestrator/wiki/Installation-&-Deployment) |yes|
| emlrender | EML file rendering tool | `password` | Yes | [Link!](https://github.com/xme/emlrender) |OpenSource|
| FireEye | Endpoint Security | `apiKey` | Yes | [Link!](https://docs.fireeye.com/) |?|
| GRR | Endpoint Incident Response tool | `apiKey` | Yes | [Link!](http://grr-doc.readthedocs.io/en/v3.2.0/investigating-with-grr/automation-with-api.html) |OpenSource|
| Kolide Fleet | osQuery fleet management | `?` | Yes | [Link!](https://github.com/kolide/fleet/blob/master/docs/api/README.md) |OpenSource|
| Lastline | Lastline Enterprise | `ApiKey` | Yes | [Link!](https://user.lastline.com/papi-doc/api/html/index.html) | Commercial |
| logdissect | CLI utility and Python API for analyzing log files and other data. | `?` | Yes | [Link!](https://github.com/dogoncouch/logdissect/blob/master/docs/README-MODULE.md) | OpenSource |
| MISP | Open Source Threat Intelligence Platform | `apiKey` | Yes | [Link!](https://www.circl.lu/doc/misp/automation/) |OpenSource|
| Metadefender | MultiAV | `apiKey` | Yes | [Link!](https://docs.opswat.com/mdcore/metadefender-core/ref) |Commercial|
| Metasploit | Exploiting | `apiKey` | Yes | [Link!](http://rapid7.github.io/metasploit-framework/api/) |Commercial|
| Moloch | Moloch is an open source, large scale, full packet capturing, indexing, and database system. | `?` | Yes | [Link!](https://github.com/aol/moloch/wiki/API) |OpenSource|
| OTRS | Open Ticket Relay System | `apiKey` | Yes | [Link!](https://doc.otrs.com/doc/api/otrs/8.0/Perl/) |?|
| Plaso | Plaso Langar Að Safna Öllu | `apiKey` | Yes | [Link!](https://readthedocs.org/projects/plaso-api/) |OpenSource|
| Recorded Future | Threat Intelligence Platform | `apiKey` | Yes | [Link!](https://api.recordedfuture.com/index.html) |?|
| Request Tracker | Ticketing System | `apiKey` | Yes | [Link!](https://rt-wiki.bestpractical.com/wiki/REST) [REST2](https://metacpan.org/pod/RT::Extension::REST2) |?|
| Scot | SCOT - Sandia Cyber Omni Tracker Ticketing System | `apiKey` | Yes | [Link!](http://scot.readthedocs.io/en/latest/devguide.html#scot-rest-api) |Free|
| TheHive | Security Incident Response Platform | `apiKey` | Yes | [Link!](https://blog.thehive-project.org/tag/api/) |Free|
| Viper.li | Viper malware repository API | `apiKey` | Yes | [Link!](https://github.com/viper-framework/viper/blob/master/docs/source/usage/web.rst) |OpenSource|
| VMRay | VMRay Sandbox | `apiKey` | Yes | [Link!](https://www.vmray.com/blog/v-1-9-api-now-restjson/) |?|

## SIEM
API | Description | Auth | HTTPS | Link | Free / Commercial|
|---|---|---|---|---|---|
| ArcSight | HP ArcSight API | `None` | `No` | [Link!](https://h41382.www4.hpe.com/gfs-shared/downloads-273.pdf) | Commercial |
| AlienVault | AlienVault API | `Yes` | `Yes` | [Link!](https://www.alienvault.com/documentation/api/av-apis.htm) | Commercial |
| ELK | ELK Stack API | `None` | `No` | [Link!](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs.html) | OpenSource |
| Gravwell | Gravwell API | `Yes` | `Yes` | [Link!](https://dev.gravwell.io/docs/#!api/api.md) | Community / Commercial |
| Humio | Humio API | `Yes` | `Yes` | [Link!](https://docs.humio.com/api/)| Community / Commercial |
| QRadar | IBM QRadar API | `None` | `No` | [Link!](https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/c_rest_api_getting_started.html) |Commercial|
| Splunk | Splunk API | `None` | `No` | [Link!](http://dev.splunk.com/restapi) |Commercial|

### Various
API | Description | Auth | HTTPS | Link |Free / Commercial|
|---|---|---|---|---|---|
| Akamai | Akamai CDN | `apiKey` | Yes | [Link!](https://developer.akamai.com/api/) | Commercial |
| AlienVault Open Threat Exchange (OTX) | IP/domain/URL reputation | `apiKey` | Yes | [Link!](https://otx.alienvault.com/api/) |?|
| Check Point APIs | Check Point APIs Homepage | `apiKey` | Yes | [Link!](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk121360) | Commercial |
| Cisco ISE | ISE is an identity and access control policy platform | `apiKey` | Yes | [Link!](https://www.cisco.com/c/en/us/support/security/identity-services-engine/products-command-reference-list.html) |?|
| Cisco PXGrid | Cisco Platform Exchange Grid | `apiKey` | Yes | [Link!](https://developer.cisco.com/site/pxgrid/) |?|
| Cisco Security APIs | Cisco Developer Page | `` | ? | [Link!](https://developer.cisco.com/site/security/) |?|
| Cisco Umbrella | Cisco Umbrella Enforcement API | `apiKey` | Yes | [Link!](https://docs.umbrella.com/developer/enforcement-api/) |?|
| Cyphon | Open Source INcident Management tool | `apiKey` | Yes | [Link!](http://cyphon.readthedocs.io/en/latest/api.html) |?|
| F5 Bip IP | F5 application services products | `apiKey` | Yes | [Link!](https://devcentral.f5.com/wiki/iControlREST.HomePage.ashx?lc=1) | Commercial |
| Google Safe Browsing | Google Link/Domain Flagging | `apiKey` | Yes | [Link!](https://developers.google.com/safe-browsing/) |?|
| Metacert | Metacert Link Flagging | `apiKey` | Yes | [Link!](https://metacert.com/) |?|
| Netscaler | Citrix Netscaler application delivery controller | `apiKey` | Yes | [Link!](https://developer-docs.citrix.com/projects/netscaler-nitro-api/en/12.0/api-reference/) | Commercial |
| Windows Defender Advanced Threat Protection (Windows Defender ATP) | WDATP | `apiKey` | Yes | [Link!](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/management-apis) |?|
| National Software Reference Library (NSRL) | - | `apiKey` | Yes | [Link!](https://github.com/bsi-group/nsrls) |?|
| PaloAlto | PaloAlto FW API | `apiKey` | Yes | [Link!](https://www.paloaltonetworks.com/documentation/71/pan-os/xml-api/get-started-with-the-pan-os-xml-api/explore-the-api) | Commercial |
| RSA Secure ID | Metacert Link Flagging | `apiKey` | Yes | [Link!]( https://community.rsa.com/docs/DOC-75741) |?|
| ServiceNow | ServiceNow API | `apiKey` | Yes | [Link!](https://developer.servicenow.com/app.do) | Commercial |
| Web Of Trust (WOT) | Website reputation | `apiKey` | Yes | [Link!](https://www.mywot.com/developers) |?|
| Yandex Safe Browsing | Yandex Link/Domain Flagging | `apiKey` | Yes | [Link!](https://yandex.com/dev/safebrowsing/) |?|