# Threat Intelligence API API

> Threat Intelligence API API on Apizie: 19 endpoints (Triggers the generation of a Customer Profile for a project., Marks an alert as benign - BENIGN., Marks an alert as a duplicate of another alert. - DUPLICATE., EnumerateAlertFacets returns the facets and the number of alerts that meet the filter criteria and have that…, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://apizie.tech/v1/dev-tools:google-threatintelligence/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `dev-tools:google-threatintelligence`
- Category: Dev Tools
- Status: byok
- Source: https://docs.cloud.google.com/threatintelligence/
- Page: https://apizie.tech/api/dev-tools/google-threatintelligence
- OpenAPI: https://apizie.tech/api/dev-tools/google-threatintelligence/openapi.json

threatintelligence.googleapis.com API.

## Endpoints

### Triggers the generation of a Customer Profile for a project.
`POST https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-generate-org-profile` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. The name of the project to generate the profile for. Format: projects/{project} |
| body | object | yes | JSON request body |

### Marks an alert as benign - BENIGN.
`POST https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-alerts-benign` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the alert to mark as a benign. Format: projects/{project}/alerts/{alert} |
| body | object | yes | JSON request body |

### Marks an alert as a duplicate of another alert. - DUPLICATE.
`POST https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-alerts-duplicate` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the alert to mark as a duplicate. Format: projects/{project}/alerts/{alert} |
| body | object | yes | JSON request body |

### EnumerateAlertFacets returns the facets and the number of alerts that meet the filter criteria and have that…
`GET https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-alerts-enumerate-facets` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| filter | string | no | Optional. Filter on what alerts will be enumerated. |
| parent | string | yes | Required. Parent of the alerts. |

### Marks an alert as escalated - ESCALATED.
`POST https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-alerts-escalate` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the alert to mark as escalated. Format: projects/{project}/alerts/{alert} |
| body | object | yes | JSON request body |

### Marks an alert as a false positive - FALSE_POSITIVE.
`POST https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-alerts-false-positive` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the alert to mark as a false positive. Format: projects/{project}/alerts/{alert} |
| body | object | yes | JSON request body |

### Get a finding by name. The `name` field should have the format: `projects/{project}/findings/{finding}`
`GET https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-findings-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the finding to get. |

### Get the decrypted password of an alert.
`GET https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-alerts-get-password` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the alert to get password for. Format: projects/{project}/alerts/{alert} |

### Get a list of alerts that meet the filter criteria.
`GET https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-alerts-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| filter | string | no | Optional. Filter criteria. Supported fields for filtering include: * `audit.create_time` * `audit.creator` * `audit.update_time` *… |
| orderBy | string | no | Optional. Order by criteria in the csv format: "field1, field2 desc" or "field1, field2" or "field1 asc, field2". If a field is specified… |
| pageSize | integer | no | Optional. Page size. Default to 100 alerts per page. Maximum is 1000 alerts per page. |
| pageToken | string | no | Optional. Page token to retrieve the next page of results. |
| parent | string | yes | Required. Parent of the alerts. Format: projects/{project} |

### Marks an alert as not actionable - NOT_ACTIONABLE.
`POST https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-alerts-not-actionable` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the alert to mark as a not actionable. Format: projects/{project}/alerts/{alert} |
| body | object | yes | JSON request body |

### Marks an alert as read - READ.
`POST https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-alerts-read` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the alert to mark as read. Format: projects/{project}/alerts/{alert} |
| body | object | yes | JSON request body |

### Marks an alert to closed state - RESOLVED.
`POST https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-alerts-resolve` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the alert to mark as resolved. Format: projects/{project}/alerts/{alert} |
| body | object | yes | JSON request body |

### Marks an alert as tracked externally - TRACKED_EXTERNALLY.
`POST https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-alerts-track-externally` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the alert to mark as tracked externally. Format: projects/{project}/alerts/{alert} |
| body | object | yes | JSON request body |

### Marks an alert as triaged - TRIAGED.
`POST https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-alerts-triage` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | yes | Required. Name of the alert to mark as a triaged. Format: projects/{project}/alerts/{alert} |
| body | object | yes | JSON request body |

### Get a list of configurations that meet the filter criteria.
`GET https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-configurations-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| filter | string | no | Optional. Filter criteria. |
| orderBy | string | no | Optional. Order by criteria in the csv format: "field1,field2 desc" or "field1,field2" or "field1 asc, field2". |
| pageSize | integer | no | Optional. Page size. |
| pageToken | string | no | Optional. Page token. |
| parent | string | yes | Required. Parent of the configuration. Format: vaults/{vault} |

### Creates or updates a configuration.
`POST https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-configurations-upsert` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| parent | string | yes | Required. Parent of the configuration. |
| publishTime | string | no | Optional. Time that the configuration should be considered to have been published. This is an advanced feature used when onboarding and… |
| body | object | yes | JSON request body |

### List configuration revisions that meet the filter criteria.
`GET https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-configurations-revisions-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| filter | string | no | Optional. An AIP-160 filter string |
| orderBy | string | no | Optional. Specify ordering of response |
| pageSize | integer | no | Optional. Page Size |
| pageToken | string | no | Optional. A page token provided by the API |
| parent | string | yes | Required. The name of the Configuration to retrieve Revisions for |

### Get a list of findings that meet the filter criteria. The `parent` field in ListFindingsRequest should have…
`GET https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-findings-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| filter | string | no | Optional. Filter criteria. |
| orderBy | string | no | Optional. Order by criteria in the csv format: "field1,field2 desc" or "field1,field2" or "field1 asc, field2". |
| pageSize | integer | no | Optional. Page size. |
| pageToken | string | no | Optional. Page token. |
| parent | string | yes | Required. Parent of the findings. |

### SearchFindings is a more powerful version of ListFindings that supports complex queries like "findings for…
`GET https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-findings-search` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| orderBy | string | no | Optional. Order by criteria in the csv format: "field1,field2 desc" or "field1,field2" or "field1 asc, field2". |
| pageSize | integer | no | Optional. Page size. |
| pageToken | string | no | Optional. Page token. |
| parent | string | yes | Required. Parent of the findings. Format: vaults/{vault} |
| query | string | no | Optional. Query on what findings will be returned. This supports the same filter criteria as FindingService.ListFindings as well as the… |

## Example
```
curl "https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-generate-org-profile" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Threat Intelligence API API?
Create a free Apizie key, then send POST https://apizie.tech/v1/dev-tools:google-threatintelligence/threatintelligence-projects-generate-org-profile with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Threat Intelligence API API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Threat Intelligence API itself also needs your own key from googleapis.com.

### Can AI agents use the Threat Intelligence API API?
Yes. Add the Apizie MCP server (https://apizie.tech/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key dev-tools:google-threatintelligence.

### What is the status of the Threat Intelligence API API?
Needs your own provider key (bring your own key)