---
title: "Get the list of Cyber Threat Feed events."
method: GET
path: "/api/v2/threat-feed-events"
tags: ["Cyber Threat Feed"]
---

# Get the list of Cyber Threat Feed events.

`GET /api/v2/threat-feed-events`

## Request

- Base URL: `https://app.blackkitetech.com`
- URL: `https://app.blackkitetech.com/api/v2/threat-feed-events`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://app.blackkitetech.com//api/v2/oauth/token`
- TypeScript: <https://skmtc.dev/blackkitetech/apis/black-kite-api/docs/api/v2/threat-feed-events/get.ts> (a function with typed inputs; its response is checked against the schema)

List the Cyber Threat Feed events matched by a previously created search key, in the Black Kite JSON format. The search criteria are re-run against the live feed on every request. List responses omit the Advisories field; use the single event endpoint to retrieve it.

## Query parameters

- `search_key` string, required
- `page_number` integer
- `page_size` 10 | 20 | 30 | 50 | 100 | 250

## Response `200`

Success

- ThreatFeedEvent[]
  - `EventId` string: The unique identifier of the event (string UUIDv7).
  - `SchemaVersion` string: The version of the event schema.
  - `LifecycleState` 'Active' | 'Merged' | 'Retracted' | 'Superseded': The current lifecycle state of the event.
  - `MergedInto` string, nullable: When the event has been merged into another event, the id of the surviving event. Null otherwise.
  - `EventType` 'Data Breach' | 'Ransomware' | 'Vulnerability' | 'Advisory' | 'Hacktivist' | 'Social' | 'Incident' | 'Credential Exposure' | 'Data Leak' | 'Threat Actor Activity' | 'Research Report': The type of the event.
  - `Severity` 'Informational' | 'Low' | 'Medium' | 'High' | 'Critical', nullable: The severity assigned to the event.
  - `Title` string, nullable: A short title describing the event.
  - `Companies` object[]: The companies mentioned by the event, together with their role.
    - `CompanyId` number, nullable: The Black Kite company id (BKID). This is the primary company key.
    - `CompanyName` string, nullable: The name of the company.
    - `Domain` string, nullable: The registrable domain of the company. Secondary company key.
    - `Role` 'Affected' | 'Producer' | 'Publisher' | 'Mentioned': The role of the company within the event.
    - `CountryCode` string, nullable: The ISO-3166-1 alpha-2 country code of the company.
    - `Industry` string, nullable: The industry description of the company.
    - `NaicsCode` string, nullable: The 4 digit NAICS code of the company.
  - `Summary` string, nullable: A summary describing the event.
  - `Links` string[]: Reference links related to the event.
  - `FeedMentionCount` number: The number of distinct sources that mentioned the event.
  - `AffectedProducts` object[]: The distinct products affected by the event. CPEs of a product are nested under Cpes.
    - `ProductName` string: The name of the affected product.
    - `ProductId` number, nullable: The Black Kite product id. This identifier is reserved for future use and is not currently populated (returns null).
    - `Cpes` string[]: The CPEs associated with the product.
  - `Vulnerabilities` object[]: The vulnerabilities (CVEs) associated with the event.
    - `Cve` string: The CVE id of the vulnerability.
    - `VulnerabilityId` number, nullable: The Black Kite vulnerability id. This identifier is reserved for future use and is not currently populated (returns null).
  - `FocusTags` string[]: The focus tags associated with the event.
  - `ThreatActors` string[]: The threat actors associated with the event.
  - `Advisories` object, nullable: Advisory details of the event. Only returned by the single event endpoint; omitted (null) in list responses.
    - `summary` string, nullable: A summary of the advisory.
    - `cisa_advisory` string, nullable: The related CISA advisory reference, when applicable.
    - `recommendations` string[]: Recommended actions to mitigate the event.
    - `other_advisories` string[]: Other related advisories.
    - `vendor_advisories` string[]: Vendor-published advisories.
  - `EventDate` string, date-time: The real-world date and time the event occurred. This value never changes.
  - `FirstSeenDate` string, date-time: The date and time the event was first ingested.
  - `UpdateDate` string, date-time: The date and time the event was last updated. Use this value with UpdatedSince to synchronise incrementally.

## Other responses

- `400`: BadRequest
- `401`: Unauthorized
- `404`: NotFound
- `default`: Failure

## Changes

- **2026-10-02** `f1e937bdbbbd`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/blackkitetech/apis/black-kite-api/changes/api/v2/threat-feed-events/get.md)

---

[API](https://skmtc.dev/blackkitetech/apis/black-kite-api.md) - [All operations](https://skmtc.dev/blackkitetech/apis/black-kite-api/llms.txt) - [OpenAPI document](https://skmtc.dev/blackkitetech/apis/black-kite-api/revisions/fc42796447f4?raw)