# AlienVault — Wrapped API

> **You are on:** `https://api.paywithlocus.com/api` | [llms.txt](https://paywithlocus.com/llms.txt) | [docs](https://docs.paywithlocus.com)
>
> Locus runs on multiple environments -- make sure every URL you call matches your expected environment.
> | Environment | Landing | API | Docs |
> |---|---|---|---|
> | Production | paywithlocus.com | api.paywithlocus.com | docs.paywithlocus.com |
> | Beta | beta.paywithlocus.com | api.beta.paywithlocus.com | docs.paywithlocus.com |
> | Stage | stage.paywithlocus.com | api.stage.paywithlocus.com | docs.paywithlocus.com |
>
> If the API URL above doesn't match your expected environment, re-fetch this file from the correct domain.

> Search and analyze global threat intelligence data including indicators of compromise, threat pulses, and adversary profiles from the Open Threat Exchange community. Monitor recent security alerts and access detailed information about threats and adversaries to strengthen your cybersecurity defenses.

**Category:** Developer Tools | **Website:** [alienvault.com/](https://alienvault.com/) | **Docs:** [parse.bot/marketplace/7954e979-c5b0-467c-a8b4-6480777f3aa8/alienvault-com-api](https://parse.bot/marketplace/7954e979-c5b0-467c-a8b4-6480777f3aa8/alienvault-com-api)

Pay-per-use API proxy. Each call is automatically billed to your wallet in USDC.

## Access

**Base URL:** `https://api.paywithlocus.com/api/wrapped/parse-alienvault-com-api-7954e979/`
**Auth:** `Authorization: Bearer <LOCUS_API_KEY>`

## Endpoints

### browse_adversaries

Retrieve a paginated list of known threat actors/adversaries with descriptions and metadata. Each adversary includes a name, description, metadata (country, synonyms, references), and UUID.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `limit` | integer | No | Number of results per page. |
| `page` | integer | No | Page number for pagination. |
| `sort` | string | No | Sort order. |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-alienvault-com-api-7954e979/browse_adversaries \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"limit":"<integer>","page":"<integer>","sort":"<string>"}'
```

### get_adversary_details

Retrieve details for a specific adversary by name. Performs case-insensitive matching against the full adversary list. Returns description, metadata (country, synonyms, references, capabilities, victimology), and UUID. Use browse_adversaries results[*].value to find valid names.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `name` | string | Yes | The name of the adversary (e.g. 'ALLANITE', 'APT 16'). Case-insensitive. |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-alienvault-com-api-7954e979/get_adversary_details \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"<string>"}'
```

### get_indicator_details

Retrieve detailed threat intelligence for a specific indicator (IP, domain, URL, file hash, CVE). Returns reputation data, geolocation, associated pulses, validation status, and section-specific details. The 'general' section includes all core fields; other sections provide specialized views. Not all section/type combinations are available upstream.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `section` | string | No | Data section to retrieve. |
| `type` | string | Yes | Indicator type. |
| `value` | string | Yes | Indicator value (e.g. '8.8.8.8' for IPv4, 'example.com' for domain, 'CVE-2021-44228' for cve). |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-alienvault-com-api-7954e979/get_indicator_details \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"section":"<string>","type":"<string>","value":"<string>"}'
```

### get_pulse_details

Retrieve full metadata for a specific threat intelligence pulse including tags, malware families, MITRE ATT&CK technique IDs, targeted countries, industries, and indicator counts. Returns a single pulse object. Use the pulse_id from search_pulses results.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `pulse_id` | string | Yes | The unique alphanumeric ID of the pulse (from search_pulses results[*].id). |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-alienvault-com-api-7954e979/get_pulse_details \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"pulse_id":"<string>"}'
```

### get_pulse_indicators

Retrieve indicators of compromise (IOCs) associated with a pulse. Returns a paginated list of indicators with type, value, creation date, and activity status. Each indicator includes its type (IPv4, domain, FileHash-SHA256, CVE, URL, etc.) and the raw indicator value.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `limit` | integer | No | Number of indicators per page. |
| `page` | integer | No | Page number for pagination. |
| `pulse_id` | string | Yes | The unique alphanumeric ID of the pulse (from search_pulses results[*].id or get_pulse_details.id). |
| `sort` | string | No | Sort order for indicators. Accepted values: '-created' (newest first), 'created' (oldest first). |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-alienvault-com-api-7954e979/get_pulse_indicators \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"limit":"<integer>","page":"<integer>","pulse_id":"<string>","sort":"<string>"}'
```

### get_recent_alerts

Retrieve the most recently modified threat intelligence pulses/alerts. Returns the same data shape as search_pulses, sorted by most recent modification. Equivalent to search_pulses with no query and sort=-modified.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `limit` | integer | No | Number of alerts to retrieve per page. |
| `page` | integer | No | Page number for pagination. |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-alienvault-com-api-7954e979/get_recent_alerts \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"limit":"<integer>","page":"<integer>"}'
```

### search_pulses

Full-text search over threat intelligence pulses by keyword, tag, or metadata. Returns paginated results sorted by modification date by default. Omitting the query returns all pulses. Each pulse summary includes indicator counts and author info but not the full indicator list (use get_pulse_indicators for that).

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `limit` | integer | No | Number of results per page. |
| `page` | integer | No | Page number for pagination. |
| `query` | string | No | Search keyword (e.g. 'cobalt strike', 'ransomware'). Omitting returns all pulses. |
| `sort` | string | No | Sort order for results. |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-alienvault-com-api-7954e979/search_pulses \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"limit":"<integer>","page":"<integer>","query":"<string>","sort":"<string>"}'
```