# AlienVault — Wrapped API

> **You are on:** `https://api.paywithlocus.com/api` | [llms.txt](https://paywithlocus.com/llms.txt) | [docs](https://docs.paywithlocus.com)
>
> Locus runs on multiple environments -- make sure every URL you call matches your expected environment.
> | Environment | Landing | API | Docs |
> |---|---|---|---|
> | Production | paywithlocus.com | api.paywithlocus.com | docs.paywithlocus.com |
> | Beta | beta.paywithlocus.com | api.beta.paywithlocus.com | docs.paywithlocus.com |
> | Stage | stage.paywithlocus.com | api.stage.paywithlocus.com | docs.paywithlocus.com |
>
> If the API URL above doesn't match your expected environment, re-fetch this file from the correct domain.

> Search and analyze global threat intelligence data including indicators of compromise, threat pulses, and adversary profiles from the Open Threat Exchange community. Monitor recent security alerts and access detailed information about threats and adversaries to strengthen your cybersecurity defenses.

**Category:** Developer Tools | **Website:** [alienvault.com/](https://alienvault.com/) | **Docs:** [parse.bot/marketplace/7954e979-c5b0-467c-a8b4-6480777f3aa8/alienvault-com-api](https://parse.bot/marketplace/7954e979-c5b0-467c-a8b4-6480777f3aa8/alienvault-com-api)

Pay-per-use API proxy for Locus Pro. Each call burns credits from your workspace balance.

## Access

**Base URL:** `https://api.paywithlocus.com/api/wrapped/credits/alienvault/`
**Auth:** `Authorization: Bearer <LOCUS_CREDITS_SECRET_KEY>` (an `lcr_` secret key or a scoped `lcac_` agent credential)
**Required header:** `Idempotency-Key: <fresh UUID per call>`. A retry with the same key replays the stored result without a new charge.
**Response:** the provider response after any endpoint-specific normalization. `X-Locus-Credits-Charged` carries the charge and `X-Locus-Credits-Balance` the remaining balance. Insufficient credits return `402` before the provider is called.
**Pricing:** estimated costs below are USD. Locus debits the credit equivalent at your workspace rate.

Full call contract: https://docs.paywithlocus.com/api-reference/introduction

> Using a Pay With Locus wallet key (`claw_` prefix)? Wallet routes are documented separately: https://docs.paywithlocus.com/wrapped-apis/for-agents

## Endpoints

### Browse adversaries

Retrieve a paginated list of known threat actors/adversaries with descriptions and metadata. Each adversary includes a name, description, metadata (country, synonyms, references), and UUID.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `limit` | integer | No | Number of results per page. |
| `page` | integer | No | Page number for pagination. |
| `sort` | string | No | Sort order. |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/credits/alienvault/browse-adversaries \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"limit":"<integer>","page":"<integer>","sort":"<string>"}'
```

### Get adversary details

Retrieve details for a specific adversary by name. Performs case-insensitive matching against the full adversary list. Returns description, metadata (country, synonyms, references, capabilities, victimology), and UUID. Use browse_adversaries results[*].value to find valid names.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `name` | string | Yes | The name of the adversary (e.g. 'ALLANITE', 'APT 16'). Case-insensitive. |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/credits/alienvault/get-adversary-details \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name":"<string>"}'
```

### Get indicator details

Retrieve detailed threat intelligence for a specific indicator (IP, domain, URL, file hash, CVE). Returns reputation data, geolocation, associated pulses, validation status, and section-specific details. The 'general' section includes all core fields; other sections provide specialized views. Not all section/type combinations are available upstream.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `section` | string | No | Data section to retrieve. |
| `type` | string | Yes | Indicator type. |
| `value` | string | Yes | Indicator value (e.g. '8.8.8.8' for IPv4, 'example.com' for domain, 'CVE-2021-44228' for cve). |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/credits/alienvault/get-indicator-details \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"section":"<string>","type":"<string>","value":"<string>"}'
```

### Get pulse details

Retrieve full metadata for a specific threat intelligence pulse including tags, malware families, MITRE ATT&CK technique IDs, targeted countries, industries, and indicator counts. Returns a single pulse object. Use the pulse_id from search_pulses results.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `pulse_id` | string | Yes | The unique alphanumeric ID of the pulse (from search_pulses results[*].id). |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/credits/alienvault/get-pulse-details \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"pulse_id":"<string>"}'
```

### Get pulse indicators

Retrieve indicators of compromise (IOCs) associated with a pulse. Returns a paginated list of indicators with type, value, creation date, and activity status. Each indicator includes its type (IPv4, domain, FileHash-SHA256, CVE, URL, etc.) and the raw indicator value.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `limit` | integer | No | Number of indicators per page. |
| `page` | integer | No | Page number for pagination. |
| `pulse_id` | string | Yes | The unique alphanumeric ID of the pulse (from search_pulses results[*].id or get_pulse_details.id). |
| `sort` | string | No | Sort order for indicators. Accepted values: '-created' (newest first), 'created' (oldest first). |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/credits/alienvault/get-pulse-indicators \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"limit":"<integer>","page":"<integer>","pulse_id":"<string>","sort":"<string>"}'
```

### Get recent alerts

Retrieve the most recently modified threat intelligence pulses/alerts. Returns the same data shape as search_pulses, sorted by most recent modification. Equivalent to search_pulses with no query and sort=-modified.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `limit` | integer | No | Number of alerts to retrieve per page. |
| `page` | integer | No | Page number for pagination. |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/credits/alienvault/get-recent-alerts \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"limit":"<integer>","page":"<integer>"}'
```

### Search pulses

Full-text search over threat intelligence pulses by keyword, tag, or metadata. Returns paginated results sorted by modification date by default. Omitting the query returns all pulses. Each pulse summary includes indicator counts and author info but not the full indicator list (use get_pulse_indicators for that).

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `limit` | integer | No | Number of results per page. |
| `page` | integer | No | Page number for pagination. |
| `query` | string | No | Search keyword (e.g. 'cobalt strike', 'ransomware'). Omitting returns all pulses. |
| `sort` | string | No | Sort order for results. |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/credits/alienvault/search-pulses \
  -H "Authorization: Bearer $LOCUS_CREDITS_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"limit":"<integer>","page":"<integer>","query":"<string>","sort":"<string>"}'
```

## Next steps

- [All wrapped API providers](https://paywithlocus.com/wapi/index.md): pick another provider.
- [Find and call tools](https://paywithlocus.com/agent/tools.md): price ceilings, async results, and errors.
- [Credits and billing](https://paywithlocus.com/agent/billing.md): what a call costs and how to add credits.
- [Agent docs index](https://paywithlocus.com/agent/index.md): every Locus agent page.