For teams

Threat Wire API

One read-only endpoint that puts the wire into your own tooling: a SOAR playbook, a nightly enrichment job, a dashboard. JSON, CSV or STIX 2.1.

what it is, and is not

It reads. There is no write surface at all, and a key can see only its own organisation’s entitlements. It is designed for a scheduled pull rather than per-request lookups, which is what the 500-a-day limit reflects.

Included in Pro+ and Team. Keys are issued from your team page once you have one of those.

authentication

A bearer token in the Authorization header. Keys begin sa_, carry scopes, and can be revoked instantly from the team page.

request

curl -H "Authorization: Bearer sa_YOUR_KEY_HERE" \
  "https://securityartifacts.com/threat-wire/export?format=json&since=2026-09-01T00:00:00Z&limit=500"

We store only a SHA-256 of each key, so it cannot be read back out and a database dump authenticates nobody. If a key is lost, revoke it and issue another; there is no recovery path and that is the point.

parameters

name	values	default	notes
`format`	`json \| csv \| stix`	`json`	STIX 2.1 bundles of indicator and vulnerability objects, for a TIP that ingests them directly.
`since`	`ISO 8601 timestamp`	`—`	Only entries published at or after this. What an incremental pull uses.
`severity`	`critical \| high \| medium \| low`	`—`	Exact match, not a floor. Ask twice for two levels.
`kev_only`	`true \| false`	`false`	Restrict to vulnerabilities on the CISA Known Exploited catalogue.
`limit`	`1 to 1000`	`200`	Rows per request.

response

JSON responses carry a meta object recording the format, the filters applied and the row count, so a pipeline can assert it got what it asked for rather than trusting that it did.

json

{
  "meta": {
    "generated_at": "2026-09-01T04:00:12.114Z",
    "format": "json",
    "count": 137,
    "filters": { "since": "2026-08-31T00:00:00Z", "severity": null, "kev_only": false }
  },
  "items": [
    {
      "id": "…",
      "title": "…",
      "source": "CISA KEV",
      "cve": "CVE-2026-…",
      "severity": "critical",
      "kev": true,
      "published_at": "2026-08-31T18:02:00Z",
      "url": "https://…"
    }
  ]
}

format=csv returns the same fields flat, with a header row. format=stix returns a STIX 2.1 bundle.

limits

500 requests per key per UTC day, counted lazily and reset on the first request of a new day. Generous for a scheduled pull, low enough that a scrape is visible. Up to 1000 rows per request.

Ten live keys per organisation. That ceiling exists because key sprawl is how a credential outlives the person who created it, and how nobody notices one has leaked.

errors

status	error	meaning
`401`	`invalid_key_format`	The header was missing, or the key did not begin with sa_.
`401`	`invalid_key`	No such key, or it has been revoked or has expired. Deliberately the same response for all three: anything else would say which keys once existed.
`403`	`insufficient_scope`	The key is valid but was not issued with threat_wire:read.
`402`	`upgrade_required`	The owning subscription is not on a plan that includes the API, or has lapsed.
`429`	`rate_limited`	Over 500 requests for the current UTC day. Carries Retry-After.
`400`	`invalid_query`	A parameter failed validation. The response names the field.

a nightly pull

cron

#!/usr/bin/env bash
# Yesterday's entries, KEV only, as STIX for the TIP.
set -euo pipefail

SINCE=$(date -u -d 'yesterday 00:00' +%Y-%m-%dT%H:%M:%SZ)

curl --fail --silent --show-error \
  -H "Authorization: Bearer $SA_API_KEY" \
  "https://securityartifacts.com/threat-wire/export?format=stix&kev_only=true&since=$SINCE&limit=1000" \
  -o "/var/tmp/wire-$(date -u +%F).json"

Keep the key in your own secret store rather than in the script. --failmatters: without it curl writes the error body to your output file and exits zero, and your pipeline ingests a 402 as intelligence.

getting a key

Pro+ includes one seat and the API. Team adds seats from 3 up and one invoice. Either way, keys are created and revoked from your team page, and the plaintext is shown exactly once.

See both plans

Evaluating this for a pipeline and need something the docs do not cover? Ask, and the answer goes on this page rather than into an email only you can read.