---
title: "Search through the Cyber Threat Feed events."
method: POST
path: "/api/v2/threat-feed-searches"
tags: ["Cyber Threat Feed"]
---

# Search through the Cyber Threat Feed events.

`POST /api/v2/threat-feed-searches`

## Request

- Base URL: `https://app.blackkitetech.com`
- URL: `https://app.blackkitetech.com/api/v2/threat-feed-searches`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://app.blackkitetech.com//api/v2/oauth/token`
- TypeScript: <https://skmtc.dev/blackkitetech/apis/black-kite-api/docs/api/v2/threat-feed-searches/post.ts> (a function with typed inputs; its response is checked against the schema)

Create a search operation over all public Cyber Threat Feed events. This endpoint does not return the resulting events, instead it returns a search key that can be used with the getThreatFeedEvents operation to list the events found. At least one search criterion is required; values inside an array are OR-ed and distinct arrays are AND-ed. 
 **Attention**: Every unique client id can create a maximum of 100000 search keys per day. 
 **Attention**: All array type search criteria may take a maximum of 100000 values each.

## Request body

- object
  - `GenericSearchText` string: A generic search text searched over the event title, summary, company name, threat actor and product name.
  - `EventTypes` string[], nullable: The list of event types to match.
  - `Severities` string[], nullable: The list of severities to match.
  - `LifecycleStates` string[], nullable: The list of lifecycle states to match. Defaults to Active only when omitted.
  - `CompanyDomains` string[], nullable: The list of exact registrable company domains to match. Secondary company filter; prefer CompanyIds.
  - `CompanyNames` string[], nullable: The list of company names to match (partial match).
  - `CompanyRoles` string[], nullable: The list of company roles used to narrow the company matches.
  - `CountryCodes` string[], nullable: The list of ISO-3166-1 alpha-2 country codes to match.
  - `NaicsCodes` string[], nullable: The list of 4 digit NAICS codes to match.
  - `CompanyIds` number[], nullable: The list of Black Kite company ids (BKID) to match. This is the primary company filter.
  - `ProductNames` string[], nullable: The list of product names to match (partial match).
  - `Cpes` string[], nullable: The list of CPEs to match. An event matches when any of its products carries any of the given CPEs.
  - `Cves` string[], nullable: The list of CVE ids to match (exact match).
  - `ProductIds` number[], nullable: The list of Black Kite product ids to match. This identifier is reserved for future use and is not currently populated.
  - `VulnerabilityIds` number[], nullable: The list of Black Kite vulnerability ids to match. This identifier is reserved for future use and is not currently populated.
  - `FocusTags` string[], nullable: The list of focus tags to match.
  - `ThreatActors` string[], nullable: The list of threat actors to match.
  - `EventStartDate` string, date-time: The earliest EventDate to match. The range between EventStartDate and EventEndDate can be at most 90 days.
  - `EventEndDate` string, date-time: The latest EventDate to match. The range between EventStartDate and EventEndDate can be at most 90 days.
  - `UpdatedSince` string, date-time: Only match events whose UpdateDate is later than this value. Use together with SortBy=UpdateDate for incremental synchronisation.
  - `SortBy` 'EventDate' | 'UpdateDate' | 'FeedMentionCount' | 'Severity': The field to sort the results by.
  - `SortOrder` 'Ascending' | 'Descending': The sort direction.

## Response `200`

Success

- object
  - `Key` string, required: A key in GUID format pointing to the newly created search action. Use this key with the getThreatFeedEvents operation as the search_key query parameter to fetch the results.

## Other responses

- `400`: BadRequest
- `401`: Unauthorized
- `default`: Failure

## Changes

- **2026-10-02** `f1e937bdbbbd`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/blackkitetech/apis/black-kite-api/changes/api/v2/threat-feed-searches/post.md)

---

[API](https://skmtc.dev/blackkitetech/apis/black-kite-api.md) - [All operations](https://skmtc.dev/blackkitetech/apis/black-kite-api/llms.txt) - [OpenAPI document](https://skmtc.dev/blackkitetech/apis/black-kite-api/revisions/fc42796447f4?raw)