API Documentation

Comprehensive guides and API references for integrating AntiBait's email threat detection into your applications.

IOC Threat Graph

Premium

Build relationship graphs for threat actor mapping and infrastructure visualization. Returns nodes and edges ready for graph visualization libraries.

API Endpoint

GET

GET/api/iocs/graph

Query Parameters

iocValue: string (required)
  // The IOC value to center the graph on

iocType?: string
  // Filter by specific IOC type

depth?: number (default: 2, max: 3)
  // Graph traversal depth

Response

{
  "success": true,
  "data": {
    "nodes": [...],
    "edges": [...]
  },
  "metadata": {
    "totalNodes": number,
    "totalEdges": number,
    "depth": number
  }
}

Example Request

Request

GET /api/iocs/[email protected]&iocType=email&depth=2
Authorization: Bearer YOUR_API_KEY

Response

{
  "success": true,
  "data": {
    "nodes": [
      {
        "id": "email:[email protected]",
        "type": "email",
        "value": "[email protected]",
        "isMalicious": true,
        "threatScore": 95,
        "occurrenceCount": 47,
        "firstSeen": "2025-10-15T08:20:00Z",
        "lastSeen": "2025-11-03T10:30:00Z"
      },
      {
        "id": "domain:evil.com",
        "type": "domain",
        "value": "evil.com",
        "isMalicious": true,
        "threatScore": 92,
        "occurrenceCount": 52,
        "firstSeen": "2025-10-15T08:20:00Z",
        "lastSeen": "2025-11-03T10:30:00Z"
      },
      {
        "id": "ip:203.0.113.1",
        "type": "ip",
        "value": "203.0.113.1",
        "isMalicious": true,
        "threatScore": 88,
        "occurrenceCount": 38,
        "firstSeen": "2025-10-20T12:00:00Z",
        "lastSeen": "2025-11-02T18:45:00Z"
      },
      {
        "id": "url:https://evil.com/phishing",
        "type": "url",
        "value": "https://evil.com/phishing",
        "isMalicious": true,
        "threatScore": 90,
        "occurrenceCount": 31,
        "firstSeen": "2025-10-18T14:30:00Z",
        "lastSeen": "2025-11-01T16:20:00Z"
      }
    ],
    "edges": [
      {
        "id": "email:[email protected]_uses_domain-domain:evil.com",
        "source": "email:[email protected]",
        "target": "domain:evil.com",
        "relationshipType": "email_uses_domain"
      },
      {
        "id": "email:[email protected]_from_ip-ip:203.0.113.1",
        "source": "email:[email protected]",
        "target": "ip:203.0.113.1",
        "relationshipType": "sent_from_ip"
      },
      {
        "id": "url:https://evil.com/phishing-url_contains_domain-domain:evil.com",
        "source": "url:https://evil.com/phishing",
        "target": "domain:evil.com",
        "relationshipType": "url_contains_domain"
      }
    ]
  },
  "metadata": {
    "totalNodes": 4,
    "totalEdges": 3,
    "depth": 2
  }
}

Node Structure

idstring

Unique node identifier in format "type:value"

typestring

IOC type (email, domain, ip, url, etc.)

valuestring

The actual IOC value

isMaliciousboolean

Whether the IOC is marked as malicious

threatScorenumber

Threat score (0-100)

occurrenceCountnumber

Number of times this IOC has been observed

firstSeendatetime

Timestamp when IOC was first observed

lastSeendatetime

Timestamp when IOC was last observed

Edge Structure

idstring

Unique edge identifier

sourcestring

Source node ID (in format "type:value")

targetstring

Target node ID (in format "type:value")

relationshipTypestring

Type of relationship (e.g., "email_uses_domain", "sent_from_ip", "url_contains_domain")

Compatible Visualization Libraries

D3.js

Force-directed graphs and custom visualizations

Cytoscape.js

Network analysis and visualization

vis.js

Interactive network graphs

Sigma.js

Large-scale graph rendering

Use Cases

Threat Actor Mapping

Visualize connections between attacker infrastructure and identify threat actor networks

Infrastructure Analysis

Map malicious infrastructure to understand attack patterns and shared resources

Incident Investigation

Trace relationships during security incidents to discover related IOCs

Proactive Blocking

Identify and block entire malicious infrastructure networks before they attack

Authentication Required

This endpoint requires a valid API key. Include your API key in the Authorization header as a Bearer token.

Performance Consideration

Graph depth is limited to 3 levels to prevent excessive queries. For highly connected IOCs, start with depth=1 or depth=2 and expand selectively.

Need help integrating our API? Our support team is here to assist you.

Contact • View FAQ • Manage API Keys