---
title: "Get a single Cyber Threat Feed event."
method: GET
path: "/api/v2/threat-feed-events/{eventId}"
tags: ["Cyber Threat Feed"]
---

# Get a single Cyber Threat Feed event.

`GET /api/v2/threat-feed-events/{eventId}`

## Request

- Base URL: `https://app.blackkitetech.com`
- URL: `https://app.blackkitetech.com/api/v2/threat-feed-events/{eventId}`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://app.blackkitetech.com//api/v2/oauth/token`
- TypeScript: <https://skmtc.dev/blackkitetech/apis/black-kite-api/docs/api/v2/threat-feed-events/:eventId/get.ts> (a function with typed inputs; its response is checked against the schema)

Get a single Cyber Threat Feed event by its id, in the Black Kite JSON format. Merged, retracted and superseded events are returned (HTTP 200) so consumers can learn why an event was removed and which event superseded it. This endpoint includes the Advisories field.

## Path parameters

- `eventId` string, required

## Response `200`

Success

- ThreatFeedEvent: A single Cyber Threat Feed event in the Black Kite JSON format.
  - `EventId` string: The unique identifier of the event (string UUIDv7).
  - `SchemaVersion` string: The version of the event schema.
  - `LifecycleState` 'Active' | 'Merged' | 'Retracted' | 'Superseded': The current lifecycle state of the event.
  - `MergedInto` string, nullable: When the event has been merged into another event, the id of the surviving event. Null otherwise.
  - `EventType` 'Data Breach' | 'Ransomware' | 'Vulnerability' | 'Advisory' | 'Hacktivist' | 'Social' | 'Incident' | 'Credential Exposure' | 'Data Leak' | 'Threat Actor Activity' | 'Research Report': The type of the event.
  - `Severity` 'Informational' | 'Low' | 'Medium' | 'High' | 'Critical', nullable: The severity assigned to the event.
  - `Title` string, nullable: A short title describing the event.
  - `Companies` object[]: The companies mentioned by the event, together with their role.
    - `CompanyId` number, nullable: The Black Kite company id (BKID). This is the primary company key.
    - `CompanyName` string, nullable: The name of the company.
    - `Domain` string, nullable: The registrable domain of the company. Secondary company key.
    - `Role` 'Affected' | 'Producer' | 'Publisher' | 'Mentioned': The role of the company within the event.
    - `CountryCode` string, nullable: The ISO-3166-1 alpha-2 country code of the company.
    - `Industry` string, nullable: The industry description of the company.
    - `NaicsCode` string, nullable: The 4 digit NAICS code of the company.
  - `Summary` string, nullable: A summary describing the event.
  - `Links` string[]: Reference links related to the event.
  - `FeedMentionCount` number: The number of distinct sources that mentioned the event.
  - `AffectedProducts` object[]: The distinct products affected by the event. CPEs of a product are nested under Cpes.
    - `ProductName` string: The name of the affected product.
    - `ProductId` number, nullable: The Black Kite product id. This identifier is reserved for future use and is not currently populated (returns null).
    - `Cpes` string[]: The CPEs associated with the product.
  - `Vulnerabilities` object[]: The vulnerabilities (CVEs) associated with the event.
    - `Cve` string: The CVE id of the vulnerability.
    - `VulnerabilityId` number, nullable: The Black Kite vulnerability id. This identifier is reserved for future use and is not currently populated (returns null).
  - `FocusTags` string[]: The focus tags associated with the event.
  - `ThreatActors` string[]: The threat actors associated with the event.
  - `Advisories` object, nullable: Advisory details of the event. Only returned by the single event endpoint; omitted (null) in list responses.
    - `summary` string, nullable: A summary of the advisory.
    - `cisa_advisory` string, nullable: The related CISA advisory reference, when applicable.
    - `recommendations` string[]: Recommended actions to mitigate the event.
    - `other_advisories` string[]: Other related advisories.
    - `vendor_advisories` string[]: Vendor-published advisories.
  - `EventDate` string, date-time: The real-world date and time the event occurred. This value never changes.
  - `FirstSeenDate` string, date-time: The date and time the event was first ingested.
  - `UpdateDate` string, date-time: The date and time the event was last updated. Use this value with UpdatedSince to synchronise incrementally.

## Other responses

- `400`: BadRequest
- `401`: Unauthorized
- `404`: NotFound
- `default`: Failure

## Changes

- **2026-10-02** `f1e937bdbbbd`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/blackkitetech/apis/black-kite-api/changes/api/v2/threat-feed-events/:eventId/get.md)

---

[API](https://skmtc.dev/blackkitetech/apis/black-kite-api.md) - [All operations](https://skmtc.dev/blackkitetech/apis/black-kite-api/llms.txt) - [OpenAPI document](https://skmtc.dev/blackkitetech/apis/black-kite-api/revisions/fc42796447f4?raw)